Technical Information
- %TEMP%\xtwlpk1
- %TEMP%\xtwlpk2
- %TEMP%\xtwlpk3
- http://sa###t-bali.com/yr387n3?xt###########
- http://vm####-hudeem.ru/yr387n3?xt###########
- http://to##hot.com/yr387n3?xt###########
- DNS ASK sa###t-bali.com
- DNS ASK vm####-hudeem.ru
- DNS ASK to##hot.com
- DNS ASK ja###brith.net
- DNS ASK sy###ont.com