Paypal "You Just Sent a Payment" spam leads to malware

A new malicious spam campaign has just launched this morning targeting Paypal users. This malware campaign attempts to "social engineer" users into clicking a link that they know they shouldn't click on! Here's the email:

The criminals believe (and from what we've seen, correctly) that when presented with the news that you just sent $100 to someone from your Paypal account, you will have a panic reaction and click on the link in the email. This is what they are counting on!

As you can see we got quite a few of these this morning:

The destination is NOT going to be Paypal. Don't click on the link, and tell your friends not to click on the link either! If they do, a bad set of malicious actions are set into motion.

This particular version of the campaign just started about 2.5 hours ago. Here are the number of messages we have seen so far:

 count |        mbox         
-------+---------------------
    22 | 2012-05-01 04:00:00
    22 | 2012-05-01 04:15:00
   312 | 2012-05-01 04:30:00
    41 | 2012-05-01 04:45:00
    15 | 2012-05-01 05:00:00
    78 | 2012-05-01 05:15:00
   241 | 2012-05-01 05:30:00
     1 | 2012-05-01 05:45:00
   210 | 2012-05-01 06:00:00
    91 | 2012-05-01 06:15:00
(10 rows)

There are many hundreds of links that may have been advertised in your copy of this email, but don't click on ANY of them!

In the example case that we checked, we followed a link to "globalsecurityservices.com" (yes, we like irony).

When the web page was visited, it immediately executed two remote javascript files (I've added spaces to "break" them):

script type="text/javascript" src="http:// laxana .org /1VxMC4Dy /js .js"
script type="text/javascript" src="http:// womaametw3 .com /CWTKosSw /js .js"
which redirected to an Exploit server that displayed this "Please Wait" sign while something more malicious was happening in the background.

The exploit kit dropped a Java "JAR" file that was launched in Java, taking advantage of a security hole, which then caused another executable file to download and install on the computer.

What was that executable? We're not sure yet, but your anti-virus product probably doesn't know either. At the time we submitted the malware to VirusTotal there were only 5 of 43 anti-virus products could label the malware as malicious. Although McAfee called it "Zbot" (PWS-Zbot.gen.ya, the anti-virus name for the Zeus Bot) Avast and one other vendor called it "Karagany" (Win32:Karagany-FS [Trj]).

The malware's MD5 was 4f58895af2b8f89bd90092f08fcbd54f and it was 33280 bytes in size.

Here's a link to the original VirusTotal report.

Previous Threats

This link is very closely linked to a "LinkedIn" spam campaign from yesterday. That campaign functioned in exactly the same manner, with the difference only in the spam campaign.

All of the domains listed below have been compromised by an attacker. Most likely the criminals have stolen the FTP userid and password of the criminal, allowing them to change the webmaster's content without the webmaster's knowledge. If you control or know the owner of one of these websites, let them know they have been hacked. They need to remove the content, scan any computers they use to access their website for malware, and change their password AFTER they get the malware cleaned up.

            machine            |         path         
-------------------------------+----------------------
 cpaindia.net                  | /rHFbxKTn/index.html
 dealaddict.ch                 | /bp9ksV54/index.html
 dealaddict.ch                 | /N2rhmW5i/index.html
 dealaddict.ch                 | /r1kVYAfU/index.html
 dealaddict.ch                 | /vpW8hoZ6/index.html
 depilee.com                   | /BzJoVeo0/index.html
 depilee.com                   | /Lskx0Bew/index.html
 depilee.com                   | /NdHgm0gT/index.html
 depilee.com                   | /oZFZ0qJK/index.html
 depilee.com                   | /pD2zHbBB/index.html
 depilee.com                   | /vpW8hoZ6/index.html
 depilee.com                   | /wcE0aK0J/index.html
 depilee.com                   | /wjivLtgo/index.html
 dpsdurgapur.com               | /4RcYf6gB/index.html
 dpsdurgapur.com               | /7QLZuMme/index.html
 dpsdurgapur.com               | /bp9ksV54/index.html
 dpsdurgapur.com               | /BzJoVeo0/index.html
 dpsdurgapur.com               | /ErmgUouT/index.html
 dpsdurgapur.com               | /gj1W42Ee/index.html
 dpsdurgapur.com               | /i8ztSS5H/index.html
 dpsdurgapur.com               | /iaJ7FSBi/index.html
 dpsdurgapur.com               | /mKvc8Mh7/index.html
 dpsdurgapur.com               | /N2rhmW5i/index.html
 dpsdurgapur.com               | /NdHgm0gT/index.html
 dpsdurgapur.com               | /oZFZ0qJK/index.html
 dpsdurgapur.com               | /pD2zHbBB/index.html
 dpsdurgapur.com               | /rHFbxKTn/index.html
 dpsdurgapur.com               | /rzDZAsw7/index.html
 dpsdurgapur.com               | /t7xYVUJE/index.html
 dpsdurgapur.com               | /tLnW6jJT/index.html
 dpsdurgapur.com               | /UAtkgmot/index.html
 dpsdurgapur.com               | /UcL29wrU/index.html
 dpsdurgapur.com               | /vpW8hoZ6/index.html
 dpsdurgapur.com               | /wtQ8G0Ku/index.html
 dpsdurgapur.com               | /YhwvXGhk/index.html
 dpsdurgapur.com               | /zvo8ioak/index.html
 enfoquescreativos.com         | /4RcYf6gB/index.html
 enfoquescreativos.com         | /7NEM56yQ/index.html
 enfoquescreativos.com         | /7QLZuMme/index.html
 enfoquescreativos.com         | /bp9ksV54/index.html
 enfoquescreativos.com         | /BzJoVeo0/index.html
 enfoquescreativos.com         | /ddLvpeMu/index.html
 enfoquescreativos.com         | /DkM4v1PP/index.html
 enfoquescreativos.com         | /gj1W42Ee/index.html
 enfoquescreativos.com         | /N2rhmW5i/index.html
 enfoquescreativos.com         | /oZFZ0qJK/index.html
 enfoquescreativos.com         | /r1kVYAfU/index.html
 enfoquescreativos.com         | /Re3BMGVG/index.html
 enfoquescreativos.com         | /rHFbxKTn/index.html
 enfoquescreativos.com         | /RoScD8aq/index.html
 enfoquescreativos.com         | /rzDZAsw7/index.html
 enfoquescreativos.com         | /UAtkgmot/index.html
 enfoquescreativos.com         | /vpW8hoZ6/index.html
 enfoquescreativos.com         | /wjivLtgo/index.html
 enfoquescreativos.com         | /wtQ8G0Ku/index.html
 enfoquescreativos.com         | /YhwvXGhk/index.html
 enfoquescreativos.com         | /zvo8ioak/index.html
 ftp.neez.com.br               | /4RcYf6gB/index.html
 ftp.neez.com.br               | /7NEM56yQ/index.html
 ftp.neez.com.br               | /7QLZuMme/index.html
 ftp.neez.com.br               | /ErmgUouT/index.html
 ftp.neez.com.br               | /gj1W42Ee/index.html
 ftp.neez.com.br               | /mKvc8Mh7/index.html
 ftp.neez.com.br               | /NdHgm0gT/index.html
 ftp.neez.com.br               | /oZFZ0qJK/index.html
 ftp.neez.com.br               | /pSG1s2xs/index.html
 ftp.neez.com.br               | /Re3BMGVG/index.html
 ftp.neez.com.br               | /rzDZAsw7/index.html
 ftp.neez.com.br               | /t7xYVUJE/index.html
 ftp.neez.com.br               | /tLnW6jJT/index.html
 ftp.neez.com.br               | /UAtkgmot/index.html
 ftp.neez.com.br               | /UcL29wrU/index.html
 ftp.neez.com.br               | /wcE0aK0J/index.html
 ftp.neez.com.br               | /xXr3khjG/index.html
 ftp.pousadaesmeralda.com.br   | /4RcYf6gB/index.html
 ftp.pousadaesmeralda.com.br   | /bp9ksV54/index.html
 ftp.pousadaesmeralda.com.br   | /ddLvpeMu/index.html
 ftp.pousadaesmeralda.com.br   | /DkM4v1PP/index.html
 ftp.pousadaesmeralda.com.br   | /gj1W42Ee/index.html
 ftp.pousadaesmeralda.com.br   | /i8ztSS5H/index.html
 ftp.pousadaesmeralda.com.br   | /iaJ7FSBi/index.html
 ftp.pousadaesmeralda.com.br   | /Lskx0Bew/index.html
 ftp.pousadaesmeralda.com.br   | /mKvc8Mh7/index.html
 ftp.pousadaesmeralda.com.br   | /N2rhmW5i/index.html
 ftp.pousadaesmeralda.com.br   | /NdHgm0gT/index.html
 ftp.pousadaesmeralda.com.br   | /oZFZ0qJK/index.html
 ftp.pousadaesmeralda.com.br   | /pD2zHbBB/index.html
 ftp.pousadaesmeralda.com.br   | /pSG1s2xs/index.html
 ftp.pousadaesmeralda.com.br   | /r1kVYAfU/index.html
 ftp.pousadaesmeralda.com.br   | /Re3BMGVG/index.html
 ftp.pousadaesmeralda.com.br   | /rHFbxKTn/index.html
 ftp.pousadaesmeralda.com.br   | /rzDZAsw7/index.html
 ftp.pousadaesmeralda.com.br   | /UcL29wrU/index.html
 ftp.pousadaesmeralda.com.br   | /wcE0aK0J/index.html
 ftp.pousadaesmeralda.com.br   | /wjivLtgo/index.html
 ftp.pousadaesmeralda.com.br   | /wtQ8G0Ku/index.html
 ftppousadaesmeralda.com.br    | /ddLvpeMu/index.html
 ftppousadaesmeralda.com.br    | /Lskx0Bew/index.html
 ftppousadaesmeralda.com.br    | /oZFZ0qJK/index.html
 ftppousadaesmeralda.com.br    | /pSG1s2xs/index.html
 ftppousadaesmeralda.com.br    | /wjivLtgo/index.html
 globesecurityservices.com     | /4RcYf6gB/index.html
 globesecurityservices.com     | /6BrzkppT/index.html
 globesecurityservices.com     | /7NEM56yQ/index.html
 globesecurityservices.com     | /7QLZuMme/index.html
 globesecurityservices.com     | /bp9ksV54/index.html
 globesecurityservices.com     | /BzJoVeo0/index.html
 globesecurityservices.com     | /ddLvpeMu/index.html
 globesecurityservices.com     | /DkM4v1PP/index.html
 globesecurityservices.com     | /ErmgUouT/index.html
 globesecurityservices.com     | /gj1W42Ee/index.html
 globesecurityservices.com     | /i8ztSS5H/index.html
 globesecurityservices.com     | /iaJ7FSBi/index.html
 globesecurityservices.com     | /Lskx0Bew/index.html
 globesecurityservices.com     | /mKvc8Mh7/index.html
 globesecurityservices.com     | /NdHgm0gT/index.html
 globesecurityservices.com     | /oZFZ0qJK/index.html
 globesecurityservices.com     | /pD2zHbBB/index.html
 globesecurityservices.com     | /pSG1s2xs/index.html
 globesecurityservices.com     | /rHFbxKTn/index.html
 globesecurityservices.com     | /RoScD8aq/index.html
 globesecurityservices.com     | /rzDZAsw7/index.html
 globesecurityservices.com     | /t7xYVUJE/index.html
 globesecurityservices.com     | /tLnW6jJT/index.html
 globesecurityservices.com     | /UAtkgmot/index.html
 globesecurityservices.com     | /UcL29wrU/index.html
 globesecurityservices.com     | /vpW8hoZ6/index.html
 globesecurityservices.com     | /wcE0aK0J/index.html
 globesecurityservices.com     | /wjivLtgo/index.html
 globesecurityservices.com     | /wtQ8G0Ku/index.html
 gpureappliances.com           | /4RcYf6gB/index.html
 gpureappliances.com           | /6BrzkppT/index.html
 gpureappliances.com           | /7NEM56yQ/index.html
 gpureappliances.com           | /7QLZuMme/index.html
 gpureappliances.com           | /bp9ksV54/index.html
 gpureappliances.com           | /ddLvpeMu/index.html
 gpureappliances.com           | /DkM4v1PP/index.html
 gpureappliances.com           | /ErmgUouT/index.html
 gpureappliances.com           | /gj1W42Ee/index.html
 gpureappliances.com           | /Lskx0Bew/index.html
 gpureappliances.com           | /N2rhmW5i/index.html
 gpureappliances.com           | /NdHgm0gT/index.html
 gpureappliances.com           | /oZFZ0qJK/index.html
 gpureappliances.com           | /pD2zHbBB/index.html
 gpureappliances.com           | /r1kVYAfU/index.html
 gpureappliances.com           | /rHFbxKTn/index.html
 gpureappliances.com           | /RoScD8aq/index.html
 gpureappliances.com           | /rzDZAsw7/index.html
 gpureappliances.com           | /t7xYVUJE/index.html
 gpureappliances.com           | /UAtkgmot/index.html
 gpureappliances.com           | /vpW8hoZ6/index.html
 gpureappliances.com           | /wcE0aK0J/index.html
 gpureappliances.com           | /wtQ8G0Ku/index.html
 gpureappliances.com           | /xXr3khjG/index.html
 gpureappliances.com           | /YhwvXGhk/index.html
 gpureappliances.com           | /zvo8ioak/index.html
 hitechsystems.org.in          | /4RcYf6gB/index.html
 hitechsystems.org.in          | /7NEM56yQ/index.html
 hitechsystems.org.in          | /7QLZuMme/index.html
 hitechsystems.org.in          | /ddLvpeMu/index.html
 hitechsystems.org.in          | /DkM4v1PP/index.html
 hitechsystems.org.in          | /gj1W42Ee/index.html
 hitechsystems.org.in          | /Lskx0Bew/index.html
 hitechsystems.org.in          | /mKvc8Mh7/index.html
 hitechsystems.org.in          | /N2rhmW5i/index.html
 hitechsystems.org.in          | /NdHgm0gT/index.html
 hitechsystems.org.in          | /oZFZ0qJK/index.html
 hitechsystems.org.in          | /pD2zHbBB/index.html
 hitechsystems.org.in          | /pSG1s2xs/index.html
 hitechsystems.org.in          | /r1kVYAfU/index.html
 hitechsystems.org.in          | /Re3BMGVG/index.html
 hitechsystems.org.in          | /rHFbxKTn/index.html
 hitechsystems.org.in          | /RoScD8aq/index.html
 hitechsystems.org.in          | /rzDZAsw7/index.html
 hitechsystems.org.in          | /t7xYVUJE/index.html
 hitechsystems.org.in          | /UAtkgmot/index.html
 hitechsystems.org.in          | /UcL29wrU/index.html
 hitechsystems.org.in          | /vpW8hoZ6/index.html
 hitechsystems.org.in          | /wcE0aK0J/index.html
 hitechsystems.org.in          | /wjivLtgo/index.html
 hitechsystems.org.in          | /wtQ8G0Ku/index.html
 hitechsystems.org.in          | /xXr3khjG/index.html
 hypernovamedia.com            | /4RcYf6gB/index.html
 hypernovamedia.com            | /6BrzkppT/index.html
 hypernovamedia.com            | /7NEM56yQ/index.html
 hypernovamedia.com            | /7QLZuMme/index.html
 hypernovamedia.com            | /bp9ksV54/index.html
 hypernovamedia.com            | /BzJoVeo0/index.html
 hypernovamedia.com            | /DkM4v1PP/index.html
 hypernovamedia.com            | /ErmgUouT/index.html
 hypernovamedia.com            | /gj1W42Ee/index.html
 hypernovamedia.com            | /i8ztSS5H/index.html
 hypernovamedia.com            | /iaJ7FSBi/index.html
 hypernovamedia.com            | /Lskx0Bew/index.html
 hypernovamedia.com            | /mKvc8Mh7/index.html
 hypernovamedia.com            | /N2rhmW5i/index.html
 hypernovamedia.com            | /pD2zHbBB/index.html
 hypernovamedia.com            | /pSG1s2xs/index.html
 hypernovamedia.com            | /r1kVYAfU/index.html
 hypernovamedia.com            | /Re3BMGVG/index.html
 hypernovamedia.com            | /RoScD8aq/index.html
 hypernovamedia.com            | /t7xYVUJE/index.html
 hypernovamedia.com            | /tLnW6jJT/index.html
 hypernovamedia.com            | /UAtkgmot/index.html
 hypernovamedia.com            | /UcL29wrU/index.htm
 hypernovamedia.com            | /UcL29wrU/index.html
 hypernovamedia.com            | /vpW8hoZ6/index.html
 hypernovamedia.com            | /wcE0aK0J/index.html
 hypernovamedia.com            | /wjivLtgo/index.html
 hypernovamedia.com            | /xXr3khjG/index.html
 hypernovamedia.com            | /YhwvXGhk/index.html
 hypernovamedia.com            | /zvo8ioak/index.html
 ilabph.com                    | /6BrzkppT/index.html
 ilabph.com                    | /7NEM56yQ/index.html
 ilabph.com                    | /BzJoVeo0/index.html
 ilabph.com                    | /ddLvpeMu/index.html
 ilabph.com                    | /ErmgUouT/index.html
 ilabph.com                    | /gj1W42Ee/index.html
 ilabph.com                    | /i8ztSS5H/index.html
 ilabph.com                    | /iaJ7FSBi/index.html
 ilabph.com                    | /Lskx0Bew/index.html
 ilabph.com                    | /mKvc8Mh7/index.html
 ilabph.com                    | /N2rhmW5i/index.html
 ilabph.com                    | /NdHgm0gT/index.html
 ilabph.com                    | /oZFZ0qJK/index.html
 ilabph.com                    | /pD2zHbBB/index.html
 ilabph.com                    | /pSG1s2xs/index.html
 ilabph.com                    | /r1kVYAfU/index.html
 ilabph.com                    | /Re3BMGVG/index.html
 ilabph.com                    | /rHFbxKTn/index.html
 ilabph.com                    | /RoScD8aq/index.html
 ilabph.com                    | /rzDZAsw7/index.html
 ilabph.com                    | /t7xYVUJE/index.html
 ilabph.com                    | /tLnW6jJT/index.html
 ilabph.com                    | /UAtkgmot/index.html
 ilabph.com                    | /UcL29wrU/index.html
 ilabph.com                    | /vpW8hoZ6/index.html
 ilabph.com                    | /wcE0aK0J/index.html
 ilabph.com                    | /wjivLtgo/index.html
 ilabph.com                    | /wtQ8G0Ku/index.html
 ilabph.com                    | /xXr3khjG/index.html
 ilabph.com                    | /YhwvXGhk/index.html
 jmexy.com                     | /4RcYf6gB/index.html
 jmexy.com                     | /7QLZuMme/index.html
 jmexy.com                     | /BzJoVeo0/index.html
 jmexy.com                     | /ddLvpeMu/index.html
 jmexy.com                     | /DkM4v1PP/index.html
 jmexy.com                     | /ErmgUouT/index.html
 jmexy.com                     | /gj1W42Ee/index.html
 jmexy.com                     | /Lskx0Bew/index.html
 jmexy.com                     | /mKvc8Mh7/index.html
 jmexy.com                     | /N2rhmW5i/index.html
 jmexy.com                     | /NdHgm0gT/index.html
 jmexy.com                     | /r1kVYAfU/index.html
 jmexy.com                     | /Re3BMGVG/index.html
 jmexy.com                     | /rHFbxKTn/index.html
 jmexy.com                     | /RoScD8aq/index.html
 jmexy.com                     | /rzDZAsw7/index.html
 jmexy.com                     | /tLnW6jJT/index.html
 jmexy.com                     | /UAtkgmot/index.html
 jmexy.com                     | /UcL29wrU/index.html
 jmexy.com                     | /vpW8hoZ6/index.html
 jmexy.com                     | /wcE0aK0J/index.html
 jmexy.com                     | /wjivLtgo/index.html
 jmexy.com                     | /wtQ8G0Ku/index.html
 jmexy.com                     | /xXr3khjG/index.html
 jmexy.com                     | /YhwvXGhk/index.html
 jmexy.com                     | /zvo8ioak/index.html
 justinbieber-fans.nixiweb.com | /6BrzkppT/index.html
 justinbieber-fans.nixiweb.com | /7NEM56yQ/index.html
 justinbieber-fans.nixiweb.com | /ddLvpeMu/index.html
 justinbieber-fans.nixiweb.com | /DkM4v1PP/index.html
 justinbieber-fans.nixiweb.com | /ErmgUouT/index.html
 justinbieber-fans.nixiweb.com | /gj1W42Ee/index.html
 justinbieber-fans.nixiweb.com | /iaJ7FSBi/index.html
 justinbieber-fans.nixiweb.com | /Lskx0Bew/index.html
 justinbieber-fans.nixiweb.com | /mKvc8Mh7/index.html
 justinbieber-fans.nixiweb.com | /oZFZ0qJK/index.html
 justinbieber-fans.nixiweb.com | /pD2zHbBB/index.html
 justinbieber-fans.nixiweb.com | /pSG1s2xs/index.html
 justinbieber-fans.nixiweb.com | /Re3BMGVG/index.html
 justinbieber-fans.nixiweb.com | /rHFbxKTn/index.html
 justinbieber-fans.nixiweb.com | /RoScD8aq/index.html
 justinbieber-fans.nixiweb.com | /rzDZAsw7/index.html
 justinbieber-fans.nixiweb.com | /t7xYVUJE/index.html
 justinbieber-fans.nixiweb.com | /UcL29wrU/index.html
 justinbieber-fans.nixiweb.com | /xXr3khjG/index.html
 justinbieber-fans.nixiweb.com | /YhwvXGhk/index.html
 justinbieber-fans.nixiweb.com | /zvo8ioak/index.html
 mangalamcorporation.in        | /4RcYf6gB/index.html
 mangalamcorporation.in        | /6BrzkppT/index.html
 mangalamcorporation.in        | /bp9ksV54/index.html
 mangalamcorporation.in        | /BzJoVeo0/index.html
 mangalamcorporation.in        | /ddLvpeMu/index.html
 mangalamcorporation.in        | /DkM4v1PP/index.html
 mangalamcorporation.in        | /gj1W42Ee/index.html
 mangalamcorporation.in        | /i8ztSS5H/index.html
 mangalamcorporation.in        | /iaJ7FSBi/index.html
 mangalamcorporation.in        | /mKvc8Mh7/index.html
 mangalamcorporation.in        | /N2rhmW5i/index.html
 mangalamcorporation.in        | /NdHgm0gT/index.html
 mangalamcorporation.in        | /oZFZ0qJK/indexhtml
 mangalamcorporation.in        | /oZFZ0qJK/index.html
 mangalamcorporation.in        | /pD2zHbBB/index.html
 mangalamcorporation.in        | /pSG1s2xs/index.html
 mangalamcorporation.in        | /r1kVYAfU/index.html
 mangalamcorporation.in        | /rHFbxKTn/index.html
 mangalamcorporation.in        | /RoScD8aq/index.html
 mangalamcorporation.in        | /rzDZAsw7/index.html
 mangalamcorporation.in        | /UAtkgmot/index.html
 mangalamcorporation.in        | /UcL29wrU/index.html
 mangalamcorporation.in        | /vpW8hoZ6/index.html
 mangalamcorporation.in        | /wcE0aK0J/index.html
 mangalamcorporation.in        | /xXr3khjG/index.html
 mangalamcorporation.in        | /YhwvXGhk/index.html
 mksteslaenergy.com            | /4RcYf6gB/index.html
 mksteslaenergy.com            | /6BrzkppT/index.html
 mksteslaenergy.com            | /7NEM56yQ/index.html
 mksteslaenergy.com            | /BzJoVeo0/index.html
 mksteslaenergy.com            | /ddLvpeMu/index.html
 mksteslaenergy.com            | /DkM4v1PP/index.html
 mksteslaenergy.com            | /ErmgUouT/index.html
 mksteslaenergy.com            | /gj1W42Ee/index.html
 mksteslaenergy.com            | /i8ztSS5H/index.html
 mksteslaenergy.com            | /iaJ7FSBi/index.html
 mksteslaenergy.com            | /mKvc8Mh7/index.html
 mksteslaenergy.com            | /N2rhmW5i/index.html
 mksteslaenergy.com            | /NdHgm0gT/index.html
 mksteslaenergy.com            | /oZFZ0qJK/index.html
 mksteslaenergy.com            | /pD2zHbBB/index.html
 mksteslaenergy.com            | /pSG1s2xs/index.html
 mksteslaenergy.com            | /r1kVYAfU/index.html
 mksteslaenergy.com            | /rzDZAsw7/indexhtml
 mksteslaenergy.com            | /rzDZAsw7/index.html
 mksteslaenergy.com            | /tLnW6jJT/index.html
 mksteslaenergy.com            | /UAtkgmot/index.html
 mksteslaenergy.com            | /UcL29wrU/index.html
 mksteslaenergy.com            | /wcE0aK0J/index.html
 mksteslaenergy.com            | /wjivLtgo/index.html
 mksteslaenergy.com            | /xXr3khjG/index.html
 mksteslaenergy.com            | /YhwvXGhk/index.html
 mpralos.gr                    | /6BrzkppT/index.html
 mpralos.gr                    | /7NEM56yQ/index.html
 mpralos.gr                    | /7QLZuMme/index.html
 mpralos.gr                    | /bp9ksV54/index.html
 mpralos.gr                    | /BzJoVeo0/index.html
 mpralos.gr                    | /ErmgUouT/index.html
 mpralos.gr                    | /gj1W42Ee/index.html
 mpralos.gr                    | /i8ztSS5H/index.html
 mpralos.gr                    | /iaJ7FSBi/index.html
 mpralos.gr                    | /Lskx0Bew/index.html
 mpralos.gr                    | /mKvc8Mh7/index.html
 mpralos.gr                    | /N2rhmW5i/index.html
 mpralos.gr                    | /NdHgm0gT/index.html
 mpralos.gr                    | /oZFZ0qJK/index.html
 mpralos.gr                    | /pD2zHbBB/index.html
 mpralos.gr                    | /pSG1s2xs/index.html
 mpralos.gr                    | /r1kVYAfU/index.html
 mpralos.gr                    | /rHFbxKTn/index.html
 mpralos.gr                    | /rzDZAsw7/index.html
 mpralos.gr                    | /t7xYVUJE/index.html
 mpralos.gr                    | /tLnW6jJT/index.html
 mpralos.gr                    | /UAtkgmot/index.html
 mpralos.gr                    | /UcL29wrU/index.html
 mpralos.gr                    | /wcE0aK0J/index.html
 mpralos.gr                    | /wjivLtgo/index.html
 mpralos.gr                    | /wtQ8G0Ku/index.html
 mpralos.gr                    | /zvo8ioak/index.html
 njsksansthan.com              | /6BrzkppT/index.html
 njsksansthan.com              | /7NEM56yQ/index.html
 njsksansthan.com              | /7QLZuMme/index.html
 njsksansthan.com              | /bp9ksV54/index.html
 njsksansthan.com              | /ddLvpeMu/index.html
 njsksansthan.com              | /DkM4v1PP/index.html
 njsksansthan.com              | /ErmgUouT/index.html
 njsksansthan.com              | /iaJ7FSBi/index.html
 njsksansthan.com              | /Lskx0Bew/index.html
 njsksansthan.com              | /N2rhmW5i/index.html
 njsksansthan.com              | /pD2zHbBB/index.html
 njsksansthan.com              | /Re3BMGVG/index.html
 njsksansthan.com              | /RoScD8aq/index.html
 njsksansthan.com              | /rzDZAsw7/index.html
 njsksansthan.com              | /UcL29wrU/index.html
 njsksansthan.com              | /wtQ8G0Ku/index.html
 njsksansthan.com              | /xXr3khjG/index.html
 njsksansthan.com              | /YhwvXGhk/index.html
 njsksansthan.com              | /zvo8ioak/index.html
 pakwestind.com                | /6BrzkppT/index.html
 pakwestind.com                | /ErmgUouT/index.html
 pakwestind.com                | /i8ztSS5H/index.html
 pakwestind.com                | /NdHgm0gT/index.html
 pakwestind.com                | /oZFZ0qJK/index.html
 pakwestind.com                | /pD2zHbBB/index.html
 pakwestind.com                | /rHFbxKTn/index.html
 pakwestind.com                | /t7xYVUJE/index.html
 pakwestind.com                | /tLnW6jJT/index.html
 pakwestind.com                | /UAtkgmot/index.html
 pakwestind.com                | /UcL29wrU/index.html
 pakwestind.com                | /wcE0aK0J/index.html
 pakwestind.com                | /wtQ8G0Ku/index.html
 punial.com                    | /4RcYf6gB/index.html
 punial.com                    | /7NEM56yQ/index.html
 punial.com                    | /7QLZuMme/index.html
 punial.com                    | /bp9ksV54/index.html
 punial.com                    | /BzJoVeo0/index.html
 punial.com                    | /ErmgUouT/index.html
 punial.com                    | /i8ztSS5H/index.html
 punial.com                    | /NdHgm0gT/index.html
 punial.com                    | /r1kVYAfU/index.html
 punial.com                    | /rHFbxKTn/index.html
 punial.com                    | /RoScD8aq/index.html
 punial.com                    | /t7xYVUJE/index.html
 punial.com                    | /UcL29wrU/index.html
 punial.com                    | /vpW8hoZ6/index.html
 punial.com                    | /xXr3khjG/index.html
 punial.com                    | /zvo8ioak/index.html
 rsons.in                      | /6BrzkppT/index.html
 rsons.in                      | /bp9ksV54/index.html
 rsons.in                      | /DkM4v1PP/index.html
 rsons.in                      | /gj1W42Ee/index.html
 rsons.in                      | /i8ztSS5H/index.html
 rsons.in                      | /mKvc8Mh7/index.html
 rsons.in                      | /r1kVYAfU/index.html
 rsons.in                      | /Re3BMGVG/index.html
 rsons.in                      | /tLnW6jJT/index.html
 rsons.in                      | /UAtkgmot/index.html
 rsons.in                      | /vpW8hoZ6/index.html
 rsons.in                      | /wcE0aK0J/index.html
 rsons.in                      | /wtQ8G0Ku/index.html
 rsons.in                      | /xXr3khjG/index.html
 siniflar.net                  | /4RcYf6gB/index.html
 siniflar.net                  | /ddLvpeMu/index.html
 siniflar.net                  | /ErmgUouT/index.html
 siniflar.net                  | /wjivLtgo/index.html