Technical Information
- %WINDIR%\syswow64\locationnotifications.exe
- %WINDIR%\syswow64\cmd.exe
- <Current directory>\config.ini
- <Current directory>\post
- <Current directory>\post
- <Current directory>\post
- 'o4##2f.cn':1219
- 'o4##2f.cn':9112
- http://o4###f.cn:1219/Data/KG1lVi90nf1oWupHlBrOrYXjSh1H5VlT0rw4gZ1KrFOzlHlqMnjNAOeQK75ULAk4CflNhTruf58pm5kpth6LYnsGejRQHDkaSFkw9wZgYgvYEjRWzwEmt32303231C4EA34D4C231C8D532CAB13235B7D636C3EB.txt?...
- http://11#.##2.248.5:1219/CFMMB/Tips.txt?10#####
- DNS ASK o4##2f.cn
- ClassName: 'CrossFire' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' ' (with hidden window)
- '%WINDIR%\syswow64\locationnotifications.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\locationnotifications.exe'