Technical Information
- %WINDIR%\syswow64\recover.exe
- C:\fgfff0f1fjg.ini
- <Current directory>\config.ini
- <Current directory>\post
- C:\fgfff0f1fjg.ini
- <Current directory>\post
- <Full path to file>
- <Current directory>\post
- http://FI##.##00001.COM:1714/CFBED/CFBED.txt?10#####
- http://FI##.##00001.COM:1714/CFBED/CFBEDpuppet.Txt?10#####
- http://fi##.##00001.com:1714/Data/AOAOVCJQYVLVVQO44VQLJNl4LV4OE1lLSO4YJ1YLV2AY6lEY2CCCLNCA4EJ6JlOYE2JACEACS26V6YA1EVEN16LQELJJYY4ACN4J4AEVVAVJ1VJY1J6lOV2AOE32303231C4EA31D4C23134C8D536CAB13236B...
- http://FI##.##00001.COM:1714/CFBED/Tips.ini?10#####
- DNS ASK fi##.#f00001.com
- ClassName: 'CrossFire' WindowName: ''
- '%WINDIR%\syswow64\recover.exe'