Thunder, express, and Tornado download address encryption and decryption Analysis

1. Normal address to thunder address
Add "AA" to the original address and "ZZ" to the end (Note: quotation marks are not included). The address is changed
AAhttp: // p2s.newhua.com/down/wrar371sc.exeZZ
This address is base64 encoded
QUFodHRwOi8vcDJzLm5ld2h1YS5jb20vZG93bi93cmFyMzcxc2MuZXhlWlo =
Add thunder before the URL: //, that is
Thunder: // QUFodHRwOi8vcDJzLm5ld2h1YS5jb20vZG93bi93cmFyMzcxc2MuZXhlWlo =
2. Normal address to express address
Add "[FLASHGET]" before and after the original address (Note: No quotation marks are included), and the address is changed
[FLASHGET] http://p2s.newhua.com/down/wrar371sc.exe?flashget]
This address is base64 encoded
Bytes
Flash get: // is added before the express link. Note that "& Symbol" is added to the link. It is not clear how the symbol is obtained, I added my personal information to the end. No conversion error has been reported so far, that is
Flashget: // example & yinbing1986
3. convert a normal address to a tornado address
Tornado is much simpler. encode the original address with base64
AHR0cDovL3Aycy5uZXdodWEuY29tL2Rvd24vd3JhcjM3MXNjLmV4ZQ =
Add qqdl before the URL: //, that is
Qqdl: // aHR0cDovL3Aycy5uZXdodWEuY29tL2Rvd24vd3JhcjM3MXNjLmV4ZQ