【雷电模拟器】刺激战场影子V3.6多功能辅助,稳定不封

3512074

66666666666666

211048110

感谢楼主分享！zn50有你更精彩！

841642621

感谢楼主分享！zn50有你更精彩！ff

辉煌仪奇

感谢楼主分享！zn50有你更精彩！

125148201

kan kan lo haodongxi

辉煌仪奇

关键行为
行为描述：        跨进程写入数据
详情信息：       
TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x00400000, Size = 0x00001000 TargetPID = 0x00000bd8

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x00401000, Size = 0x00097000 TargetPID = 0x00000bd8

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x00498000, Size = 0x00019000 TargetPID = 0x00000bd8

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x004b1000, Size = 0x00012000 TargetPID = 0x00000bd8

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x004e5000, Size = 0x00006000 TargetPID = 0x00000bd8

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x7ffd3008, Size = 0x00000004 TargetPID = 0x00000bd8

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x00400000, Size = 0x00001000 TargetPID = 0x00000c2c

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x0040c000, Size = 0x00004e00 TargetPID = 0x00000c2c

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x00411000, Size = 0x00000200 TargetPID = 0x00000c2c

TargetProcess = C:\WINDOWS\system32\cmd.exe, WriteAddress = 0x7ffdf008, Size = 0x00000004 TargetPID = 0x00000c2c

行为描述：        常规加载驱动
详情信息：       
\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\829EJV3TJ3P3VL3R3XO4U4AQ4W4CS4.dat

行为描述：        设置线程上下文
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\影子科技v3.6【雷电模拟器】.exe

行为描述：        获取TickCount值
详情信息：       
TickCount = 225531, SleepMilliseconds = 2000.

TickCount = 225562, SleepMilliseconds = 2000.

TickCount = 225578, SleepMilliseconds = 2000.

TickCount = 228265, SleepMilliseconds = 2000.

TickCount = 228181, SleepMilliseconds = 10.

TickCount = 228197, SleepMilliseconds = 10.

TickCount = 228275, SleepMilliseconds = 10.

TickCount = 228322, SleepMilliseconds = 10.

TickCount = 228338, SleepMilliseconds = 10.

TickCount = 230260, SleepMilliseconds = 10.

TickCount = 232463, SleepMilliseconds = 10.

TickCount = 232478, SleepMilliseconds = 10.

TickCount = 234353, SleepMilliseconds = 10.

TickCount = 234385, SleepMilliseconds = 10.

TickCount = 236603, SleepMilliseconds = 10.

行为描述：        设置启动项
详情信息：       
C:\Documents and Settings\All Users\「开始」菜单\程序\启动\cmonom.bat

行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5

C:\Documents and Settings\Administrator\Local Settings\History

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5

C:\Documents and Settings\Administrator\Cookies

C:\Documents and Settings\Administrator\IETldCache

行为描述：        创建系统服务
详情信息：       
[服务创建成功]: 829EJV3TJ3P3VL3R3XO4U4AQ4W4CS4, C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\\829EJV3TJ3P3VL3R3XO4U4AQ4W4CS4.dat

[服务创建成功]: Driver, c:\Driver.sys

A469418180

顶帖是一种态度，也是一种尊重。

chaoluo

】刺激战场影子V3.6多

xq823834029

看帖必回真君子，好贴必顶大丈夫