I would check the last accessed time of the files in question. Those urls look like traffic to ad servers to me that may be just from visiting websites with ads.
Well the links I posted are from the time the guy was busted on my laptop, early morning hours. There are so many files I wouldn't know which files to check.