Technical Information
- %WINDIR%\syswow64\mobsync.exe
- %WINDIR%\syswow64\cmd.exe
- <Current directory>\config.ini
- <Current directory>\post
- <Current directory>\post
- <Current directory>\post
- 'o4##2f.cn':1219
- 'o4##2f.cn':9112
- http://o4###f.cn:1219/Data/NefceizduW2ly08Mu0ANAKeg0lmhcV5aiiGQLlTGPMVx1nD27PKf1drT29UupmvMFhqCmzNwqhu0qW1lYxRQNYtjQO4ieOhmnfUX32303231C4EA33D4C23237C8D539CAB13132B7D63231C3EB.txt?11##### via o...
- http://11#.##2.248.5:1219/CFBED/Tips.txt?11#####
- DNS ASK o4##2f.cn
- ClassName: 'CrossFire' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' ' (with hidden window)
- '%WINDIR%\syswow64\mobsync.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\mobsync.exe'