Friday, April 28, 2023

A Compilation of Koobface Botnet Themed Malicious Executable Download Locations 2009 - 2011

While digging into my old threat intelligence research archive I found the following which I decided to share with everyone.

Happy "takes you back doesn't it" time and OSINT and threat intelligence for historical cross-checking and connecting the dots time.

Sample URLs include:

hxxp://quwudgwddcjbsjdwdjwopdwojdjjjjjjw[.]com/?getexe=tumlike[.]2[.]exe

hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=poster[.]10[.]exe

hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=friendfeedreg[.]1[.]exe

hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=aolsbm[.]2[.]exe

hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=twreg[.]12[.]exe

hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=tumreg[.]1[.]exe

hxxp://roomservicedesign[.]com[.]au/[.]9mov05w/?getexe=drk[.]exe

hxxp://roomservicedesign[.]com[.]au/[.]9mov05w/?getexe=ffe32[.]exe

hxxp://roomservicedesign[.]com[.]au/[.]9mov05w/?getexe=yahblog[.]exe

hxxp://mdcoc[.]net/jxjv0z2s/setup798342[.]exe

hxxp://www[.]blowmeupbig[.]com/[.]iunb8/?getexe=za[.]exe

hxxp://www[.]blowmeupbig[.]com/[.]iunb8/?getexe=hny32[.]exe

hxxp://www[.]chateaudecoisse[.]com/[.]tfdmezb/?getexe=m24[.]in[.]exe

hxxp://www[.]chateaudecoisse[.]com/[.]tfdmezb/?getexe=dg[.]exe

hxxp://anlaegkp[.]dk/trygxqlz/setup314555[.]exe

hxxp://lyulf[.]co[.]uk/2pmf1qq/setup742472[.]exe

hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=ff2ie[.]exe

hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=p[.]exe

hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=m24[.]in[.]exe

hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=dg[.]exe

hxxp://solarinstitut[.]com/yf734/index[.]php?e=635893

hxxp://helpingouryouthachieve[.]com/sim/index[.]php?e=590202

hxxp://www[.]darelorenzo[.]it/[.]sys/?action=fbgen&v=104&crc=669

hxxp://1zabslwvn538n4i5tcjl[.]com/temp/exe/codec[.]exe

hxxp://smx[.]nu/y580/setup[.]exe

hxxp://mantleofmercy[.]org/07/

hxxp://watvindteindhoven[.]nl/614/?go

hxxp://stagnescathedral[.]org/actualperformans/?72691/

hxxp://partenaires-particuliers[.]fr/[.]abodpg/?getexe=tg[.]16[.]exe

hxxp://viale[.]be/[.]jxel/?getexe=p[.]exe

hxxp://viale[.]be/[.]jxel/?getexe=ws[.]exe

hxxp://cedelevator[.]com/[.]sys/?getexe=tg[.]16[.]exe

hxxp://www[.]person[.]doae[.]go[.]th/[.]sys/?getexe=tg[.]16[.]exe

hxxp://ntas[.]com/[.]sys/?getexe=tg[.]16[.]exe

hxxp://waypoint-center[.]org/[.]sys/?action=ppgen&a=-2001606274&v=106&pid=1000

hxxp://waypoint-center[.]org/[.]sys/?action=fbgen&v=106&crc=669

hxxp://deltasatuk[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=ws[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=hostsgb3[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=ws[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=ws[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=ws[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=ws[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=ws[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=ws[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=ws[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=cmd[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=hostsgb3[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=ws[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=ws[.]exe

hxxp://tjsokolosek[.]wz[.]cz/[.]sys/?getexe=loader[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=ws[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=ws[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://www[.]jwdtrees[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://www[.]jwdtrees[.]com/[.]sys/?getexe=loader[.]exe

hxxp://www[.]lionkitchen[.]com[.]sg/[.]sys/?getexe=loader[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=loader[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=go[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=loader[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=pp[.]14[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=v2captcha21[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=v2newblogger[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=v2webserver[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=go[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=loader[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=go[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=loader[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=pp[.]14[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2captcha21[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2newblogger[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2webserver[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=go[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=hosts2[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=loader[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=p[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=pp[.]14[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=v2webserver[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=go[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=hosts2[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=pp[.]14[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2captcha21[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2newblogger[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2webserver[.]exe

hxxp://goldenliontech[.]com/[.]sys/?getexe=loader[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=go[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=p[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=go[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=loader[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://juanfurlan[.]com[.]ar/[.]sys/?getexe=v2captcha21[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=go[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=loader[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=p[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=go[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=hosts2[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=p[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=pp[.]14[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=v2captcha21[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=v2newblogger[.]exe

hxxp://mdcoc[.]net/[.]sys/?getexe=v2webserver[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=go[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=loader[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=pp[.]14[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=v2captcha21[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=v2newblogger[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=v2webserver[.]exe

hxxp://prostruction[.]net/[.]sys/?getexe=go[.]exe

hxxp://prostruction[.]net/[.]sys/?getexe=hosts2[.]exe

hxxp://prostruction[.]net/[.]sys/?getexe=p[.]exe

hxxp://prostruction[.]net/[.]sys/?getexe=v2webserver[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=go[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=loader[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://shirleymancino[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=go[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=loader[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=loader[.]exe

hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=pp[.]14[.]exe

hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=v2captcha21[.]exe

hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=v2newblogger[.]exe

hxxp://testing[.]onlinesigns[.]co[.]za/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]australianslongevity[.]net/[.]sys/?getexe=loader[.]exe

hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]sys/?getexe=go[.]exe

hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]sys/?getexe=loader[.]exe

hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]corteostoricoterrasanctibenedicti[.]org/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=loader[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]dinovincenzopatroni[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]fininve[.]it/[.]sys/?getexe=go[.]exe

hxxp://www[.]fininve[.]it/[.]sys/?getexe=loader[.]exe

hxxp://www[.]fininve[.]it/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]fininve[.]it/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]fininve[.]it/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]fininve[.]it/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]fininve[.]it/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]firststategymnastics[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]firststategymnastics[.]com/[.]sys/?getexe=loader[.]exe

hxxp://www[.]firststategymnastics[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]firststategymnastics[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]firststategymnastics[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]firststategymnastics[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]firststategymnastics[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]firststategymnastics[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]gecahe[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]gecahe[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]lavalledellupo[.]it/[.]sys/?getexe=go[.]exe

hxxp://www[.]lavalledellupo[.]it/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]lavalledellupo[.]it/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]lavalledellupo[.]it/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]lavalledellupo[.]it/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]lavalledellupo[.]it/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]person[.]doae[.]go[.]th/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=loader[.]exe

hxxp://www[.]proelec-dpt[.]fr/[.]sys/?getexe=go[.]exe

hxxp://www[.]proelec-dpt[.]fr/[.]sys/?getexe=loader[.]exe

hxxp://www[.]proelec-dpt[.]fr/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]proelec-dpt[.]fr/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]proelec-dpt[.]fr/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=loader[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]skylergreene[.]com/[.]sys/?getexe=loader[.]exe

hxxp://www[.]skylergreene[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]skylergreene[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]skylergreene[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]skylergreene[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]skylergreene[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]skylergreene[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=loader[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]waypoint-center[.]org/[.]sys/?getexe=go[.]exe

hxxp://www[.]waypoint-center[.]org/[.]sys/?getexe=hosts2[.]exe

hxxp://www[.]waypoint-center[.]org/[.]sys/?getexe=p[.]exe

hxxp://www[.]waypoint-center[.]org/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]waypoint-center[.]org/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]waypoint-center[.]org/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=go[.]exe

hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=hosts2[.]exe

hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=p[.]exe

hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=pp[.]14[.]exe

hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=v2newblogger[.]exe

hxxp://zaferburo[.]com[.]tr/[.]sys/?getexe=v2webserver[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=fb[.]101[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=pp[.]14[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2captcha21[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2newblogger[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=v2webserver[.]exe

hxxp://goldenliontech[.]com/[.]sys/?getexe=fb[.]101[.]exe

hxxp://goldenliontech[.]com/[.]sys/?getexe=go[.]exe

hxxp://goldenliontech[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://goldenliontech[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://goldenliontech[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=fb[.]101[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=go[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]australianslongevity[.]net/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]australianslongevity[.]net/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]australianslongevity[.]net/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]australianslongevity[.]net/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]australianslongevity[.]net/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=fb[.]101[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://www[.]ntas[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=fb[.]101[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]powertreecorp[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://comunicat-de-presa[.]ro/[.]sys/?getexe=hosts2[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=v2captcha21[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=loader[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]bastakigroup[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2captcha21[.]exe

hxxp://www[.]its-email[.]co[.]uk/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]its-email[.]co[.]uk/[.]sys/?getexe=v2captcha21[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=fb[.]101[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=go[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=loader[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]bastakigroup[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=fb[.]101[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=go[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=hosts2[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=loader[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2captcha[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2prx[.]exe

hxxp://www[.]comunicat-de-presa[.]ro/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://reishus[.]de/[.]sys/?action=fbgen&mode=s&age=193&a=-186345958&v=82&crc=669&ie=6[.]0[.]2900[.]2180

hxxp://reishus[.]de/[.]sys/?getexe=fb[.]84[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=fbcheck[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=go[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=hosts2[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=pp[.]14[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=v2captcha[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=v2prx[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=fb[.]84[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=fbcheck[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=go[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=hosts2[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=v2captcha[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=v2prx[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=v2webserver[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=fb[.]84[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=fbcheck[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=go[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=v2captcha[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://easygiftgiving[.]com/[.]sys/?getexe=go[.]exe

hxxp://easygiftgiving[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://easygiftgiving[.]com/[.]sys/?getexe=v2captcha[.]exe

hxxp://easygiftgiving[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://easygiftgiving[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=fb[.]84[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=fbcheck[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=go[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=v2captcha[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=fb[.]83[.]exe

hxxp://mahjongmuseum[.]com/[.]sys/?getexe=v2reader[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=fb[.]83[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=v2reader[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=fb[.]80[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=fb[.]81[.]exe

hxxp://www[.]tabdesign[.]com[.]sg/[.]sys/?getexe=gr[.]05[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=fb[.]81[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=ff2ie[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=loader[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=tw[.]08[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=v2captcha[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://www[.]timsmurf[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://www[.]moviemusicuk[.]us/index[.]htm/?go

hxxp://www[.]wvgoldwings[.]com/video/

hxxp://www[.]wvgoldwings[.]com/video/?go

hxxp://boatnews[.]eu/[.]sys/?getexe=fb[.]76[.]exe

hxxp://boatnews[.]eu/[.]sys/?getexe=go[.]exe

hxxp://boatnews[.]eu/[.]sys/?getexe=pp[.]13[.]exe

hxxp://boatnews[.]eu/[.]sys/?getexe=v2prx[.]exe

hxxp://boatnews[.]eu/[.]sys/?getexe=v2webserver[.]exe

hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=fb[.]76[.]exe

hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=fblanding[.]exe

hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=go[.]exe

hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=pp[.]13[.]exe

hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=v2prx[.]exe

hxxp://jugendfeuerwehr-zermatt[.]ch/[.]sys/?getexe=v2webserver[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=fb[.]76[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=fblanding[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=pp[.]13[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=v2webserver[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=ms[.]26[.]exe

hxxp://whatsupgreenville[.]com/[.]sys/?getexe=fb[.]76[.]exe

hxxp://whatsupgreenville[.]com/[.]sys/?getexe=fblanding[.]exe

hxxp://whatsupgreenville[.]com/[.]sys/?getexe=go[.]exe

hxxp://whatsupgreenville[.]com/[.]sys/?getexe=pp[.]13[.]exe

hxxp://whatsupgreenville[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://whatsupgreenville[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://www[.]starbrands-ltd[.]com/[.]sys/?getexe=loader[.]exe

hxxp://suntico-dev[.]com/950/index[.]php?go

hxxp://musikskolan[.]orsa[.]se/434/?go

hxxp://rayfordliesbet[.]blogspot[.]com/

hxxp://sessionsmatarmatar[.]blogspot[.]com/

hxxp://jazz-brewery[.]com/[.]sys/?getexe=go[.]exe

hxxp://jazz-brewery[.]com/[.]sys/?getexe=mded[.]exe

hxxp://jazz-brewery[.]com/[.]sys/?getexe=tw[.]07[.]exe

hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=go[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=go[.]exe

hxxp://teplomer1[.]czechian[.]net/[.]sys/?getexe=go[.]exe

hxxp://www[.]foo6[.]com/[.]sys/?getexe=fb[.]75[.]exe

hxxp://www[.]foo6[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]foo6[.]com/[.]sys/?getexe=mded[.]exe

hxxp://www[.]foo6[.]com/[.]sys/?getexe=pp[.]12[.]exe

hxxp://www[.]foo6[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://www[.]fototeka[.]rs/[.]sys/?getexe=fb[.]75[.]exe

hxxp://www[.]fototeka[.]rs/[.]sys/?getexe=go[.]exe

hxxp://www[.]fototeka[.]rs/[.]sys/?getexe=mded[.]exe

hxxp://www[.]fototeka[.]rs/[.]sys/?getexe=pp[.]12[.]exe

hxxp://www[.]fototeka[.]rs/[.]sys/?getexe=v2prx[.]exe

hxxp://www[.]starbrands-ltd[.]com/[.]sys/?getexe=go[.]exe

hxxp://www[.]starbrands-ltd[.]com/[.]sys/?getexe=tw[.]07[.]exe

hxxp://russkiytoy[.]at/[.]sys/?getexe=tw[.]07[.]exe

hxxp://www[.]foo6[.]com/[.]sys/?getexe=ff2ie[.]exe

hxxp://arpkriswanto[.]blogspot[.]com/

hxxp://ayoubayoubpatouhas[.]blogspot[.]com/

hxxp://ayounirwinirwin[.]blogspot[.]com/

hxxp://bardinteagan[.]blogspot[.]com/

hxxp://cameliatarif[.]blogspot[.]com/

hxxp://focalshossam[.]blogspot[.]com/

hxxp://mckeehantangytangy[.]blogspot[.]com/

hxxp://pennockmuthanna[.]blogspot[.]com/

hxxp://rosalieishananto[.]blogspot[.]com/

hxxp://russkiytoy[.]at/[.]sys/?getexe=fb[.]75[.]exe

hxxp://russkiytoy[.]at/[.]sys/?getexe=go[.]exe

hxxp://russkiytoy[.]at/[.]sys/?getexe=pp[.]12[.]exe

hxxp://russkiytoy[.]at/[.]sys/?getexe=v2prx[.]exe

hxxp://totallyask[.]to[.]ohost[.]de/207/?go

hxxp://aidanaidantattersfield[.]blogspot[.]com/

hxxp://nine[.]jo/834/?go

hxxp://deploytech[.]co[.]nz/368/?go

hxxp://insalacotecwyn[.]blogspot[.]com/

hxxp://jurgisbooty[.]blogspot[.]com/

hxxp://parrisvistisen[.]blogspot[.]com/

hxxp://rotermundraimon[.]blogspot[.]com/

hxxp://tendaiblunk[.]blogspot[.]com/

hxxp://agr255[.]cne-escutismo[.]pt/[.]sys/?getexe=fb[.]75[.]exe

hxxp://agr255[.]cne-escutismo[.]pt/[.]sys/?getexe=get[.]exe

hxxp://agr255[.]cne-escutismo[.]pt/[.]sys/?getexe=pp[.]12[.]exe

hxxp://agr255[.]cne-escutismo[.]pt/[.]sys/?getexe=v2prx[.]exe

hxxp://indigozeus1[.]net/zs12/bot[.]exe

hxxp://jazz-brewery[.]com/[.]sys/?getexe=fb[.]75[.]exe

hxxp://jazz-brewery[.]com/[.]sys/?getexe=get[.]exe

hxxp://jazz-brewery[.]com/[.]sys/?getexe=pp[.]12[.]exe

hxxp://jazz-brewery[.]com/[.]sys/?getexe=v2prx[.]exe

hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=fb[.]75[.]exe

hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=get[.]exe

hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=pp[.]12[.]exe

hxxp://musikskolan[.]orsa[.]se/[.]sys/?getexe=v2prx[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=fb[.]75[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=get[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=pp[.]12[.]exe

hxxp://qatar-business-guide[.]net/[.]sys/?getexe=v2prx[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=fb[.]75[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=get[.]exe

hxxp://reishus[.]de/[.]sys/?getexe=pp[.]12[.]exe

hxxp://www[.]delicesevdam[.]net/botistan[.]exe

hxxp://devline[.]se/6/

hxxp://kiano-180809[.]com/the/?pid=30759

hxxp://unix-service[.]com/js1[.]php

hxxp://tohva[.]org/bestacti0n/

hxxp://hellnax[.]com/e/install_126[.]exe

hxxp://magnaniwines[.]com/freeevlds/gteftf9hns2[.]js

hxxp://restaurant-soleildafrique[.]fr/fuunnyvide0/o4m833a8[.]js

hxxp://jagtridningjylland[.]dk/beestdwd/87m[.]js

hxxp://rtprestaurantguide[.]com/amalzlngc1ips/968e8[.]js

hxxp://s198814458[.]onlinehome[.]us/y0urperf0rmans/ui9o[.]js

hxxp://godupholdshim[.]netfirms[.]com/c00ldwd/vzde[.]js

hxxp://lionandlamb[.]biz/privalefi1m/a8es[.]js

hxxp://pangea-consulting[.]com/y0urperf0rmans/pd38ss9n-[.]js

hxxp://kristameier[.]com/fuunnysh0w/h80q-[.]js

hxxp://proteatr[.]edu[.]mhost[.]ru/privalec1ip/82yiiy3[.]js

hxxp://videoleverage[.]com/beesttw/coh[.]js

hxxp://lpexpressions[.]com/c00lperf0rmans/pgy[.]js

hxxp://ram-220709[.]com/go/?pid=30937&type=videxp

hxxp://r-d-cgpay-090709[.]com/go/index[.]php

hxxp://upload[.]octopus-multimedia[.]be/1/pdrv[.]exe

hxxp://upload[.]octopus-multimedia[.]be/1/pp[.]10[.]exe

hxxp://upload[.]octopus-multimedia[.]be/1/nfr[.]exe

hxxp://cgpay-re-230609[.]com/the/?pid=8176&type=videxp

hxxp://liesbethmilan[.]be/1/be[.]15[.]exe

hxxp://liesbethmilan[.]be/1/captcha6[.]exe

hxxp://liesbethmilan[.]be/1/hi[.]12[.]exe

hxxp://liesbethmilan[.]be/1/ms[.]19[.]exe

hxxp://liesbethmilan[.]be/1/pdrv[.]exe

hxxp://liesbethmilan[.]be/1/pp[.]10[.]exe

hxxp://liesbethmilan[.]be/1/tg[.]12[.]exe

hxxp://liesbethmilan[.]be/1/websrvx2[.]exe

hxxp://taahe[.]bij[.]pl/cowgirls[.]html

hxxp://yourfindguide[.]com/search[.]php?said=net15&q=jesus+christ&rfrl=

hxxp://rd040609-cgpay[.]net

hxxp://nicevideo18[.]net/software/ea2faf7008/11400/1/Setup[.]exe

hxxp://niceshoot89[.]com/software/04f456eca8/30000/1/Setup[.]exe

hxxp://updatedb87[.]cn/out/load[.]php

hxxp://bewfsnfwka[.]net/ccsuper3[.]php

hxxp://r-cgpay-15062009[.]com/go/index[.]php

hxxp://carlossextube[.]com

hxxp://r-cg100609[.]com/go/?pid=10160&type=videxp

hxxp://r-cg100609[.]com/the/?pid=8198

hxxp://utopia-products[.]com/setup[.]exe

hxxp://www[.]osftp[.]yoyo[.]pl/1/nfr[.]exe

hxxp://www[.]osftp[.]yoyo[.]pl/1/pp[.]10[.]exe

hxxp://www[.]utopia-footwear[.]com[.]au/setup[.]exe

hxxp://nicevideo44[.]com/download/1/1000/5

hxxp://cgpay0406[.]com/the/?pid=8198

hxxp://evidek[.]ro/1/tg[.]12[.]exe

hxxp://google-reseach[.]com/gfeed/link/18_escort_female_old_year/1_default[.]html

hxxp://mailgov[.]net/gfeed/click[.]php?q=&p=1

hxxp://mailgov[.]net/tds/go[.]php?sid=1&tds-key=

hxxp://evidek[.]ro/1/pp[.]10[.]exe

hxxp://redir3105[.]com/go/index[.]php

hxxp://videogtx4you1[.]com/download/1/1234/0

hxxp://videofx4you1[.]com/software/019d135faa/10180/1/Setup[.]exe

hxxp://search-adverts[.]net/forum/load[.]php?id=4

hxxp://indigolife[.]com[.]au/fantasticdemonstration/lrxgodudz[.]js

hxxp://videofx4you2[.]com/download/1/1000/5

hxxp://videofx4you2[.]com/software/a6a6ed398e/10005/1/Setup[.]exe

hxxp://videofx4you2[.]com/view/1/1000/5

hxxp://redir1805[.]com/go/fb_s[.]php

hxxp://www[.]limnos[.]si/home-video/

hxxp://dl[.]guarddog2009[.]com/cw[.]exe

hxxp://redir1805[.]com/the/?pid=10350&type=exe

hxxp://megavipsite[.]cn/avl/162[.]exe

hxxp://megavipsite[.]cn/avl/178[.]exe

hxxp://stjude-rawang[.]com/1/nfr[.]exe

hxxp://stjude-rawang[.]com/1/pp[.]08[.]exe

hxxp://mxviewworldmy2[.]com/download/1/1113/1/FlashPlayer[.]v9

hxxp://tubeee[.]com/video[.]php?l=5:52&id=0&n=teen&a=whiteboy66&path=[.]/tmb/teen/04[.]jpg&rat=[.]/img/rating3[.]jpg&v=122575

hxxp://jii[.]be/s116/in[.]cgi?16

hxxp://livestockfeed[.]cn/mov/r/index[.]html

hxxp://redir2404[.]com/the/?pid=8047&type=videxp

hxxp://mxviewworldmy1[.]com/view/1/1193/0

hxxp://puttsoftwareupdate[.]com/images/2[.]exe

hxxp://puttsoftwareupdate[.]com/images/p[.]exe

hxxp://tds[.]smallsexvids[.]info/go[.]php?sid=1

hxxp://hxviewworldmy1[.]com/software/3f507c14a5/12440/1/Setup[.]exe

hxxp://popka-klass[.]net

hxxp://rxtraffclicks[.]com/download/1/1000/5

hxxp://directseek[.]org/25/load[.]php

hxxp://redir1504[.]com/go/

hxxp://redir2304[.]com/go/

hxxp://redir2404[.]com/go/

hxxp://y18032009[.]com/go/

hxxp://y18032009[.]com/the/

hxxp://y18032009[.]com/the/?pid=1

hxxp://y18032009[.]com/the/?pid=2

hxxp://hxviewworldmy2[.]com/software/e3d6b7561f/10005/1/Setup[.]exe

hxxp://expfanclub[.]com/lom/index[.]php

hxxp://hqviewworldmy1[.]com/software/c2fb59fa16/12221/1/2[.]exe

hxxp://traffbox[.]com/in[.]cgi?3

hxxp://rtraffclicks[.]com/software/38e4f74690/10005/1/Setup[.]exe

hxxp://viewworldmy2[.]com/software/38e4f74690/10005/1/Setup[.]exe

hxxp://whitevilleportal[.]com/images/podmena[.]exe

hxxp://avprotect[.]net/podmena[.]exe

hxxp://viewworldmy1[.]com/download/1/1000/5

hxxp://xviewworldmy1[.]com/download/1/1000/5

hxxp://tri-visionhomes[.]com/im/podmena[.]exe

hxxp://edwardhomepage[.]info/podmena[.]exe

hxxp://steer2[.]co[.]uk/im/podmena[.]exe

hxxp://tmr-unlimited[.]com/podmena[.]exe

hxxp://tomsspace[.]co[.]uk/im/podmena[.]exe

hxxp://tryithere[.]net/podmena[.]exe

hxxp://ldj5[.]biz/setup[.]exe

hxxp://viewworldh[.]com/download/1/1000/5

hxxp://viewworldy[.]com/download/1/1000/5

hxxp://intelfarm[.]com/1/popup_main[.]exe

No comments:

Post a Comment