ctlp.co/phm (shortened link – 302)
schnitzelfvideop.tk/84ae.html (frame to load next link)
zvlks.gormless.org/208.html?qbzsyl (page with html encoded links to download exe)
126.96.36.199/imagedl11.php (exe – application/force-download)
188.8.131.52/imagedl11.php (exe – application/force-download)
An example page can be found here. The links are just HTML Encoded and they will decode to the exe links.
The resulting exe will match the filename regex below.
Many comments about this can be found on mywot.