Newer branch stage-2 stager (st.php.malw); fetched from 198.245.53.26/st.php and executed via PowerShell with TLS 1.2 enforcement