nice nice good job.
You can decompile it with .Net reflector, and you can find the function there, it sends _ONLY_ the captcha to their server, of course it has the captcha code before the connection to their server, otherwise it couldn't send it to their server to decrypt, shush...Quote:
Hi gentelmen,
I do no about U, but for mee this is pure trojan.
Yes it resolves capcha thing, but:::
IT IS ALWAYS connect to something with IP: 85.144.129.230
I digg a little in to this prog, just to find out it is parcing the memory to pull out the captcha BEFORE connecting to the server above.
Unfortunatelly I can't tell what else beyond captcha this tool is pulling out of the memory,possibly your Login info!
One thing for sure, it has the capcha code before the connection.
At the moment I am installing WireShark, just to see, what this thing is sending home...
Enjoy
I gave him thanks cos hes installing WireShark to check this out.Quote:
Singa gave him thanks? for what?
to dude12345:
first of all install wireshark and then say something. it is connecting to send the picture.
and thise "maybe"..."possibly". what do you thinking about?
it patches the picture and markes it as "read" for sure it will not be the same picture twice.