I will skip the reversing part: i'm a bit bored to take 50 screenshots and go step by step about what's do the 'M' version of Tobfy. (this winlock is very primitive and relatively easy to understand)
So, let's go directly to the C&C part.
French landing when loaded (buggy IP retrieving, and geoloc):
• dns: 1 ›› ip: 126.96.36.199 - adresse: AREKOV.COM
Some samples took from the server:
I'm a bit unaware about Tobfy but that the first time i see this one on affiliate system.