Got one today and I did an image search to contact the Devs, if you get one of these scams try to mess with them as much as possible to waste their time.
Just be careful, the initial payload, the setup is what steals your cookies, discord token, a screenshot of your screen, wallets (I assume crypto wallets by the file name), and apparently it... might try to download your desktop, documents, etc when looking at the files it creates/created then it also has a nodejs app which acts as a persistent rat, it is in your appdata temp, has the nodejs icon, it is run via the open vbs script and that is opened/called by a vbs script in your startup folder, so while it is easy to disable once you figure it out, it is not something you want to risk getting infected with either