绝地求生单板骨骼透视破解版（可过租号器使用）

lwick

感谢分享！

123WoodMan666

1

aa354888

啊

1578221801

感谢楼主分享！zn50有你更精彩！

w930322

此文件为病毒 请勿使用！！！！！！！
文件名称：
QQ.zip

MD5： 79ea59e1085bef8597e6c38d3a928fa9  
文件类型： zip  
上传时间： 2017-12-02 21:08:41  
出品公司： N/A  
版本： N/A  
壳或编译器信息： COMPILER:Elan  
子文件信息： 详情







关键行为


行为描述： 修改原系统的EXE文件  
详情信息：
C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe

C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll

行为描述： 跨进程写入数据  
详情信息：
TargetProcess = C:\WINDOWS\system32\smss.exe, WriteAddress = 0x20060000, Size = 0x0000b000 TargetPID = 0x00000208

TargetProcess = C:\WINDOWS\system32\smss.exe, WriteAddress = 0x00310000, Size = 0x00000233 TargetPID = 0x00000208

TargetProcess = C:\WINDOWS\system32\smss.exe, WriteAddress = 0x00320000, Size = 0x000000df TargetPID = 0x00000208

TargetProcess = C:\WINDOWS\system32\smss.exe, WriteAddress = 0x00330000, Size = 0x00000030 TargetPID = 0x00000208

TargetProcess = C:\WINDOWS\system32\smss.exe, WriteAddress = 0x00340000, Size = 0x00000084 TargetPID = 0x00000208

TargetProcess = C:\WINDOWS\system32\csrss.exe, WriteAddress = 0x20060000, Size = 0x0000b000 TargetPID = 0x00000248

TargetProcess = C:\WINDOWS\system32\csrss.exe, WriteAddress = 0x03ed0000, Size = 0x00000233 TargetPID = 0x00000248

TargetProcess = C:\WINDOWS\system32\csrss.exe, WriteAddress = 0x03ee0000, Size = 0x000000df TargetPID = 0x00000248

TargetProcess = C:\WINDOWS\system32\csrss.exe, WriteAddress = 0x03ef0000, Size = 0x00000030 TargetPID = 0x00000248

TargetProcess = C:\WINDOWS\system32\csrss.exe, WriteAddress = 0x03f00000, Size = 0x00000084 TargetPID = 0x00000248

TargetProcess = C:\WINDOWS\system32\winlogon.exe, WriteAddress = 0x20060000, Size = 0x0000b000 TargetPID = 0x00000260

TargetProcess = C:\WINDOWS\system32\VBoxService.exe, WriteAddress = 0x0012f2ec, Size = 0x00000004 TargetPID = 0x00000ae8

TargetProcess = C:\WINDOWS\system32\winlogon.exe, WriteAddress = 0x00e30000, Size = 0x00000233 TargetPID = 0x00000260

TargetProcess = C:\WINDOWS\system32\winlogon.exe, WriteAddress = 0x00e40000, Size = 0x000000df TargetPID = 0x00000260

TargetProcess = C:\WINDOWS\system32\winlogon.exe, WriteAddress = 0x010d0000, Size = 0x00000030 TargetPID = 0x00000260

行为描述： 插入APC（异步过程调用）  
详情信息：
C:\Program Files\Internet Explorer\iexplore.exe

行为描述： 创建远程线程  
详情信息：
TargetProcess: smss.exe, InheritedFromPID = 4, ProcessID = 520, ThreadID = 2800, StartAddress = 00340000, Parameter = 00330000

TargetProcess: csrss.exe, InheritedFromPID = 520, ProcessID = 584, ThreadID = 2820, StartAddress = 03F00000, Parameter = 03EF0000

TargetProcess: winlogon.exe, InheritedFromPID = 520, ProcessID = 608, ThreadID = 2840, StartAddress = 010E0000, Parameter = 010D0000

TargetProcess: services.exe, InheritedFromPID = 608, ProcessID = 652, ThreadID = 2852, StartAddress = 00BC0000, Parameter = 00BB0000

TargetProcess: lsass.exe, InheritedFromPID = 608, ProcessID = 664, ThreadID = 2864, StartAddress = 00DE0000, Parameter = 00DD0000

TargetProcess: svchost.exe, InheritedFromPID = 652, ProcessID = 872, ThreadID = 2876, StartAddress = 025D0000, Parameter = 025C0000

TargetProcess: svchost.exe, InheritedFromPID = 652, ProcessID = 936, ThreadID = 2888, StartAddress = 00E90000, Parameter = 00E80000

TargetProcess: svchost.exe, InheritedFromPID = 652, ProcessID = 976, ThreadID = 2896, StartAddress = 05BD0000, Parameter = 05BC0000

TargetProcess: svchost.exe, InheritedFromPID = 652, ProcessID = 1060, ThreadID = 2904, StartAddress = 007D0000, Parameter = 007C0000

TargetProcess: svchost.exe, InheritedFromPID = 652, ProcessID = 1092, ThreadID = 2936, StartAddress = 01150000, Parameter = 01140000

TargetProcess: spoolsv.exe, InheritedFromPID = 652, ProcessID = 1180, ThreadID = 2964, StartAddress = 015C0000, Parameter = 015B0000

TargetProcess: jqs.exe, InheritedFromPID = 652, ProcessID = 1304, ThreadID = 2976, StartAddress = 013D0000, Parameter = 013C0000

TargetProcess: alg.exe, InheritedFromPID = 652, ProcessID = 1624, ThreadID = 3060, StartAddress = 00D80000, Parameter = 00CB0000

TargetProcess: explorer.exe, InheritedFromPID = 1932, ProcessID = 2000, ThreadID = 3068, StartAddress = 03400000, Parameter = 026B0000

TargetProcess: reader_sl.exe, InheritedFromPID = 2000, ProcessID = 220, ThreadID = 3088, StartAddress = 00AD0000, Parameter = 00AC0000

行为描述： 获取TickCount值  
详情信息：
TickCount = 223171, SleepMilliseconds = 5000.

行为描述： 设置启动项  
详情信息：
C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\htxueaht.exe

行为描述： 设置特殊文件属性  
详情信息：
C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\htxueaht.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe

C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe

行为描述： 在根目录创建自运行文件  
详情信息：
C:\DiskX\autorun.inf

行为描述： 设置特殊文件夹属性  
详情信息：
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5

C:\Documents and Settings\Administrator\Local Settings\History

C:\Documents and Settings\Administrator\Local Settings\History\History.IE5

C:\Documents and Settings\Administrator\Cookies

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache

C:\Documents and Settings\Administrator\IECompatCache




进程行为

•创建进程
•创建新文件进程
•跨进程写入数据
•创建远程线程
•枚举进程
•创建本地线程

更多>>



文件行为

•创建文件
•修改原系统的EXE文件
•创建可执行文件
•删除文件
•覆盖已有文件
•复制文件
•设置启动项
•内存映射方式修改可执行文件
•设置特殊文件属性
•查找文件
•在根目录创建自运行文件
•重命名文件
•设置特殊文件夹属性
•修改文件内容

更多>>



网络行为

•下载文件
•连接指定站点
•打开HTTP连接
•建立到一个指定的套接字连接
•读取网络文件
•发送HTTP包
•打开HTTP请求
•按名称获取主机地址

更多>>



注册表行为

•修改注册表
•删除注册表键值
•删除注册表键

更多>>



其他行为

•创建互斥体
•创建事件对象
•修改后的可执行文件MD5
•打开事件
•获取TickCount值
•调整进程token权限
•枚举窗口
•插入APC（异步过程调用）
•调用Sleep函数
•隐藏指定窗口
•可执行文件MD5
•打开互斥体
•查找指定窗口

aecho1

尊重原创者，更尊重搬运者，辛苦了

fjxmlh1

怎么破加速器

xxxx0xwq

小手一抖，牛币拿走。

cxl5201314

正需要，支持楼主，在真牛我只看好你！

a2208171662

正需要，支持楼主，在真牛我只看好你！