A Compilation of Known Conti Ransomware Gang Malicious Executable Download Locations - An OSINT Analysis

I've decided to continue data mining the recently leaked Conti Ransomware Gang internal communications on my way to find and share more actionable intelligence in terms of their Internet-connected infrastructure and in this post I've decided to share a set of currently active malicious executable download locations courtesy of the Conti Ransomware gang which you can check out in terms of attribution and cyber attack campaign take down efforts.

Sample list of currently active Conti Ransomware gang malicious executable download locations:

hxxp://copyrightlive-ksa.com/Preview_Report.exe

hxxp://ebeautytrade.com/calc.exe

hxxp://37.1.209.181/2805/locker.exe

hxxp://omegasystemsuae.com/Preview_Document.exe

hxxp://copyrightlive-ksa.com/Preview_Document.exe

hxxp://www.alkanzalzahabi.com/Preview_Document.exe

hxxp://omegasystemsuae.com/Preview_Document.exe

hxxp://shawigroup.com/Preview_Document.exe

hxxp://copyrightlive-ksa.com/Preview_Document.exe

hxxp://www.alkanzalzahabi.com/Preview_Document.exe

hxxp://shawigroup.com/Preview_Document.exe

hxxp://copyrightlive-ksa.com/P32.exe

hxxp://shawigroup.com/Preview_Document.exe

hxxp://allacestech.com/Preview_Document.exe

hxxp://allacestech.com/Preview_Document.exe

hxxp://shawigroup.com/Preview_Document.exe

hxxp://allacestech.com/Preview_Document.exe

hxxp://allacestech.com/Preview_Document.exe

hxxp://allacestech.com/Preview_Document.exe

hxxp://globaluxrma.com/Preview_Document.exe

hxxp://globaluxrma.com/Preview_Document.exe

hxxp://shighil.com/Preview_Document.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://www.bsrdesigns.com/DocumentPreview.exe

hxxp://91.235.129.41/P32.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://watchespower.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocumentPreview.exe

hxxp://watchespower.com/DocumentPreview.exe

hxxp://www.bsrdesigns.com/DocumentPreview.exe

hxxp://watchespower.com/DocumentPreview.exe

hxxp://91.235.129.41/P32.exe

hxxp://91.235.129.41/P32.exe

hxxp://alexandersqualitycleaners.com/DocumentPreview.exe

hxxp://middletownfriedchickengyro.com/DocumentPreview.exe

hxxp://91.235.129.41/P32.exe

hxxp://dubaidreamsadventure.com/Document_Aerlingus.exe

hxxp://www.shiningshadowllc.com/Document_BritishAirways.exe

hxxp://dubaidreamsadventure.com/Document_Aerlingus.exe

hxxp://www.shiningshadowllc.com/Document_BritishAirways.exe

hxxp://dubaidreamsadventure.com/Document_Aerlingus.exe

hxxp://www.shiningshadowllc.com/Document_BritishAirways.exe

hxxp://www.shiningshadowllc.com/Document_BritishAirways.exe

hxxp://www.omegasystemsuae.com/Document_Aerlingus.exe

hxxp://www.omegasystemsuae.com/Document_Aerlingus.exe

hxxp://www.omegasystemsuae.com/Document_Aerlingus.exe

hxxp://www.omegasystemsuae.com/RalphLaurenDocument.exe

hxxp://copyrightlive-uae.com/calc.exe

hxxp://copyrightlive-uae.com/ld1n.exe

hxxp://copyrightlive-uae.com/DAFSDASD.exe

hxxp://copyrightlive-uae.com/DocumentPreview.exe

hxxp://www.almakaan.com/DocumentPreview.exe

hxxp://copyrightlive-uae.com/DocumentPreview.exe

hxxp://45.153.240.191/crypt/18554hs.exe

hxxp://copyrightlive-uae.com/DocumentPreview.exe

hxxp://copyrightlive-uae.com/PreviewDocument.exe

hxxp://194.5.249.13/p32.exe

hxxp://globaluxrma.com/ReviewDocument.exe

hxxp://shawigroup.com/ReviewDocument.exe

hxxp://bloomfieldholding.com/ReviewDocument.exe

hxxp://bloomfieldholding.com/wp-content/ReviewDocument.exe

hxxp://greenmountains.ae/YAS42.exe

hxxp://greenmountains.ae/YAS42.exehxxp://copyrightlive-ksa.com/Preview_Report.exe

hxxp://www.alkanzalzahabi.com/DocumentPreview.exe

hxxp://copyrightlive-ksa.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://allacestech.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://alwasl-syria.com/DocumentPreview.exe

hxxp://alwasl-syria.com/DocumentPreview.exe

hxxp://nutritionprofbob.com/DocumentPreview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://alwasl-syria.com/DocumentPreview.exe

hxxp://alwasl-syria.com/DocumentPreview.exe

hxxp://alwasl-syria.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://allacestech.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/Setup.exe

hxxp://www.omegasystemsuae.com/Setup.exe

hxxp://www.omegasystemsuae.com/Setup.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://www.omegasystemsuae.com/DocumentPreview.exe

hxxp://bloomfieldholding.com/DocumentPreview.exe

hxxp://bloomfieldholding.com/PreviewDocument.exe

hxxp://shawigroup.com/DuplicateFinder.exe

hxxp://shawigroup.com/DuplicateFinder.exe

hxxp://shawigroup.com/DuplicateFinder.exe

hxxp://shawigroup.com/Doc-Print.exe

hxxp://middletownfriedchickengyro.com/DocumentPreview.exe

hxxp://middletownfriedchickengyro.com/Doc-Print.exe

hxxp://middletownfriedchickengyro.com/DocumentPreview.exe

hxxp://middletownfriedchickengyro.com/Doc-Print.exe

hxxp://nutritionprofbob.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocPreview.exe

hxxp://porceletta-ware.com/DocPreview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://porceletta-ware.com/DocPreview.exe

hxxp://www.ottenbourg.com/Doc-Preview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://nutritionprofbob.com/DocumentPreview.exe

hxxp://www.shiningshadowllc.com/Doc-Preview.exe

hxxp://shighil.com/Doc-Preview.exe

hxxp://violinstop.com/DocumentPreview.exe

hxxp://gk24w3eumyv4fqajpbw6jbrd6eb4kwvcqcfg4po25cnxuqs7hhhan6yd.onion/npcap.exe

hxxp://www.ottenbourg.com/AcademiPreview.exe

hxxp://www.shiningshadowllc.com/Doc-Preview.exe

hxxp://ajeetsinghbaddan.com/Doc-Preview.exe

hxxp://www.shiningshadowllc.com/Doc-Preview.exe

hxxp://ajeetsinghbaddan.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc-Preview.exe

hxxp://reefglobal.com/Doc1.exe

hxxp://reefglobal.com/dl2a.exe

hxxp://paullesueurlegacyfoundation.com/9rhjdkjfh.exe

hxxp://www.ottenbourg.com/nagpsdo.exe

hxxp://www.namaskardunia.com/badtest2.exe

hxxp://www.namaskardunia.com/test1.exe

hxxp://45.148.120.192/service64.exe

hxxp://45.148.120.192/service111.exe

hxxp://45.148.120.192/service222.exe

hxxp://fdsfdsf.com/fdsfds/file.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://45.148.120.192/service64.exe

hxxp://45.148.120.192/service111.exe

hxxp://45.148.120.192/service222.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://www.ottenbourg.com/upload/xml1.exe

hxxp://dylanengineeringservices.com/3.exe

hxxp://dylanengineeringservices.com/3.exe

hxxp://www.ottenbourg.com/5.exe

hxxp://maintenance.com/autoupdate.exe

hxxp://85.25.194.150/BVY729LK10PAWN/1.exe

hxxp://85.25.194.150/BVY729LK10PAWN/2.exe

hxxp://85.25.194.150/BVY729LK10PAWN/3.exe

hxxp://85.25.194.150/BVY729LK10PAWN/1.exe

hxxp://85.25.194.150/BVY729LK10PAWN/2.exe

hxxp://85.25.194.150/BVY729LK10PAWN/3.exe

hxxp://shighil.com/dl2.exe

hxxp://shighil.com/dl2.exe

hxxp://62.108.34.54/service64.exe

hxxp://62.108.34.54/service_ssl.exe

hxxp://62.108.34.54/P32.exe

hxxp://62.108.34.54/winserv.exe

hxxp://62.108.34.54/service64.exe

hxxp://62.108.34.54/service_ssl.exe

hxxp://62.108.34.54/P32.exe

hxxp://62.108.34.54/winserv.exe

hxxp://62.108.34.54/service64.exe

hxxp://62.108.34.54/service_ssl.exe

hxxp://62.108.34.54/P32.exe

hxxp://62.108.34.54/winserv.exe

hxxp://62.108.34.54/service64.exe

hxxp://62.108.34.54/service_ssl.exe

hxxp://62.108.34.54/P32.exe

hxxp://62.108.34.54/winserv.exe

hxxp://emploimed.com/dl2m.exe

hxxp://copyrightlive-ksa.com/t1000.exe

hxxp://www.shighil.com/dl2.exe

hxxp://www.shighil.com/dl2.exe

hxxp://nutritionprofbob.com/teste.exe

hxxp://copyrightlive-ksa.com/t1000.exe

hxxp://www.shiningshadowllc.com/DocumentPreview.exe

hxxp://85.25.194.150/BVY729LK10PAWN/1.exe

hxxp://85.25.194.150/BVY729LK10PAWN/2.exe

hxxp://85.25.194.150/BVY729LK10PAWN/3.exe

hxxp://brankovucinec.blob.core.windows.net/downloads/mstsc.exe_.manifest.zip

hxxp://emploimed.com/scintillabc.exe

hxxp://emploimed.com/scintillabc.exe

hxxp://www.coalminds.com/Document_Print.exe

hxxp://www.sonorambc.org/Document_Print.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://puccienterprises.com/Preview.exe

hxxp://e-tech.ie/PreviewDoc.exe

hxxp://e-tech.ie/PreviewDoc.exe

hxxp://puccienterprises.com/Preview.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://e-tech.ie/PreviewDoc.exe

hxxp://nutritionprofbob.com/Preview1.exe

hxxp://nutritionprofbob.com/prw/Preview.exe

hxxp://nutritionprofbob.com/prw/Preview.exe

hxxp://violinstop.com/Preview.exe

hxxp://nutritionprofbob.com/prw/Preview.exe

hxxp://reefglobal.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe

hxxp://middletownfriedchickengyro.com/Preview.exe

hxxp://middletownfriedchickengyro.com/Preview.exe

hxxp://middletownfriedchickengyro.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe

hxxp://easychurchbooks.com/Preview.exe

hxxp://easychurchbooks.com/Preview.exe

hxxp://sonorambc.org/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/Preview.exe-

hxxp://aspiremedstaff.com/Print.exe

hxxp://aspiremedstaff.com/Print.exe

hxxp://aspiremedstaff.com/Print.exe

hxxp://emploimed.com/Print_Preview.exe

hxxp://www.namaskardunia.com/Preview.exe

hxxp://www.namaskardunia.com/Preview.exe

hxxp://atlantisprojects.ca/Preview.exe

hxxp://gilchrist.fl.us/Preview.exe

hxxp://www.parkisolutions.com/Preview.exe

hxxp://www.parkisolutions.com/Preview.exe

hxxp://unitedyfl.com/Print_Preview.exe

hxxp://unitedyfl.com/Print_Preview.exe

hxxp://www.parkisolutions.com/Preview.exe

hxxp://fancydes.webd.pl/Review.exe

hxxp://rayanat.com/Print_Preview.exe

hxxp://wholesalebosmereusa.com/Preview.exe

hxxp://kohlheatingandair.com/Review.exe

hxxp://fancydes.webd.pl/Review.exe

hxxp://rayanat.com/Preview_Print.exe

hxxp://calacatta.com/Preview.exe

hxxp://google.com/update.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://www.adventureworldindia.com/Preview.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://aspiremedstaff.com/Preview.exe

hxxp://emploimed.com/Preview.exe

hxxp://emploimed.com/Preview.exe

hxxp://emploimed.com/Preview.exe

hxxp://emploimed.com/Preview.exe

hxxp://globaluxrma.com/Review.exe

hxxp://emploimed.com/Preview.exe

hxxp://emploimed.com/Preview.exe

hxxp://paullesueurlegacyfoundation.com/ReviewPrint.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://shighil.com/ReviewPrint.exe

hxxp://shighil.com/TerminationRep.exe

hxxp://alwaslegypt.com/Preview.exe

hxxp://www.omegasystemsuae.com/Preview.exe

hxxp://www.omegasystemsuae.com/BKOFR.exe

hxxp://copyrightlive-uae.com/P64.exe

hxxp://copyrightlive-uae.com/Print.pdf.exe

hxxp://copyrightlive-uae.com/P64.exe

hxxp://coffschamber.com.au/Review.exe

hxxp://coffschamber.com.au/Review.exe

hxxp://coffschamber.com.au/Review.exe

hxxp://cdn-102.anonfiles.com/XdzdPbVfo8/a6501123-1600284832/Review.exe

hxxp://cdn-102.anonfiles.com/XdzdPbVfo8/a6501123-1600284832/Review.exe

hxxp://cdn-33.anonfiles.com/L3oeQ0Vbo2/d37ab69a-1600287659/Preview.exe

hxxp://emploimed.com/Preview.exe

hxxp://cdn-33.anonfiles.com/L3oeQ0Vbo2/d37ab69a-1600287659/Preview.exe

hxxp://portableapps.com/downloading/?a=TeamViewerPortable&n=TeamViewer%20Portable&s=s&p=&d=pa&f=TeamViewerPortable_15.9.4.paf.exe

hxxp://www.omegasystemsuae.com/BKOFR.exe

hxxp://www.delwarren.com/backup/nowin.exe

hxxp://wikiapply.ir/Scrip.exe

hxxp://shighil.com/Scrit.exe

hxxp://shighil.com/Scrip.exe

hxxp://shighil.com/Print.exe

hxxp://nutritionprofbob.com/Preview.exe

hxxp://cdn-114.anonfiles.com/ZfSf52X2oc/76279be8-1600685243/mor125.exe

hxxp://dubaidreamsadventure.com/Print_Review.exe

hxxp://107.155.137.21/https_x64.exe

hxxp://stahlworks.com/dev/unzip.exe

hxxp://94.140.115.219/doc/http.bin_x86.exe

hxxp://94.140.115.219/doc/http64.bin_x64.exe

hxxp://94.140.115.219/doc/http.bin_x86.exe

hxxp://94.140.115.219/doc/http64.bin_x64.exe

hxxp://94.140.115.219/doc/htp_x64.exe

hxxp://94.140.115.219/doc/htp_x86.exe

hxxp://94.140.115.219/1/http64.exe

hxxp://94.140.115.219/1/P32.exe

hxxp://94.140.115.219/1/P64.exe

hxxp://94.140.115.219/1/run1.exe

hxxp://94.140.115.219/1/run2.exe

hxxp://94.140.115.219/1/service_http64.exe

hxxp://94.140.115.219/doc/http.bin_x86.exe

hxxp://94.140.115.219/doc/http64.bin_x64.exe

hxxp://94.140.115.219/doc/http.bin_x86.exe

hxxp://94.140.115.219/doc/http64.bin_x64.exe

hxxp://94.140.115.219/doc/htp_x64.exe

hxxp://94.140.115.219/doc/htp_x86.exe

hxxp://94.140.115.219/1/http64.exe

hxxp://94.140.115.219/1/P32.exe

hxxp://94.140.115.219/1/P64.exe

hxxp://94.140.115.219/1/run1.exe

hxxp://94.140.115.219/1/run2.exe

hxxp://94.140.115.219/1/service_http64.exe

hxxp://94.140.115.219/crypt/3/http_8080_x64.exe

hxxp://94.140.115.219/crypt/3/http64.exe

hxxp://94.140.115.219/crypt/3/https_8443_x64.exe

hxxp://94.140.115.219/crypt/3/P64.exe

hxxp://94.140.115.219/crypt/3/run2.exe

hxxp://94.140.115.219/crypt/3/run1.exe

hxxp://94.140.115.219/crypt/3/https_8443.exe

hxxp://94.140.115.219/crypt/3/http8080.exe

hxxp://94.140.115.219/crypt/3/http_8080_x64.exe

hxxp://94.140.115.219/crypt/3/http64.exe

hxxp://94.140.115.219/crypt/3/https_8443_x64.exe

hxxp://94.140.115.219/crypt/3/P64.exe

hxxp://94.140.115.219/crypt/3/run2.exe

hxxp://94.140.115.219/crypt/3/run1.exe

hxxp://94.140.115.219/crypt/3/https_8443.exe

hxxp://94.140.115.219/crypt/3/http8080.exe

hxxp://85.25.194.150/BVY729LK10PAWN/1.exe

hxxp://85.25.194.150/BVY729LK10PAWN/2.exe

hxxp://85.25.194.150/BVY729LK10PAWN/3.exe

hxxp://94.140.115.219/3/http_8080_x64.exe

hxxp://94.140.115.219/3/http64.exe

hxxp://94.140.115.219/3/http8080.exe

hxxp://94.140.115.219/3/https_8443.exe

hxxp://94.140.115.219/3/https_8443_x64.exe

hxxp://94.140.115.219/3/P32.exe

hxxp://94.140.115.219/3/p64.exe

hxxp://94.140.115.219/3/run1.exe

hxxp://94.140.115.219/3/run2.exe

hxxp://94.140.115.219/4/http.exe

hxxp://94.140.115.219/4/http64.exe

hxxp://94.140.115.219/4/https.exe

hxxp://94.140.115.219/4/https64.exe

hxxp://94.140.115.219/4/P32.exe

hxxp://94.140.115.219/4/P64.exe

hxxp://94.140.115.219/4/run1.exe

hxxp://94.140.115.219/4/run2.exe

hxxp://94.140.115.219/4/serv_http64.exe

hxxp://94.140.115.219/3/http_8080_x64.exe

hxxp://94.140.115.219/3/http64.exe

hxxp://94.140.115.219/3/http8080.exe

hxxp://94.140.115.219/3/https_8443.exe

hxxp://94.140.115.219/3/https_8443_x64.exe

hxxp://94.140.115.219/3/P32.exe

hxxp://94.140.115.219/3/p64.exe

hxxp://94.140.115.219/3/run1.exe

hxxp://94.140.115.219/3/run2.exe

hxxp://94.140.115.219/4/http.exe

hxxp://94.140.115.219/4/http64.exe

hxxp://94.140.115.219/4/https.exe

hxxp://94.140.115.219/4/https64.exe

hxxp://94.140.115.219/4/P32.exe

hxxp://94.140.115.219/4/P64.exe

hxxp://94.140.115.219/4/run1.exe

hxxp://94.140.115.219/4/run2.exe

hxxp://94.140.115.219/4/serv_http64.exe

hxxp://94.140.115.219/4/http.exe

hxxp://94.140.115.219/4/http64.exe

hxxp://94.140.115.219/4/https.exe

hxxp://94.140.115.219/4/https64.exe

hxxp://94.140.115.219/4/P32.exe

hxxp://94.140.115.219/4/P64.exe

hxxp://94.140.115.219/4/run1.exe

hxxp://94.140.115.219/4/run2.exe

hxxp://94.140.115.219/4/serv_http64.exe

hxxp://94.140.115.219/4/http.exe

hxxp://94.140.115.219/4/http64.exe

hxxp://94.140.115.219/4/https.exe

hxxp://94.140.115.219/4/https64.exe

hxxp://94.140.115.219/4/P32.exe

hxxp://94.140.115.219/4/P64.exe

hxxp://94.140.115.219/4/run1.exe

hxxp://94.140.115.219/4/run2.exe

hxxp://94.140.115.219/4/serv_http64.exe

hxxp://94.140.115.219/3/http_8080_x64.exe

hxxp://94.140.115.219/3/http64.exe

hxxp://94.140.115.219/3/http8080.exe

hxxp://94.140.115.219/3/https_8443.exe

hxxp://94.140.115.219/3/https_8443_x64.exe

hxxp://94.140.115.219/3/P32.exe

hxxp://94.140.115.219/3/p64.exe

hxxp://94.140.115.219/3/run1.exe

hxxp://94.140.115.219/3/run2.exe

hxxp://94.140.115.219/3/http_8080_x64.exe

hxxp://94.140.115.219/3/http64.exe

hxxp://94.140.115.219/3/http8080.exe

hxxp://94.140.115.219/3/https_8443.exe

hxxp://94.140.115.219/3/https_8443_x64.exe

hxxp://94.140.115.219/3/P32.exe

hxxp://94.140.115.219/3/p64.exe

hxxp://94.140.115.219/3/run1.exe

hxxp://94.140.115.219/3/run2.exe

Stay tuned!