The plugin URL is stored in file in following format:  /plugin/index.php?plugin=<Plugin_Name>  The following plugins are found in the memory of the Zyklon malware:  /plugin/index.php?plugin=cuda /plugin/index.php?plugin=minerd /plugin/index.php?plugin=sgminer /plugin/index.php?plugin=socks /plugin/index.php?plugin=tor /plugin/index.php?plugin=games /plugin/index.php?plugin=software /plugin/index.php?plugin=ftp /plugin/index.php?plugin=email /plugin/index.php?plugin=browser  The downloaded plugins are injected into: Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe