http://101.55.121.196/server.exe
http://103.24.94.60/m53.exe
http://103.24.94.60/m54.exe
http://103.24.94.60/m.exe
http://118.193.228.207/20753.exe
http://118.193.228.207/m.exe
http://118.193.228.207/m.exe	5D837415380F648C0DBD8C26C36F5DEC
http://157.7.137.197/t/m.exe
http://211.78.90.113/music/cover/as/update.exe
http://blogattach.naver.com/4bde57e7f3adaf735db9dee1d430483398c73fd8f3/20140731_150_blogfile/carven21_1406799482913_2pjw3V_exe/DestoryRat_2385.exe
http://client.mailsecurityservice.com/ViewClient/connect.php?n=0409.exe
http://client.mailsecurityservice.com/ViewClient/connect.php?n=arp.exe
http://client.mailsecurityservice.com/ViewClient/connect.php?n=MOFA.exe
http://client.mailsecurityservice.com/ViewClient/connect.php?n=zxishanchu1106.exe
http://news.hnn.hk/2014/0729/private_newstw.php
http://www.hjclub.info/bbs/uploadfiles/45/AwViewWx.exe
http://www.petsgoalfactory.com/e/update/uptedas.exe
http://www.twnewsdaily.com/home/old_no/apple.jpg
http://www.twnewsdaily.com/home/old_no/pay.html