Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,%APPDATA%\Origin\Origin.exe,'
- %APPDATA%\origin\origin.exe
- '%APPDATA%\origin\origin.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' [bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%APPDATA%\Origin'