2026
Master Üye
- Katılım
- 10 Mar 2024
- Mesajlar
- 1,041
- Beğeniler
- 92
gecmis olsun simdidenher hangi bir gui ya da pencere açılmadı bende açınca
gecmis olsun simdidenher hangi bir gui ya da pencere açılmadı bende açınca
DAJFGOŞIADJFGŞOIADFŞOGIJ yok la mainde açmadımgecmis olsun simdiden
he iyiDAJFGOŞIADJFGŞOIADFŞOGIJ yok la mainde açmadım
adamın perma banı hayırlı olsun şimdidenTHREAT LEVEL: 8/11EXTREME RISK - DANGEROUS MALWARE!
BULDUKLARIM:
DISCORD:
- Discord sunucuları bulundu
- AdjustTokenPrivileges - Token çalma yeteneği!
- OpenProcessToken - Token erişimi
FİLE SYSTEM:
- \Desktop\ - Masaüstüne erişiyor!
- \Downloads\ - İndirilenler'e erişiyor!
- mappings.txt - Kendi dosyaları
CRYPTO WALLET:
- BCryptOpenAlgorithmProvider - Şifreleme/kripto işlemleri
SPYWARE:
- GetCapture, SetCapture - Ekran yakalama
- RtlCaptureContext - Sistem context yakalama
PERSISTENCE:
SONUÇ:
- GetStartupInfoW - Başlangıçta çalışma
BU SADECE HİLE DEĞİL!
**VERİ HIRS
IZI YAPIYOR!**Discord token çalabilir
Dosyalarına erişiyor (Desktop, Downloads)
Ekran görüntüsü alabilir
tam dangalak w
bencedeadamın perma banı hayırlı olsun şimdiden
yav insan bari obf ataydı amlkwdamlkwd/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
undefined8 *
FUN_14000b0b0(undefined8 *param_1,undefined8 *param_2,short param_3,undefined8 *param_4,
undefined8 *param_5)
{
code *pcVar1;
int iVar2;
undefined8 *puVar3;
longlong lVar4;
longlong lVar5;
longlong lVar6;
undefined8 *****pppppuVar7;
ulonglong uVar8;
ulonglong uVar9;
undefined1 *puVar10;
undefined1 *puVar11;
undefined1 *puVar12;
undefined4 uVar13;
undefined8 uStack_130;
undefined1 auStack_128 [8];
undefined1 auStack_120 [24];
undefined8 local_108;
undefined8 local_100;
undefined8 local_f8;
undefined1 local_e8;
undefined8 *local_e0;
undefined2 local_d0;
undefined6 uStack_ce;
undefined8 local_c0;
ulonglong local_b8;
int local_b0;
uint local_ac;
undefined8 local_a8;
undefined8 uStack_a0;
undefined8 local_98;
undefined8 uStack_90;
ulonglong local_88;
longlong lStack_80;
longlong local_78;
undefined8 ****local_70;
undefined8 uStack_68;
ulonglong local_60;
ulonglong local_58;
ulonglong local_50;
puVar12 = auStack_128;
puVar11 = auStack_128;
local_50 = DAT_1400ba400 ^ (ulonglong)auStack_128;
uStack_a0 = 0;
local_98 = 0;
uStack_90 = 0xf;
local_a8 = (undefined8 *)0x0;
local_e0 = param_1;
puVar3 = (undefined8 *)FUN_14000ac80(&local_d0);
if (7 < (ulonglong)puVar3[3]) {
puVar3 = (undefined8 *)*puVar3;
}
uVar13 = 0;
local_108 = (ulonglong)local_108._4_4_ << 0x20;
lVar4 = WinHttpOpen(puVar3,0,0,0);
if (7 < local_b8) {
uVar9 = local_b8 * 2 + 2;
lVar6 = CONCAT62(uStack_ce,local_d0);
lVar5 = lVar6;
if (uVar9 < 0x1000) {
LAB_14000b172:
FUN_140060bc0(lVar5,uVar9);
goto LAB_14000b177;
}
lVar5 = *(longlong *)(lVar6 + -8);
puVar10 = auStack_128;
if ((lVar6 - lVar5) - 8U < 0x20) {
uVar9 = local_b8 * 2 + 0x29;
goto LAB_14000b172;
}
LAB_14000b59d:
pcVar1 = (code *)swi(0x29);
(*pcVar1)(5);
puVar11 = puVar10 + 8;
goto LAB_14000b5a4;
}
LAB_14000b177:
local_c0 = 0;
local_b8 = 7;
local_d0 = 0;
if (lVar4 == 0) {
LAB_14000b18d:
*param_1 = 0;
param_1[1] = 0;
param_1[2] = 0;
param_1[3] = 0;
LAB_14000b19c:
FUN_140001300(param_1,&DAT_140090b32,0);
}
else {
local_108 = CONCAT44(local_108._4_4_,10000);
WinHttpSetTimeouts(lVar4,5000,5000,10000);
if (7 < (ulonglong)param_2[3]) {
param_2 = (undefined8 *)*param_2;
}
local_e0 = (undefined8 *)WinHttpConnect(lVar4,param_2,param_3,0);
if (local_e0 == (undefined8 *)0x0) {
WinHttpCloseHandle(lVar4);
goto LAB_14000b18d;
}
if (param_3 == 0x1bb) {
uVar13 = 0x800000;
}
if (7 < (ulonglong)param_4[3]) {
param_4 = (undefined8 *)*param_4;
}
local_f8 = CONCAT44(local_f8._4_4_,uVar13);
local_100 = 0;
local_108 = 0;
lVar5 = WinHttpOpenRequest(local_e0,L"POST",param_4,0);
if (lVar5 == 0) {
WinHttpCloseHandle(local_e0);
WinHttpCloseHandle(lVar4);
*param_1 = 0;
param_1[1] = 0;
param_1[2] = 0;
param_1[3] = 0;
goto LAB_14000b19c;
}
if (param_3 == 0x1bb) {
local_ac = 0x3300;
WinHttpSetOption(lVar5,0x1f,&local_ac,4);
}
local_70 = (undefined8 *****)0x0;
uStack_68 = 0;
local_60 = 0;
local_58 = 0;
FUN_140001400(&local_70,L"Content-Type: application/json\r\nAccept: application/json\r\n",0x3a);
puVar3 = param_5 + 2;
if (0xf < (ulonglong)param_5[3]) {
param_5 = (undefined8 *)*param_5;
}
pppppuVar7 = &local_70;
if (7 < local_58) {
pppppuVar7 = (undefined8 *****)local_70;
}
local_f8 = 0;
local_100 = CONCAT44(local_100._4_4_,*(undefined4 *)puVar3);
local_108 = CONCAT44(local_108._4_4_,*(undefined4 *)puVar3);
iVar2 = WinHttpSendRequest(lVar5,pppppuVar7,local_60 & 0xffffffff,param_5);
if ((iVar2 != 0) && (iVar2 = WinHttpReceiveResponse(lVar5,0), iVar2 != 0)) {
local_b0 = 0;
iVar2 = WinHttpQueryDataAvailable(lVar5,&local_b0);
while ((iVar2 != 0 && (local_b0 != 0))) {
uVar9 = (ulonglong)(local_b0 + 1);
if (local_b0 == -1) {
uVar9 = 0xffffffffffffffff;
}
local_88 = 0;
lStack_80 = 0;
local_78 = 0;
if (uVar9 != 0) {
if (0x7fffffffffffffff < uVar9) goto LAB_14000b5ab;
if (uVar9 < 0x1000) {
local_88 = FUN_140060b70(uVar9);
LAB_14000b3bb:
lVar6 = local_88 + uVar9;
local_78 = lVar6;
FUN_14008cab0(local_88,0,uVar9);
lStack_80 = lVar6;
goto LAB_14000b3dc;
}
if (uVar9 + 0x27 <= uVar9) {
/* WARNING: Subroutine does not return */
FUN_1400053a0();
}
lVar6 = FUN_140060b70();
if (lVar6 != 0) {
local_88 = lVar6 + 0x27U & 0xffffffffffffffe0;
*(longlong *)(local_88 - 8) = lVar6;
goto LAB_14000b3bb;
}
LAB_14000b596:
pcVar1 = (code *)swi(0x29);
(*pcVar1)(5);
puVar10 = auStack_120;
goto LAB_14000b59d;
}
LAB_14000b3dc:
local_ac = 0;
iVar2 = WinHttpReadData(lVar5,local_88,local_b0,&local_ac);
if ((iVar2 != 0) && (local_ac != 0)) {
uVar9 = (ulonglong)local_ac;
if (uStack_90 - local_98 < uVar9) {
local_108 = uVar9;
FUN_140006500(&local_a8,uVar9,local_e8);
}
else {
puVar3 = &local_a8;
if (0xf < uStack_90) {
puVar3 = local_a8;
}
lVar6 = (longlong)puVar3 + local_98;
local_98 = local_98 + uVar9;
FUN_14008c400(lVar6,local_88,local_ac);
*(undefined1 *)(uVar9 + lVar6) = 0;
}
}
if (local_88 != 0) {
uVar8 = local_78 - local_88;
uVar9 = local_88;
if (0xfff < uVar8) {
if (0x1f < (local_88 - *(ulonglong *)(local_88 - 8)) - 8) goto LAB_14000b596;
uVar8 = uVar8 + 0x27;
uVar9 = *(ulonglong *)(local_88 - 8);
}
FUN_140060bc0(uVar9,uVar8);
}
iVar2 = WinHttpQueryDataAvailable(lVar5,&local_b0);
}
}
WinHttpCloseHandle(lVar5);
WinHttpCloseHandle(local_e0);
WinHttpCloseHandle(lVar4);
*(undefined4 *)param_1 = (undefined4)local_a8;
*(undefined4 *)((longlong)param_1 + 4) = local_a8._4_4_;
*(undefined4 *)(param_1 + 1) = (undefined4)uStack_a0;
*(undefined4 *)((longlong)param_1 + 0xc) = uStack_a0._4_4_;
*(undefined4 *)(param_1 + 2) = (undefined4)local_98;
*(undefined4 *)((longlong)param_1 + 0x14) = local_98._4_4_;
*(undefined4 *)(param_1 + 3) = (undefined4)uStack_90;
*(undefined4 *)((longlong)param_1 + 0x1c) = uStack_90._4_4_;
local_98 = 0;
uStack_90 = 0xf;
local_a8 = (undefined8 *)((ulonglong)local_a8 & 0xffffffffffffff00);
if (7 < local_58) {
uVar9 = local_58 * 2 + 2;
pppppuVar7 = (undefined8 *****)local_70;
if (0xfff < uVar9) {
pppppuVar7 = (undefined8 *****)local_70[-1];
puVar10 = auStack_128;
if (0x1f < (ulonglong)((longlong)local_70 + (-8 - (longlong)pppppuVar7)))
goto LAB_14000b59d;
uVar9 = local_58 * 2 + 0x29;
}
FUN_140060bc0(pppppuVar7,uVar9);
}
local_60 = 0;
local_58 = 7;
local_70 = (undefined8 ****)((ulonglong)local_70 & 0xffffffffffff0000);
}
if (0xf < uStack_90) {
uVar9 = uStack_90 + 1;
puVar3 = local_a8;
if (0xfff < uVar9) {
puVar3 = (undefined8 *)local_a8[-1];
if (0x1f < (ulonglong)((longlong)local_a8 + (-8 - (longlong)puVar3))) {
LAB_14000b5a4:
pcVar1 = (code *)swi(0x29);
(*pcVar1)(5);
puVar12 = puVar11 + 8;
LAB_14000b5ab:
/* WARNING: Subroutine does not return */
*(undefined **)(puVar12 + -8) = &UNK_14000b5b0;
FUN_1400054c0();
}
uVar9 = uStack_90 + 0x28;
}
FUN_140060bc0(puVar3,uVar9);
}
return param_1;
}
niye veri gönderiyo sunucuya?
obfli zatende cözemeyecegim kadar degilyav insan bari obf ataydı amlkwdamlkwd
Onuda yapmış yani aokwndakwndokanwdonawdobfli zatende cözemeyecegim kadar degil