Logic.net

 

Logic.net protector yaptığı önemli kısımlardan ilk olanı string olduğu için string decoder hazırladım ama sabit string çözmesi amaçlı.
Daha sonrada sayısal değerleri karıştıran değerler için ufak bir junk temizleyici yaptım en son olarak <Module> sınıfına konulan basit CRC algoritmasına çıkan method çağırımı temizleyici ile cleaner'ı hazırlamış oldum.
Öncesi:

Sonrası:

Arayüz:

Kullanımı: "sadece sürükle bırak"

You must click 'Like' before you can see the hidden data contained here

Cleaner: https://s7.dosya.tc/server21/93m02w/LogicDotNetCleaner.rar.html
Şifre: revteam.re

Not:
Çalışmalarıma rağmen bug mevcut ama bu hali iş görmektedir.

Güncelleme 25.03.2022 21:44
Bende yok diye kendim yazmıştım iş görecek kadar meğersem şimdi fark ettim varmış 

GitHub - dinhle85/LoGiC.NET-Deobfuscator: Deobfuscator for LoGiC.NET Obfuscator.

Deobfuscator for LoGiC.NET Obfuscator. Contribute to dinhle85/LoGiC.NET-Deobfuscator development by creating an account on GitHub.

 github.com

Derli hali:

You must click 'Like' before you can see the hidden data contained here

Deobfuscator: https://s5.dosya.tc/server6/2mvsjt/LogicDeobfuscator.rar.html
Şifre: revteam.re                            

Unlimited

                    

Yano Obfuscator Cleaner

 

Merhaba arkadaşlar duyduğumdan beridir yano obfuscator'ı çok merak ediyordum geçenlerde bakma şansım oldu işi kolaylaştıracak bir cleaner aracı hazırladım 

Aracın amacı string çözüp anlamsız if(true) gibi ifadeleri temizleyip de4dot'a fazlası ile yardımcı olmasıdır.

Merak edenler için yano obfuscator : https://yano.informer.com/

Araç ve ders:

You must click 'Like' before you can see the hidden data contained here

Araç: https://s5.dosya.tc/server6/7gn409/YanoCleaner.rar.html
Ders: https://s5.dosya.tc/server6/tui0eq/YanoCleanerKullanimi.rar.html
Şifre: revteam.re

Hayırlı olsun 

Unlimited

ConfuserEx Entrypoint Fixer

 Merhaba arkadaşlar geçenlerde confuserex ile uğraşırken böyle bir araç lazım olmuştu bende yapayım dedim 

Aracın yaptığı STAThread attribute kullanan methodu tespit edip entrypoint olarak belirlemesidir aslında bu basit bir işlem ama bazen büyük uygulamalarda entrypoint bulmakta zorlanabiliyoruz.
Class, method .... vb arama yapmada yada isim uzun olunca dnspy bir hayli kasılıyor hali ile can sıkıcı bir hal alabiliyor.
Fakat bu araç sayesinde uğraşmadan otomatik şekilde entrypoint bulup değiştirme işlemini yapabileceğiz şimdiden herkese hayırlı ve uğurlu olsun 

Araç: https://www.dosya.tc/server36/xw6ij8/ConfuserExEpFixer.rar.html
Şifre: revteam.re

Unlimited

 

VMP Unpacking

November 02, 2020

​ Methodology used to achieve the File posted Here.

1. I have chosen the Target which comes with Anti-Debug Check. So Activating Anti-Debug or Virtualization while Protecting the Assembly generates its signature. They trigger the WinAPi function which can be seen easily like

[DllImport("kernel32", EntryPoint = "FlushViewOfFile", SetLastError = true)]

2. Anti-Tamper is not present in our Target.

3. Find .Invoke Method with (method, parameters). This can be found in Module.cctor. You need to go to IL and put breakpoint on first num or Invoke itself to clean the Mutations. (If You execute after this, You will see arguments or methods in local variable) only numbers which need to be cleaned.

4. Go to dnSpy Debugger Settings and Enable these (IsAttached, IsLogging, IsDebuggerPresent, CheckRemoteDebuggerPresent) So the Target can not detect Debugger. The Only NtQueryInformationProcess can not be bypassed by dnSpy.

5. CRC Checking of VMPotect (.NET) upto 3.5 as well is easy and not so hard. It use WinApi to CreateFile and map it So You can change the First Argument to our Hollow File named as same to target to bypass it.

* If our Target is packed, then nothing of this will work. So make Sure our Target is not Packed and by using all these, We can not actually de-virtualize VM of VMProtect. We can do rest of the stuff but VM will be still there. You can edit file in decompiler and patch or crack it.

Cleaning Mutations of VMProtect -->

• When You Open Target with dnSpy, You can find that there are many loops, these loops are generated by the VMProtect.
• We can see that the confusion is relatively single, the variable num can be called Context (Context), execute an instruction, the context will update itself once. The target chosen is with a switch statement to pack, because we need to know whether the context is the same when entering a different basic block and then moving to the same basic block. You can debug it directly to understand it better. Each case block in the sample corresponds to the different basic block just mentioned, and will eventually be transferred to the same basic block, which is the basic block starting with "Console.WriteLine("input completed")". So we breakpoint on this basic block.
• We input different numbers, let the switch statement jump to different case blocks, and see if the final execution reaches "Console.WriteLine("input completed")", the value of num is the same.
• Now We understand the macro structure of Mutation and we can proceed to the next analysis. We need to formulate the solution to clean up Mutation, so switch dnSpy decompilation mode back to IL and observe what the num update statement looks like. The entry point of this method is a br jump, so look directly at the basic block to which br jumps.
• Since this basic block is the entry point of the entire method, this basic block must also be the place where Mutation is initialized, and it will also be the entry point for our simulation using the simulator. 

The first arrow points

ldc.i4 1149763845 stloc.0

It is the initialization of the context num, and the following code will be used to update num later

ldc.i4 1099382934 ldloc.0 sub stloc.0

If there are constants in the code, the decryption of the constants is similar to this. 

ldloc 

Such code is directly replaced with

ldc.i4

This can be applied to all situations.

VMP.NET's mutation will encrypt constants and add obfuscated branch code, so we have to restore them all after the simulation ends. 

• So Now We have cleaned Mutations & Now need to Fix CRC.
• Open File in CFF Explorer and untick IL only in .NET Directory and use de4dot Original to clean the File.
• Fix any Broken method which do not actually use Mutations but you may have cleaned thinking of Mutations. Once It all Done, 
• Now fix Invoke and make sure to have original VMP protected file in the same folder.
• After this Crack or Patch the File and Save it. It will run.

* Keep in mind We haven't touched the VM of VMProtect. We just cleared rest of the stuff. 

Special Thanks to - https://forum.tuts4you.com/profile/97708-wwh1004/ for explaining in-depth details of VMP Mutations, Russian & Chinese Forums, Dark Bull & Other 

This whole process explained above is not my work originally. It is based on the work of other Users who shared their info in RCE community and made this possible. 

I hope soon there will be something out by which We can actually devirtualize the VMProtect completely. 

P.S. - If I forget to someone to mention, Kindly Let Me Know, I will edit My Comment.

P.P.S. - I am not a good Explainer may be Very Bad still I try to write. Pardon me for all this. 

m 1 - 

Resim 2 - 

awesome_cracked.exe

​

 

Rubik Küp

 

SlothBP Breakpoints by Mobile46

 [Text Recuperation]

GetDlgItemTextA="user32.GetDlgItemTextA"

GetWindowTextA="user32.GetWindowTextA"

SetDlgItemTextA="user32.SetDlgItemTextA"

SetWindowTextA="user32.SetWindowTextA"

GetPrivateProfileStringA="kernel32.GetPrivateProfileStringA"

WritePrivateProfileStringA="kernel32.WritePrivateProfileStringA"

GetPrivateProfileIntA="kernel32.GetPrivateProfileIntA"

WriteProfileStringA="kernel32.WriteProfileStringA"

GetDlgItemTextW="user32.GetDlgItemTextW"

GetWindowTextW="user32.GetWindowTextW"

SetDlgItemTextW="user32.SetDlgItemTextW"

SetWindowTextW="user32.SetWindowTextW"

GetPrivateProfileStringW="kernel32.GetPrivateProfileStringW"

WritePrivateProfileStringW="kernel32.WritePrivateProfileStringW"

GetPrivateProfileIntW="kernel32.GetPrivateProfileIntW"

WriteProfileStringW="kernel32.WriteProfileStringW"

GetDlgItem="user32.GetDlgItem"

[Message Boxes]

MessageBoxA="user32.MessageBoxA"

MessageBoxExA="user32.MessageBoxExA"

MessageBoxIndirectA="user32.MessageBoxIndirectA"

MessageBoxW="user32.MessageBoxW"

MessageBoxExW="user32.MessageBoxExW"

MessageBoxIndirectW="user32.MessageBoxIndirectW"

MessageBeep="user32.MessageBeep"

[Dialog Boxes]

DialogBoxParamA="user32.DialogBoxParamA"

CreateDialogParamA="user32.CreateDialogParamA"

CreateDialogIndirectParamA="user32.CreateDialogIndirectParamA"

CreateWindowExA="user32.CreateWindowExA"

DialogBoxParamW="user32.DialogBoxParamW"

CreateDialogParamW="user32.CreateDialogParamW"

CreateDialogIndirectParamW="user32.CreateDialogIndirectParamW"

CreateWindowExW="user32.CreateWindowExW"

DestroyWindow="user32.DestroyWindow"

EndDialog="user32.EndDialog"

EnableWindow="user32.EnableWindow"

EnableMenuItem="user32.EnableMenuItem"

[Files]

CreateFileA="kernel32.CreateFileA"

DeleteFileA="kernel32.DeleteFileA"

GetFileAttributesA="kernel32.GetFileAttributesA"

MoveFileA="kernel32.MoveFileA"

MoveFileExA="kernel32.MoveFileExA"

GetOpenFileNameA="comdlg32.GetOpenFileNameA"

GetSaveFileNameA="comdlg32.GetSaveFileNameA"

OpenFileMappingA="kernel32.OpenFileMappingA"

CreateFileMappingA="kernel32.CreateFileMappingA"

GetStartupInfoA="kernel32.GetStartupInfoA"

GetCommandLineA="kernel32.GetCommandLineA"

CreateFileW="kernel32.CreateFileW"

DeleteFileW="kernel32.DeleteFileW"

GetFileAttributesW="kernel32.GetFileAttributesW"

MoveFileW="kernel32.MoveFileW"

MoveFileExW="kernel32.MoveFileExW"

GetOpenFileNameW="comdlg32.GetOpenFileNameW"

GetSaveFileNameW="comdlg32.GetSaveFileNameW"

OpenFileMappingW="kernel32.OpenFileMappingW"

CreateFileMappingW="kernel32.CreateFileMappingW"

GetStartupInfoW="kernel32.GetStartupInfoW"

GetCommandLineW="kernel32.GetCommandLineW"

GetFileSize="kernel32.GetFileSize"

GetFileSizeEx="kernel32.GetFileSizeEx"

GetFileType="kernel32.GetFileType"

OpenFile="kernel32.OpenFile"

ReadFile="kernel32.ReadFile"

ReadFileEx="kernel32.ReadFileEx"

SetFilePointer="kernel32.SetFilePointer"

WriteFile="kernel32.WriteFile"

WriteFileEx="kernel32.WriteFileEx"

MapViewOfFile="kernel32.MapViewOfFile"

MapViewOfFileEx="kernel32.MapViewOfFileEx"

UnmapViewOfFile="kernel32.UnmapViewOfFile"

CloseHandle="kernel32.CloseHandle"

ZwCreateFile="ntdll.ZwCreateFile"

ZwQueryInformationFile="ntdll.ZwQueryInformationFile"

ZwReadFile="ntdll.ZwReadFile"

_lclose="kernel32._lclose"

_lcreat="kernel32._lcreat"

_llseek="kernel32._llseek"

_lopen="kernel32._lopen"

_lread="kernel32._lread"

_lwrite="kernel32._lwrite"

[Modules and Libraries]

LoadLibraryA="kernel32.LoadLibraryA"

GetModuleHandleA="kernel32.GetModuleHandleA"

LoadLibraryW="kernel32.LoadLibraryW"

GetModuleHandleW="kernel32.GetModuleHandleW"

FreeLibrary="kernel32.FreeLibrary"

GetProcAddress="kernel32.GetProcAddress"

LdrLoadDll="ntdll.LdrLoadDll"

[Memory Management]

GlobalAlloc="kernel32.GlobalAlloc"

GlobalFree="kernel32.GlobalFree"

HeapCreate="kernel32.HeapCreate"

RtlAllocateHeap="ntdll.RtlAllocateHeap"

RtlDecompressBuffer="ntdll.RtlDecompressBuffer"

VirtualAlloc="kernel32.VirtualAlloc"

VirtualAllocEx="kernel32.VirtualAllocEx"

VirtualFree="kernel32.VirtualFree"

VirtualProtect="kernel32.VirtualProtect"

VirtualProtectEx="kernel32.VirtualProtectEx"

VirtualQuery="kernel32.VirtualQuery"

VirtualQueryEx="kernel32.VirtualQueryEx"

ZwAllocateVirtualMemory="ntdll.ZwAllocateVirtualMemory"

ZwFreeVirtualMemory="ntdll.ZwFreeVirtualMemory"

ZwProtectVirtualMemory="ntdll.ZwProtectVirtualMemory"

ZwQueryVirtualMemory="ntdll.ZwQueryVirtualMemory"

[Registry]

RegCreateKeyA="advapi32.RegCreateKeyA"

RegCreateKeyExA="kernel32.RegCreateKeyExA"

RegDeleteKeyA="advapi32.RegDeleteKeyA"

RegDeleteValueA="kernel32.RegDeleteValueA"

RegOpenKeyA="advapi32.RegOpenKeyA"

RegOpenKeyExA="kernel32.RegOpenKeyExA"

RegQueryInfoKeyA="kernel32.RegQueryInfoKeyA"

RegQueryValueA="advapi32.RegQueryValueA"

RegQueryValueExA="kernel32.RegQueryValueExA"

RegSaveKeyA="advapi32.RegSaveKeyA"

RegSaveKeyExA="kernel32.RegSaveKeyExA"

RegSetValueA="advapi32.RegSetValueA"

RegSetValueExA="kernel32.RegSetValueExA"

RegCreateKeyW="advapi32.RegCreateKeyW"

RegCreateKeyExW="kernel32.RegCreateKeyExW"

RegDeleteKeyW="advapi32.RegDeleteKeyW"

RegDeleteValueW="kernel32.RegDeleteValueW"

RegOpenKeyW="advapi32.RegOpenKeyW"

RegOpenKeyExW="kernel32.RegOpenKeyExW"

RegQueryInfoKeyW="kernel32.RegQueryInfoKeyW"

RegQueryValueW="advapi32.RegQueryValueW"

RegQueryValueExW="kernel32.RegQueryValueExW"

RegSaveKeyW="advapi32.RegSaveKeyW"

RegSaveKeyExW="kernel32.RegSaveKeyExW"

RegSetValueW="advapi32.RegSetValueW"

RegSetValueExW="kernel32.RegSetValueExW"

RegCloseKey="kernel32.RegCloseKey"

ZwClose="ntdll.ZwClose"

ZwCreateKey="ntdll.ZwCreateKey"

ZwDeleteKey="ntdll.ZwDeleteKey"

ZwOpenKey="ntdll.ZwOpenKey"

ZwQueryKey="ntdll.ZwQueryKey"

ZwQueryValueKey="ntdll.ZwQueryValueKey"

ZwSaveMergedKeys="ntdll.ZwSaveMergedKeys"

[Directories and Paths]

CreateDirectoryA="kernel32.CreateDirectoryA"

CreateDirectoryExA="kernel32.CreateDirectoryExA"

GetCurrentDirectoryA="kernel32.GetCurrentDirectoryA"

GetFullPathNameA="kernel32.GetFullPathNameA"

GetShortPathNameA="kernel32.GetShortPathNameA"

GetTempFileNameA="kernel32.GetTempFileNameA"

GetTempPathA="kernel32.GetTempPathA"

RemoveDirectoryA="kernel32.RemoveDirectoryA"

SearchPathA="kernel32.SearchPathA"

SetCurrentDirectoryA="kernel32.SetCurrentDirectoryA"

GetSystemWindowsDirectoryA="kernel32.GetSystemWindowsDirectoryA"

GetSystemDirectoryA="kernel32.GetSystemDirectoryA"

CreateDirectoryW="kernel32.CreateDirectoryW"

CreateDirectoryExW="kernel32.CreateDirectoryExW"

GetCurrentDirectoryW="kernel32.GetCurrentDirectoryW"

GetFullPathNameW="kernel32.GetFullPathNameW"

GetShortPathNameW="kernel32.GetShortPathNameW"

GetTempFileNameW="kernel32.GetTempFileNameW"

GetTempPathW="kernel32.GetTempPathW"

RemoveDirectoryW="kernel32.RemoveDirectoryW"

SearchPathW="kernel32.SearchPathW"

SetCurrentDirectoryW="kernel32.SetCurrentDirectoryW"

GetSystemWindowsDirectoryW="kernel32.GetSystemWindowsDirectoryW"

GetSystemDirectoryW="kernel32.GetSystemDirectoryW"

[Drives]

GetDiskFreeSpaceA="kernel32.GetDiskFreeSpaceA"

GetDiskFreeSpaceExA="kernel32.GetDiskFreeSpaceExA"

GetDriveTypeA="kernel32.GetDriveTypeA"

GetLogicalDriveStringsA="kernel32.GetLogicalDriveStringsA"

GetVolumeInformationA="kernel32.GetVolumeInformationA"

SetVolumeLabelA="kernel32.SetVolumeLabelA"

GetDiskFreeSpaceW="kernel32.GetDiskFreeSpaceW"

GetDiskFreeSpaceExW="kernel32.GetDiskFreeSpaceExW"

GetDriveTypeW="kernel32.GetDriveTypeW"

GetLogicalDriveStringsW="kernel32.GetLogicalDriveStringsW"

GetVolumeInformationW="kernel32.GetVolumeInformationW"

SetVolumeLabelW="kernel32.SetVolumeLabelW"

GetLogicalDrives="kernel32.GetLogicalDrives"

[Time]

GetTimeFormatA="kernel32.GetTimeFormatA"

GetTimeFormatW="kernel32.GetTimeFormatW"

GetFileTime="kernel32.GetFileTime"

SetFileTime="kernel32.SetFileTime"

GetLocalTime="kernel32.GetLocalTime"

GetSystemTime="kernel32.GetSystemTime"

GetSystemTimeAsFileTime="kernel32.GetSystemTimeAsFileTime"

GetTimeZoneInformation="kernel32.GetTimeZoneInformation"

LocalFileTimeToFileTime="kernel32.LocalFileTimeToFileTime"

CompareFileTime="kernel32.CompareFileTime"

SetLocalTime="kernel32.SetLocalTime"

SetSystemTime="kernel32.SetSystemTime"

SystemTimeToFileTime="kernel32.SystemTimeToFileTime"

[Miscellaneous]

DrawTextA="user32.DrawTextA"

DrawTextExA="user32.DrawTextExA"

ExtTextOutA="gdi32.ExtTextOutA"

DrawTextExA="user32.DrawTextExA"

TextOutA="gdi32.TextOutA"

DrawTextW="user32.DrawTextW"

DrawTextExW="user32.DrawTextExW"

ExtTextOutW="gdi32.ExtTextOutW"

DrawTextExW="user32.DrawTextExW"

TextOutW="gdi32.TextOutW"

BitBlt="gdi32.BitBlt"

MaskBlt="gdi32.MaskBlt"

PatBlt="gdi32.PatBlt"

[VB APIs]

ThunRTMain="msvbvm60.ThunRTMain"

rtcMsgBox="msvbvm60.rtcMsgBox"

__vbaVarAdd="msvbvm60.__vbaVarAdd"

__vbaVarSub="msvbvm60.__vbaVarSub"

__vbaVarMul="msvbvm60.__vbaVarMul"

__vbaVarIdiv="msvbvm60.__vbaVarIdiv"

__vbaVarXor="msvbvm60.__vbaVarXor"

__vbaVarAnd="msvbvm60.__vbaVarAnd"

__vbaVarNot="msvbvm60.__vbaVarNot"

__vbaVarNeg="msvbvm60.__vbaVarNeg"

__vbaVarPow="msvbvm60.__vbaVarPow"

__vbaVarOr="msvbvm60.__vbaVarOr"

__vbaStrCmp="msvbvm60.__vbaStrCmp"

__vbaStrComp="msvbvm60.__vbaStrComp"

__vbaVarTstEq="msvbvm60.__vbaVarTstEq"

__vbaVarTextTstEq="msvbvm60.__vbaVarTextTstEq"

__vbaVarTextTstNe="msvbvm60.__vbaVarTextTstNe"

__vbaStrTextCmp="msvbvm60.__vbaStrTextCmp"

__vbaVarTstEq="msvbvm60.__vbaVarTstEq"

__vbaVarTstNe="msvbvm60.__vbaVarTstNe"

__vbaVarCmpEq="msvbvm60.__vbaVarCmpEq"

__vbaVarCmpNe="msvbvm60.__vbaVarCmpNe"

__vbaVarTextCmpEq="msvbvm60.__vbaVarTextCmpEq"

__vbaVarTextCmpNe="msvbvm60.__vbaVarTextCmpNe"

__vbaFpCmpCy="msvbvm60.__vbaFpCmpCy"

__vbaStrCopy="msvbvm60.__vbaStrCopy"

__vbaVarCopy="msvbvm60.__vbaVarCopy"

__vbaVarMove="msvbvm60.__vbaVarMove"

__vbaI2Str="msvbvm60.__vbaI2Str"

__vbaFPInt="msvbvm60.__vbaFPInt"

__vbaFpR8="msvbvm60.__vbaFpR8"

__vbaFpR4="msvbvm60.__vbaFpR4"

rtcHexBstrFromVar="msvbvm60.rtcHexBstrFromVar"

rtcHexVarFromVar="msvbvm60.rtcHexVarFromVar"

rtcGetTimeBstr="msvbvm60.rtcGetTimeBstr"

rtcGetTimeValue="msvbvm60.rtcGetTimeValue"

rtcGetTimeVar="msvbvm60.rtcGetTimeVar"

rtcGetTimer="msvbvm60.rtcGetTimer"

rtcGetYear="msvbvm60.rtcGetYear"

rtcGetPresentDate="msvbvm60.rtcGetPresentDate"

rtcGetMonthOfYear="msvbvm60.rtcGetMonthOfYear"

rtcGetMinuteOfHour="msvbvm60.rtcGetMinuteOfHour"

rtcGetSecondOfMinute="msvbvm60.rtcGetSecondOfMinute"

[Windows]

SendDlgItemMessageA="user32.SendDlgItemMessageA"

SendMessageA="user32.SendMessageA"

CreateWindowExA="user32.CreateWindowExA"

FindWindowA="user32.FindWindowA"

FindWindowExA="user32.FindWindowExA"

SendDlgItemMessageW="user32.SendDlgItemMessageW"

SendMessageW="user32.SendMessageW"

CreateWindowExW="user32.CreateWindowExW"

FindWindowW="user32.FindWindowW"

FindWindowExW="user32.FindWindowExW"

NtUserShowWindow="win32u.NtUserShowWindow"

[Process + Thread]

GetModuleHandleA="kernel32.GetModuleHandleA"

CreateProcessA="kernel32.CreateProcessA"

GetModuleHandleW="kernel32.GetModuleHandleW"

CreateProcessW="kernel32.CreateProcessW"

OpenProcess="kernel32.OpenProcess"

CreateThread="kernel32.CreateThread"

SuspendThread="kernel32.SuspendThread"

ExitProcess="kernel32.ExitProcess"

TerminateProcess="kernel32.TerminateProcess"

ReadProcessMemory="kernel32.ReadProcessMemory"

WriteProcessMemory="kernel32.WriteProcessMemory"

ShellExecute="shell32.ShellExecute"

ShellExecuteEx="shell32.ShellExecuteEx"

NtCreateProcess="ntdll.NtCreateProcess"

GetTickCount="kernel32.GetTickCount"

GetCurrentProcess="kernel32.GetCurrentProcess"

GetCurrentProcessId="kernel32.GetCurrentProcessId"

GetFileSize="kernel32.GetFileSize"

[Code Injection]

SetWindowsHookExA="user32.SetWindowsHookExA"

SetWindowsHookExW="user32.SetWindowsHookExW"

CreateRemoteThread="kernel32.CreateRemoteThread"

QueueUserAPC="kernel32.QueueUserAPC"

[Networking]

UrlDownloadToFileA="urlmon.UrlDownloadToFileA"

InternetOpenA="wininet.InternetOpenA"

InternetConnectA="wininet.InternetConnectA"

HttpOpenRequestA="wininet.HttpOpenRequestA"

HttpSendRequestA="wininet.HttpSendRequestA"

UrlDownloadToFileW="urlmon.UrlDownloadToFileW"

InternetOpenW="wininet.InternetOpenW"

InternetConnectW="wininet.InternetConnectW"

HttpOpenRequestW="wininet.HttpOpenRequestW"

HttpSendRequestW="wininet.HttpSendRequestW"

InternetGetConnectedState="wininet.InternetGetConnectedState"

WinHttpOpen="winhttp.WinHttpOpen"

WinHttpConnect="winhttp.WinHttpConnect"

WinHttpSendRequest="winhttp.WinHttpSendRequest"

[Crypt]

CryptGenKey="advapi32.CryptGenKey"

CryptDecrypt="advapi32.CryptDecrypt"

CryptAcquireContext="advapi32.CryptAcquireContext"

[Resource]

LoadResource="kernel32.LoadResource"

FindResource="kernel32.FindResource"

[Malware Analysis]

SetWindowsHookA="user32.SetWindowsHookA"

SetWindowLongA="user32.SetWindowLongA"

CreateProcessInternalA="kernel32.CreateProcessInternalA"

ShellExecuteA="shell32.ShellExecuteA"

OpenServiceA="advapi32.OpenServiceA"

SetWindowsHookW="user32.SetWindowsHookW"

SetWindowLongW="user32.SetWindowLongW"

CreateProcessInternalW="kernel32.CreateProcessInternalW"

ShellExecuteW="shell32.ShellExecuteW"

OpenServiceW="advapi32.OpenServiceW"

CreateToolhelp32Snapshot="kernel32.CreateToolhelp32Snapshot"

WinExec="kernel32.WinExec"

GetAsyncKeyState="user32.GetAsyncKeyState"

GetKeyState="user32.GetKeyState"

Hata Mesajına gitmek için kullanılan kısa kelimeler CRTL+ G sonrasında Breakpoint

breakpoint sonra CTRL +F9