Check the url.
/powershell-suspicious-payload-encoded-and-compressed.html