Like I said, file-less doesn't mean it uses any magic, it will still run tr.exe and powershell.exe, and they will both trigger suspicious behavior. So only AV's with bad behavior blockers might have a hard time stopping it.
