分析了几天的文件，还是解决不了，有空帮看看！

bfm13142

一个软件里面带的整个文件夹（其中一个文件夹）。
里面几个DAT以前是没加密的，打开的话大致内容是个网站，但现在加密了（不知道用的什么方法）
几个加密的DAT用文本打开后显示内容为：

DAT文件1：

77C693DA6EFFDAD975228C04AAB386D76DFC4CA280A482AF916AF30A280C2A1739D365FD4FE573C197AD81D463EA685A4E6C7D279236950F8D0665732D289B09A7C7EEBDF0C89FAABF186CEB7DCA64487B238F3D5F7E05DFE0CCC7E0B41F803D496523BDE7DFFEAEFEC711203D95527503AD118318ABE8DBFCC517B1386A00B3E1FE9C344A9EE9D2FDDED7F08837487A59687020B88FDA6E495F646D21942B436D5B7951404961684727B8E9FADAF1A91E805A3295E9D7B10AD0FEA33C88346F40605D29B8C9ECC41F666D74C54BDA2AFF5FEB7E9296758F98AFBA8EDB6FBF50E377BF4AD267F649EE461C360A253D14283BE579CA64CF60C194BD88AC85DD71D26FC192B28CA5BD67FF54E14316320D233C152D380E370F253D085EEA7BC999AF87DB6AFF56E276DF75D36DC49FB589D86AFA4B1E341D350353E273D160F54C192C1520045CF549E77ACB67CF63FD54E170D173CC74C161C76CCB6AFB2530162300240D240D230252FD52F147EE461D28095AFB49EE4DF65DC59D87A58CA68DB58DDA6BFE57E240E14D182D1421075EF44EF14DF74A1B340C2709253C0A5FF759E979C965CD63C292B094B28CAA87A88EB592B286AD87AD87AF82A3BD65CC76C362F253EC54EE51F353EC57E24010360F360D2A0929092B0B29391F075FF64FE2401632062D143F0A28381E3110200359FE50F047EE41E64EEA7BD978DF41E74FF648EB48E945EC78DF7CA78DAABB67CD75C36CD57CA58DA78CB59CAA89A88BAB8BA182D272CD74C066FC5BFB253C1B3A085FF74DE573D070D361C79DBB8BAA85ACB99EB29DBB9BAA8BDE471231173E143C1B381C381F0458FB58FF53F243E073D36DCA61C067CE65CD60C768CB6AC96AD569C967C869CE76D270D67DA5B99EB69DAB8BA68FA186DE471E075BC56ED56FD061C668CF61C69E86DC7BC96EC491B085A3BD97ABB88BABBB8EA48DA6BB97AE80D16CF948EC7AA5B29DB18FA0B48EA2BC94AF91A1B68CD968FC55E076DE70D76AFA4BE472D26CFA54FF53F240E371D064C089D099A0B584D064F17BD977C28B87DA6EFF55E474CD98A987DA62F341132136015FFD54EE471A2B380824350C59EC7CCA9FAAB3BA83F565

DAT文件2：

65F440095CEDDEB206AA10823086D76DFC481158B69CB89E83AD4E1FFF2602200D37D198AAB389DC75C293A6B2BBB844DD37C299ADB954AE43141EE83DC14BD561A17484D725F540D25DDA26F356DB2D0FEC30381E094AC850DC27F00058DC26E972B077B87BCD20363330391A1EEF060E5FC047D62FF17BCE9FAEBF8EDB6DFB491C2D0B26333AF4481D2C3D0C5AF64AE679C091A4BC95ADBE92AE84DE77CA9BA8B894A5B0B98CDD6FFE6916

文件3：

828F61B0441B2F3B085FF446182E390A5EE97ED06EC396ABBB8F6DB47382869366AA7C95A0B184DE68BE5DB584D062F74BE57ED062F74D1C283F1523390E5FEE7AC396A745CC4BDA59AC79879060EB3AD62F3EDC45E342EF50A8B148EF5ACC44A4B588D16EFB50E57BCE65F4441524350455E474C095A0A9BC8DD860F547162F3A0F2036075EEB441D35065AF64FE372CF61F649E771F84009503827EA3ACB59F643172C3B0853EF461122360157E8461B2E0353E7050C08191FEA3FCD59A8BD94A1BD8E966AAAB385D363F34CE67FCA99AF8DDC70C665F0400950182C3D0851AC74B040C450DA21EA3A0D17EA35041A381C3AE748A0A940E752C47C9CAD80C966F3481D3005531A232A333A034A135AEE7ACF9EABB287D662EB7DD460F549192031045CF54C1F3D13233F172A3B0858F44415243504741BE63ED72D0254E67CCB98A3BF97A0B381CA9EB289A4B18CDA6F839E67B64ED225E176C391A4B08D89DE68A844CC9DAF85D86FCD67F855E070C697AD86DD74C190D963F5420B5EEF021FE731C04FD96DB755DF6981A187AF92B255E4053DF322FA421F2E3A0F25300459EC451425340554E577C697ADB88DDC68F14716232A330257EE401D2C055CE847182339172F0353EE461D371524350455E494FB0110E137142630075CEB7FD362F5491F283C102F0257EA7BCF22FF0617EE3DCF4A1E2B390F5AEB7F868293DA6DFB54E87FD16CF849E57CCD63F14C1D2C390055E439D45DAC44C853E42CE8380119391F072A0AE26A80B675AD4E1F323B095CE87CC864F1400950192029303900491F2A3F0E5BE276C792DB6DC491A0B38EDF71C094A8BB8CA0BC8AA4B28FA6BD97B584D567F6463625E838C95FFC491D2A3E1324320750E272C59CAB80DD6BC69CAE74B347DF6BAA72BB82D675C89CB48EA3B186D76CFA56ED47125BE276C792DB5BD822F07ABB4DDC6C82A084A28FB14A13EB4BFF2A1BFD4FE26AC79DABB88ADF74C594A5B485D464F5471D283D0C59E074C590D963F3481A340950E173C19FB0BB91AF87DB6AC79EB58FADBC8DDC6CFD6E1DE030C157F4411522360B5CEA7EC964FD49182F0C21340959ED001DE42CFF4BD52BF5471C293C095EEB441C350D5CEA411F370851182034055019F50B0A0B1C2FF10F1158B69CB89E83AD4E1FFF2713073EDE6EC38AA7BD8BD875C094A5B485D464F54716273D085DEC78C194A5B0B980D675C964F9431223310F202B015FF74A18350C5BF54A135AE375C4B4DB21F000152A3C0E25330E59E97FC865FC4EE77FDC70C598AEB849DD36CF5DB47F88898DDB69FF54E073C44CDD2F3E172C0054EF4110273B0252E67BD46DFA420B5EEF4514E237C95BA67E869190DB25F40455B59DBB9B86AE4910EE54C673A2451429300D5BE979D563F17BC28BD29BA2ABB2BB89DC68F14716232A3F0E5FF754EE431E2F065FF54AE571CF6CFA57EF4DE472C29EAFBE8FDE6E1E4DD020F10724360057ED431422370052E377CE64FB51E478CE9884B266FB3EE70553D76CF94E1A2E014AEB3DCC9DAF84D162FE52E77FD469F9431C300353E068F14716232A160C3914270E1FEE7E9CBA9E84A98B6CFD1C3BEF5ACB2C3D1059EF45132137085DEB7DCC9DACBD8CDD6FFE55E074C590D96FFE4A135AEB79C867FB4DE470C091A1AA86DA6BC79FB283D063F9430A531A23553AC759A87CD366F046122F380E5BEC41105BEA78D775C09DB581AF66D369D95AAB44D154E074C094A0B3848C60A0A9B389DC73CD9BB180D161E87FD16FC390D963F5420B5EEF5CCA7ED342C252A276C142DF2029C160C46DD07395A445E257C37D9FAE83CA9EABB98FA5BE8BD963EA72FB4D1C2D3C0D5BEE7AC396A7B2BB8EDF69F84CE57AD464FD4BE57FD763F956EC41112C0552E279C089D099A0C8B745DC34C19EA8B281D775C69CA9B28CA5B68FA4BB96A3BE94A68C9E68AB70B286D361F64C1A2DF433C28BD968C49CB68FA3B682DD6FC19DAAB3BA8FDE6AF352A476B946C89392966EFF1E0420062B15F741D948C47D9FAE83CA61F44B192B3E0A531A232A333A034A13213401481D2C390055E474CD98AE80DC6CC590A0B481CA61FF56E879D46CFB54E870F9430A53056AB749D82C0357E373C19CAF87D264FE56E173C09FB287DA6BFF31C048EA3DEA4BDC340055E076CD64F738D55EEF78C89BB682DF73C39EB1B88EA3BE8BA1B2BB82CA9EAFBA83B242CB7686BD64B7491212EF3039D170D47DA08098A178AE6DA546172A33095CF047192C3801481158E16BF27AC391A4B1B88DDC68F14716273E0B5BF754E57FCA65F3410A263A085AE8441D2A3A1627360756E791FE0213E2361521350256EB7FD76DFE53E274CD65FA56E379C99D70869F838D9E80A88E996BF94F1A293E1427EE35CC9DABBB95A9BB91A0B789DF69FE5DF047125BE276C792DB36CC240E16E14CFC25F60E59D85FB68766CC6BCB71D33405E55CD041DB6DC089A7B28EDA75C094A5B485D464F54716273D085DEC78C194A5B0B980D167FF52EE7ED76DC79DA8B389A7BF93A3BE97AC84D860E973FA422A51

文件4：

68B54FA672C99DA9BE95A2B589D96DC692A5B389A6BB8EA3B387DD6BF94EE57ECA66F10917E26AF24DE67FD76BC692ACBB82D66BC193A9B98020A20589DE6EFB4D1821370256E270C094A9B248D42029C160C46DD07395A445ED4AE854FC1F2E3A0851E77DCB99AE86D26EFF491B380959F54AE57CD56AC56EC192AD96AE97A283D67DD46DC668FA55EE51ED471F065CE87CA5B094AF8DA6BF97A2B091A1B78FDA6BF9481C2A39095BEB78CE62F759EC4B1A350E223DE579CB9BAE84AD85D362F74E1A283C0A59E97AC89CAA87DC471B2B075BF44E1B3A0F350F5AF54EE076C999AABA95BF93A2B085DD471F340252E7491C3801481158E16BFE4EE57ECF71C396A79BB580C99CADBC95A0B085DE6EC792A2B682D56AC69CB68CA1B087D976C79DA8BF96A7B88BA6B78DD86FC592A2B68BDC35C955E474E48B

另外的文件拿文本打开都是乱码，记得以上4个文件之前拿文本开都是有个网页地址，我不是干什么坏事，这东西是付费正版的，还给我一直开网页，想研究一下他怎么搞的！
有这方面经验的可以教教我或提醒下从哪入手，再或者什么都不知道的话你看过我也感谢了！
QQ：415047383
415047383@qq.com
站内短信也支持！
谢谢！

飘云

咦，你这个附件下载不扣30是怎么设置的，另外，你附件报毒

飘云

关于这个分析，只能通过OD追下软件的主程序了，光看看不出是怎么加密的

bfm13142

回复 3# 飘云


    是万象的广告文件夹里面的文件，里面的东西没加任何一个字符进去，完全是没有修改过的，你的报毒是什么杀毒软件？我这里没装杀毒。。。

bfm13142

回复 2# 飘云


    我也是直接上传上去的，他要设置多少扣多少钱的我也没写0，直接X掉。
  刚才下个NOD下下来果然有个文件报毒，万象这小子。。。。