3.0

2026-06-06 16:54:33 +00:00 · 2023-11-29 12:03:53 -05:00
parent f493c1981f
commit d0ebfe37e6
8 changed files with 500 additions and 366 deletions
@@ -67,7 +67,7 @@ type Beacon_SSL struct {
 var num_Profile int
 var Post bool

-func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, customuriGET, customuriPOST, beacon_PE, processinject_min_alloc, Post_EX_Process_Name, metadata, injector, Host, Profile, ProfilePath, outFile, custom_cert, cert_password, CDN, CDN_Value, datajitter, Keylogger string, Forwarder bool, tasks_max_size string, tasks_proxy_max_size string, tasks_dns_proxy_max_size string) {
+func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, customuriGET, customuriPOST, beacon_PE, processinject_min_alloc, Post_EX_Process_Name, metadata, injector, Host, Profile, ProfilePath, outFile, custom_cert, cert_password, CDN, CDN_Value, datajitter, Keylogger string, Forwarder bool, tasks_max_size string, tasks_proxy_max_size string, tasks_dns_proxy_max_size string, syscall_method string, httplib string, ThreadSpoof bool) {
 	Beacon_Com := &Beacon_Com{}
 	Beacon_Stage_p1 := &Beacon_Stage_p1{}
 	Beacon_Stage_p2 := &Beacon_Stage_p2{}
@@ -80,10 +80,10 @@ func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, custom
 	var HostStageMessage string

 	fmt.Println("[*] Preparing Varibles...")
-	HostStageMessage, Beacon_Com.Variables = GenerateComunication(stage, sleeptime, jitter, useragent, datajitter, tasks_max_size, tasks_proxy_max_size, tasks_dns_proxy_max_size)
-	Beacon_PostEX.Variables = GeneratePostProcessName(Post_EX_Process_Name, Keylogger)
+	HostStageMessage, Beacon_Com.Variables = GenerateComunication(stage, sleeptime, jitter, useragent, datajitter, tasks_max_size, tasks_proxy_max_size, tasks_dns_proxy_max_size, httplib)
+	Beacon_PostEX.Variables = GeneratePostProcessName(Post_EX_Process_Name, Keylogger, ThreadSpoof)
 	Beacon_GETPOST.Variables = GenerateHTTPVaribles(Host, metadata, uri, customuri, customuriGET, customuriPOST, CDN, CDN_Value, Profile, Forwarder)
-	Beacon_Stage_p2.Variables = GeneratePE(beacon_PE)
+	Beacon_Stage_p1.Variables, Beacon_Stage_p2.Variables = GeneratePE(beacon_PE, syscall_method)
 	Process_Inject.Variables = GenerateProcessInject(processinject_min_alloc, injector)
 	Beacon_GETPOST_Profile.Variables, Beacon_SSL.Variables = GenerateProfile(Profile, CDN, CDN_Value, cert_password, custom_cert, ProfilePath, Host)
 	fmt.Println("[*] Building Profile...")
@@ -96,13 +96,21 @@ func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, custom
 	PEX_Name := PEX[1]
 	fmt.Println("[*] Post-Ex Process Name: " + PEX_Name[:(len(PEX_Name)-3)])
 	fmt.Println("[!] Beacon Shellcode Will Obfuscate Beacon in Memory Prior to Sleeping")
+	if ThreadSpoof == true {
+		fmt.Println("[!] ThreadSpooffing in enabled")
+	}
+	if syscall_method == "none" {
+		fmt.Println("[!] No Syscall method selected")
+	} else {
+		fmt.Println("[!] " + syscall_method + " syscall method selected")
+	}
 	Name, _ := strconv.Atoi(Profile)
 	fmt.Println("[*] Seleted Profile: " + Struct.Profile_Names[Name])
 	fmt.Println("[+] Profile Generated: " + outFile)
 	fmt.Println("[+] Happy Hacking")
 }

-func GenerateComunication(stage, sleeptime, jitter, useragent, datajitter string, tasks_max_size string, tasks_proxy_max_size string, tasks_dns_proxy_max_size string) (string, map[string]string) {
+func GenerateComunication(stage, sleeptime, jitter, useragent, datajitter string, tasks_max_size string, tasks_proxy_max_size string, tasks_dns_proxy_max_size string, httplib string) (string, map[string]string) {
 	Beacon_Com := &Beacon_Com{}
 	Beacon_Com.Variables = make(map[string]string)
 	var HostStageMessage string
@@ -193,10 +201,16 @@ func GenerateComunication(stage, sleeptime, jitter, useragent, datajitter string

 	}

+	if httplib != "" {
+		Beacon_Com.Variables["httplib"] = httplib
+	} else {
+		Beacon_Com.Variables["httplib"] = "wininet"
+	}
+
 	return HostStageMessage, Beacon_Com.Variables
 }

-func GeneratePostProcessName(Post_EX_Process_Name, Keylogger string) map[string]string {
+func GeneratePostProcessName(Post_EX_Process_Name, Keylogger string, ThreadSpoof bool) map[string]string {
 	Beacon_PostEX := &Beacon_PostEX{}
 	Beacon_PostEX.Variables = make(map[string]string)
 	if Post_EX_Process_Name != "" {
@@ -214,6 +228,13 @@ func GeneratePostProcessName(Post_EX_Process_Name, Keylogger string) map[string]
 	} else {
 	}

+	if ThreadSpoof == true {
+		threadhint_num, _ := strconv.Atoi(Utils.GenerateNumer(0, 8))
+		Beacon_PostEX.Variables["thread_hint"] = "set thread_hint \"" + Struct.Thread_list[(threadhint_num)] + Utils.GenHex() + "\";"
+	} else {
+		Beacon_PostEX.Variables["thread_hint"] = ""
+	}
+
 	return Beacon_PostEX.Variables
 }

@@ -290,6 +311,7 @@ func GenerateHTTPVaribles(Host, metadata, uri, customuri, customuriGET, customur
 	Beacon_GETPOST.Variables["UValue"] = Utils.GenerateValue(6, 15)
 	Beacon_GETPOST.Variables["CSMValue"] = Utils.GenerateValue(6, 15)

+	//needs to be put stacic
 	if Forwarder == true {
 		Beacon_GETPOST.Variables["forward"] = "true"
 	} else {
@@ -299,9 +321,34 @@ func GenerateHTTPVaribles(Host, metadata, uri, customuri, customuriGET, customur
 	return Beacon_GETPOST.Variables
 }

-func GeneratePE(beacon_PE string) map[string]string {
+func GeneratePE(beacon_PE string, syscall_method string) (map[string]string, map[string]string) {
+	Beacon_Stage_p1 := &Beacon_Stage_p1{}
+	Beacon_Stage_p1.Variables = make(map[string]string)
+
 	Beacon_Stage_p2 := &Beacon_Stage_p2{}
 	Beacon_Stage_p2.Variables = make(map[string]string)
+
+	if syscall_method == "" {
+		syscall_method_Num, _ := strconv.Atoi(Utils.GenerateNumer(0, 2))
+		Beacon_Stage_p1.Variables["syscall_method"] = Struct.Syscall_Method[(syscall_method_Num)]
+	}
+
+	if syscall_method != "" {
+		if syscall_method == "none" {
+			Beacon_Stage_p1.Variables["syscall_method"] = "None"
+		} else if syscall_method == "direct" {
+			Beacon_Stage_p1.Variables["syscall_method"] = "Direct"
+		} else if syscall_method == "indirect" {
+			Beacon_Stage_p1.Variables["syscall_method"] = "Indirect"
+		} else {
+			log.Fatal("Error: Please provide a valid Syscall Method")
+		}
+	}
+
+	gen_number, _ := strconv.Atoi(Utils.GenerateNumer(0, 6))
+	Beacon_Stage_p1.Variables["magic_mz_x64"] = Struct.Magic_PE[gen_number]
+	Beacon_Stage_p1.Variables["magic_pe"] = strings.ToUpper(Utils.GenerateSingleValue(2))
+
 	if beacon_PE == "" {
 		PE_Num, _ := strconv.Atoi(Utils.GenerateNumer(0, 30))
 		Beacon_Stage_p2.Variables["pe"] = Struct.Peclone_list[PE_Num]
@@ -313,7 +360,7 @@ func GeneratePE(beacon_PE string) map[string]string {
 		}
 		Beacon_Stage_p2.Variables["pe"] = Struct.Peclone_list[(PE_Num - 1)]
 	}
-	return Beacon_Stage_p2.Variables
+	return Beacon_Stage_p1.Variables, Beacon_Stage_p2.Variables
 }

 func GenerateProcessInject(processinject_min_alloc, injector string) map[string]string {
@@ -340,6 +387,7 @@ func GenerateProcessInject(processinject_min_alloc, injector string) map[string]
 	} else {
 		log.Fatal("Error: Please provide a valid Process Injector option")
 	}
+
 	return Process_Inject.Variables
 }

@@ -417,7 +465,6 @@ func GenerateProfile(Profile, CDN, CDN_Value, cert_password, custom_cert, Profil

 func Build(custom_cert, cert_password, outFile string, Beacon_Com *Beacon_Com, Beacon_Stage_p1 *Beacon_Stage_p1, Beacon_Stage_p2 *Beacon_Stage_p2, Beacon_Stage_p3 *Beacon_Stage_p3, Process_Inject *Process_Inject, Beacon_PostEX *Beacon_PostEX, Beacon_GETPOST *Beacon_GETPOST, Beacon_GETPOST_Profile *Beacon_GETPOST_Profile, Beacon_SSL *Beacon_SSL) {
 	var buffer bytes.Buffer
-
 	Beacon_Com_Struct_Template, err := template.New("Beacon_Com").Parse(Struct.Beacon_Com_Struct())
 	if err != nil {
 		log.Fatal(err)
@@ -6,7 +6,7 @@ SourcePoint is a polymorphic C2 profile generator for Cobalt Strike C2s, written


 <p align="center"> <img src=Screenshots/C2int_p1.png width="900" height="710" border="2px solid #555">
-<p align="center"> <img src=Screenshots/C2int_p2.png width="900" height="480" border="2px solid #555">
+<p align="center"> <img src=Screenshots/C2int_p2.png border="2px solid #555">

 ```
 go install github.com/Tylous/SourcePoint
@@ -40,17 +40,21 @@ Usage of ./SourcePoint:
  -CDN-Value string
        CDN cookie value (typically used for AzureEdge profiles)
  -Customuri string
-        The base URI for custom HTTP GET/POST profile (default "0") - Cannot be used with CustomuriGET or CustomuriPOST
+        The base URI for custom HTTP GET/POST profile - Cannot be used with CustomuriGET or CustomuriPOST
  -CustomuriGET string
-        The base URI for custom HTTP GET profile (default "0") - Must be used with CustomuriPOST
+        The base URI for custom HTTP GET profile - Must be used with CustomuriPOST
  -CustomuriPOST string
-        The base URI for custom HTTP POST profile (default "0") - Must be used with CustomuriGET
+        The base URI for custom HTTP POST profile - Must be used with CustomuriGET
  -Datajitter string
        Appends a value to HTTP-Get and HTTP-Post server output (default "50")
  -Forwarder
        Enabled the X-forwarded-For header (Good for when your C2 is behind a redirector)
  -Host string
        Team server domain name
+  -Httplib string
+        Select the default HTTP Beacon library:
+        [*] wininet
+        [*] winhttp' (default "winhttp")
  -Injector string
        Select the preferred method to allocate memory in the remote process:
        [*] VirtualAllocEx (Great for cross architecture i.e x86 -> x64 and x64->x86)
@@ -73,36 +77,36 @@ Usage of ./SourcePoint:
        Name of output file
  -PE_Clone string
        PE file beacon will mimic (Use the number):
-        [1] srv.dll
-        [2] ActivationManager.dll
-        [3] audioeng.dll
-        [4] AzureSettingSyncProvider.dll
-        [5] BingMaps.dll
-        [6] BootMenuUX.dll
-        [7] DIAGCPL.dll
+        [1] ActivationManager.dll
+        [2] audioeng.dll
+        [3] AzureSettingSyncProvider.dll
+        [4] BingMaps.dll
+        [5] DIAGCPL.dll
+        [6] EDGEHTML.dll
+        [7] FILEMGMT.dll
        [8] FIREWALLCONTROLPANEL.dll
-        [9] WMNetMgr.dll
-        [10] wwanapi.dll
-        [11] Windows.Storage.Search.dll
-        [12] Windows.System.Diagnostics.dll
-        [13] Windows.System.Launcher.dll
-        [14] Windows.System.SystemManagement.dll
-        [15] Windows.UI.BioFeedback.dll
-        [16] Windows.UI.BlockedShutdown.dll
-        [17] Windows.UI.Core.TextInput.dll
-        [18] FILEMGMT.dll
-        [19] polprocl.dll
-        [20] GPSVC.dll
-        [21] libcrypto.dll
-        [22] rdpcomapi.dll
-        [23] winsqlite3.dll
-        [24] wow64.dll
+        [9] GPSVC.dll
+        [10] gpupvdev.dll
+        [11] libcrypto.dll
+        [12] srvcli.dll
+        [13] srvsvc.dll
+        [14] Windows.Storage.Search.dll
+        [15] Windows.System.Diagnostics.dll
+        [16] Windows.System.Launcher.dll
+        [17] Windows.System.SystemManagement.dll
+        [18] Windows.UI.BioFeedback.dll
+        [19] Windows.UI.BlockedShutdown.dll
+        [20] Windows.UI.Core.TextInput.DLL
+        [21] winsqlite3.dll
+        [22] WMNetMgr.DLL
+        [23] wwanapi.dll
+        [24] WWANSVC.DLL
        [25] wow64win.dll
-        [26] WWANSVC.dll
-        [27] CyMemDef64.dll (Cylance's DLL)
+        [26] wow64.dll
+        [27] ctiuser.dll (Carbon Black's DLL)
        [28] InProcessClient.dll (SentinelOne's DLL)
-        [29] ctiuser.dll (Carbon Black's DLL)
-        [30] umppc.dll (CrowdStrike's DLL)
+        [29] umppc.dll (CrowdStrike's DLL)
+        [30] CyMemDef64.dll (Cylance's DLL)
  -Password string
        SSL certificate password
  -PostEX_Name string
@@ -140,7 +144,20 @@ Usage of ./SourcePoint:
  -Sleep string
        Initial beacon sleep time
  -Stage string
-        Disable host staging (Default: False) (default "False")
+        Disable host staging (Default: False) (default "false")
+  -Syscall string
+        Defines the ability to use direct/indirect system calls instead of the standard Windows API functions calls:
+        [*] None
+        [*] Direct
+        [*] Indirect (default "None")
+  -TasksDnsProxyMaxSize string
+        The maximum size (in bytes) of proxy data to transfer via the DNS communication channel at a check in
+  -TasksMaxSize string
+        The maximum size (in bytes) of task(s) and proxy data that can be transferred through a communication channel at a check in
+  -TasksProxyMaxSize string
+        The maximum size (in bytes) of proxy data to transfer via the communication channel at a check in
+  -ThreadSpoof
+        Sets post-ex DLLs to spawn threads with a spoofed start address. These are generated randomly (default true)
  -Uri string
        The number URIs a profile for beacons to choose from
  -Useragent string
@@ -152,13 +169,6 @@ Usage of ./SourcePoint:
        [*] Win6.3
        [*] Linux
        [*] Mac
-        [*] Custom - Whatever string you specify will be used as the user agent
-  -TasksMaxSize string
-        The maximum size (in bytes) of task(s) and proxy data that can be transferred through a communication channel at a check in
-  -TasksProxyMaxSize string
-        The maximum size (in bytes) of proxy data to transfer via the communication channel at a check in.
-  -TasksDnsProxyMaxSize string
-        The maximum size (in bytes) of proxy data to transfer via the DNS communication channel at a check in.
  -Yaml string
        Path to the Yaml config file
 ```
@@ -186,6 +196,7 @@ This part of your profile modifies how the beacon operators. Some of the feature
 * TCP Frame Header - Adds a header value to the TCP beacon messages
 * SSH Banner - The SSH banner used
 * SSH Pipename - The name used for the SSH banner
+* HttpLib - The library attribute allows the user to specify the default library used by the generated beacons used by the profile. The value can be "wininet" or "winhttp"

 ### Stage
 This part of your profile controls how beacon is loaded into memory and edit the content of the beacon DLL. Some of the features used to modify the behaviour are:
@@ -194,10 +205,14 @@ This part of your profile controls how beacon is loaded into memory and edit the
 * Stomppe - Asks the payload to stomp MZ, PE and, e_lfanen values after loading
 * Clean up - Tells the beacon to free up memory assoicated with the refelctive DLL that initalized it
 * UseRWX - Ensures shellcode does not use Read, Write Execute permissions
+* Magic_MZ - Overrides the first bytes (MZ header included) of Beacon's Reflective DLL (currently only for x64)
+* Magic_PE - Overrides the PE character marker used by Beacon's Reflective Loader with another value
+* Syscall - Defines the ability to use system calls instead of the standard Windows API functions
 * Smart Inject - Uses embedded function pointer hints to bootstrap the beacon agent without walking kernel32 EAT
 * Sleep Mask - TCP and SMB beacons will obfuscate themselves at rest while they wait for the connection to be established
 * PE Header - Changes the characteristics of your beacon Reflective DLL to look like something else in memory
-* Transformation - Transform beacon's Reflective DLL stage by removing or adding strings to the .rdata section
+* Transformation - Transform beacon's Reflective DLL stage by removing or adding strings to the .rdata 
+

 ### Process-Inject
 This part of your profile controls how the beacon shapes injected content and controls process injection behavior. Some of the features used to modify the behaviour are:
@@ -217,6 +232,8 @@ This part of your profile controls how the beacon handles post-exploitation modu
 * Smart Inject - Pass key function pointers from beacon to its child jobs
 * AMSI disable - Disable AMSI for powerpick, execute-assembly, and psinject (Certain EDRs can detect this best avoid using these tools)
 * Keylogger - Determines how the keystroker logging API use to capture keystrokes
+* Cleanup - Cleanups the post-ex User Defined Reflective DLL ("UDRL") memory when the post-ex DLL is loaded
+* Threadhint - Allows post-ex DLLs to spawn threads with a spoofed start address


 ### Profiles
@@ -238,6 +255,11 @@ The last option (8) is designed to input a custom profile. This option is design

 To do so, use the following options `-Customuri` and `-ProfilePath` along with `-Profile 8`. To use a different URI base for GET and POST, `-CustomuriGET` and  `-CustomuriPOST` should be used in place of `-Customuri`. While developing a profile, it’s highly recommended to use the native ./c2lint to verify everything is working. 

+## Sample Example 
+By combining these options into one profile you can create a highly effective beacon that can circumvent preventive and detective controls. While this remains an evolving cat-and-mouse game, combining the right options against a specific security stack can be quite effective. 
+
+<p align="center"> <img src=Screenshots/MDE_Example.png border="2px solid #555">
+

 ## Sample Yaml Configs

@@ -264,7 +286,16 @@ Customuri:
 CDN:
 CDN_Value: 
 ProfilePath: 
+Syscall_method:
+Httplib:
+ThreadSpoof: true
+Customuri: 
+CustomuriGET: 
+CustomuriPOST:
 Forwarder: False
+TasksMaxSize: 
+TasksProxyMaxSize:
+TasksDnsProxyMaxSize: 
 ```


@@ -20,6 +20,9 @@ Customuri:
 CDN:
 CDN_Value: 
 ProfilePath:
+Syscall_method:
+Httplib: 
+ThreadSpoof: True
 Customuri: 
 CustomuriGET: 
 CustomuriPOST:
@@ -39,6 +39,9 @@ type FlagOptions struct {
 	tasks_max_size           string
 	tasks_proxy_max_size     string
 	tasks_dns_proxy_max_size string
+	syscall_method           string
+	httplib                  string
+	threadspoof              bool
 	Yaml                     string
 }

@@ -71,6 +74,9 @@ type conf struct {
 	TasksMaxSize         string `yaml:"TasksMaxSize"`
 	TasksProxyMaxSize    string `yaml:"TasksProxyMaxSize"`
 	TasksDnsProxyMaxSize string `yaml:"TasksDnsProxyMaxSize"`
+	Syscall_method       string `yaml:"Syscall_method"`
+	Httplib              string `yaml:"Httplib"`
+	Threadspoof          bool   `yaml:"ThreadSpoof"`
 }

 func (c *conf) getConf(yamlfile string) *conf {
@@ -104,36 +110,36 @@ func options() *FlagOptions {
 	customuriGET := flag.String("CustomuriGET", "", "The base URI for custom HTTP GET profile - Must be used with CustomuriPOST")
 	customuriPOST := flag.String("CustomuriPOST", "", "The base URI for custom HTTP POST profile - Must be used with CustomuriGET")
 	beacon_PE := flag.String("PE_Clone", "", `PE file beacon will mimic (Use the number):
-[1] srv.dll
-[2] ActivationManager.dll
-[3] audioeng.dll
-[4] AzureSettingSyncProvider.dll
-[5] BingMaps.dll
-[6] BootMenuUX.dll
-[7] DIAGCPL.dll
+[1] ActivationManager.dll
+[2] audioeng.dll
+[3] AzureSettingSyncProvider.dll
+[4] BingMaps.dll
+[5] DIAGCPL.dll
+[6] EDGEHTML.dll
+[7] FILEMGMT.dll
 [8] FIREWALLCONTROLPANEL.dll
-[9] WMNetMgr.dll
-[10] wwanapi.dll
-[11] Windows.Storage.Search.dll
-[12] Windows.System.Diagnostics.dll
-[13] Windows.System.Launcher.dll
-[14] Windows.System.SystemManagement.dll
-[15] Windows.UI.BioFeedback.dll
-[16] Windows.UI.BlockedShutdown.dll
-[17] Windows.UI.Core.TextInput.dll
-[18] FILEMGMT.dll
-[19] polprocl.dll
-[20] GPSVC.dll
-[21] libcrypto.dll
-[22] rdpcomapi.dll
-[23] winsqlite3.dll
-[24] wow64.dll
+[9] GPSVC.dll
+[10] gpupvdev.dll
+[11] libcrypto.dll
+[12] srvcli.dll
+[13] srvsvc.dll
+[14] Windows.Storage.Search.dll
+[15] Windows.System.Diagnostics.dll
+[16] Windows.System.Launcher.dll
+[17] Windows.System.SystemManagement.dll
+[18] Windows.UI.BioFeedback.dll
+[19] Windows.UI.BlockedShutdown.dll
+[20] Windows.UI.Core.TextInput.DLL
+[21] winsqlite3.dll
+[22] WMNetMgr.DLL
+[23] wwanapi.dll
+[24] WWANSVC.DLL
 [25] wow64win.dll
-[26] WWANSVC.dll
-[27] CyMemDef64.dll (Cylance's DLL)
+[26] wow64.dll
+[27] ctiuser.dll (Carbon Black's DLL)
 [28] InProcessClient.dll (SentinelOne's DLL)
-[29] ctiuser.dll (Carbon Black's DLL)
-[30] umppc.dll (CrowdStrike's DLL)`)
+[29] umppc.dll (CrowdStrike's DLL)
+[30] CyMemDef64.dll (Cylance's DLL)`)
 	processinject_min_alloc := flag.String("Allocation", "", "Minimum amount of memory to request for injected content (must be higher than 4096)")
 	Post_EX_Process_Name := flag.String("PostEX_Name", "", `File Post-Ex activities will spawn and inject into (Use the number):
 [1] WerFault.exe
@@ -186,9 +192,17 @@ func options() *FlagOptions {
 	tasks_max_size := flag.String("TasksMaxSize", "", "The maximum size (in bytes) of task(s) and proxy data that can be transferred through a communication channel at a check in")
 	tasks_proxy_max_size := flag.String("TasksProxyMaxSize", "", "The maximum size (in bytes) of proxy data to transfer via the communication channel at a check in")
 	tasks_dns_proxy_max_size := flag.String("TasksDnsProxyMaxSize", "", "The maximum size (in bytes) of proxy data to transfer via the DNS communication channel at a check in")
+	syscall_method := flag.String("Syscall", "None", `Defines the ability to use direct/indirect system calls instead of the standard Windows API functions calls:
+[*] None
+[*] Direct
+[*] Indirect`)
+	httplib := flag.String("Httplib", "winhttp", `Select the default HTTP Beacon library:
+[*] wininet
+[*] winhttp'`)
+	threadspoof := flag.Bool("ThreadSpoof", true, "Sets post-ex DLLs to spawn threads with a spoofed start address. These are generated randomly")
 	Yaml := flag.String("Yaml", "", "Path to the Yaml config file")
 	flag.Parse()
-	return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, customuriGET: *customuriGET, customuriPOST: *customuriPOST, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder, tasks_max_size: *tasks_max_size, tasks_proxy_max_size: *tasks_proxy_max_size, tasks_dns_proxy_max_size: *tasks_dns_proxy_max_size}
+	return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, customuriGET: *customuriGET, customuriPOST: *customuriPOST, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder, tasks_max_size: *tasks_max_size, tasks_proxy_max_size: *tasks_proxy_max_size, tasks_dns_proxy_max_size: *tasks_dns_proxy_max_size, syscall_method: *syscall_method, httplib: *httplib, threadspoof: *threadspoof}

 }

@@ -235,6 +249,9 @@ func main() {
 		opt.tasks_max_size = c.TasksMaxSize
 		opt.tasks_proxy_max_size = c.TasksProxyMaxSize
 		opt.tasks_dns_proxy_max_size = c.TasksDnsProxyMaxSize
+		opt.syscall_method = c.Syscall_method
+		opt.httplib = c.Httplib
+		opt.threadspoof = c.Threadspoof
 	}
 	if opt.outFile == "" {
 		log.Fatal("Error: Please provide a file name to save the profile into")
@@ -249,5 +266,5 @@ func main() {
 		log.Fatal("Error: When using CustomuriGET/CustomuriPOST, both must be sepecified")
 	}
 	fmt.Println(c.TasksMaxSize)
-	Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.customuriGET, opt.customuriPOST, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder, opt.tasks_max_size, opt.tasks_proxy_max_size, opt.tasks_dns_proxy_max_size)
+	Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.customuriGET, opt.customuriPOST, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder, opt.tasks_max_size, opt.tasks_proxy_max_size, opt.tasks_dns_proxy_max_size, opt.syscall_method, opt.httplib, opt.threadspoof)
 }
@@ -17,21 +17,12 @@ var Post_EX_Process_Name = []string{`
 `, `
 	set spawnto_x86 "%windir%\\syswow64\\WWAHost.exe";
 	set spawnto_x64 "%windir%\\sysnative\\WWAHost.exe";
-`, `
-	set spawnto_x86 "%windir%\\syswow64\\wlanext.exe";
-	set spawnto_x64 "%windir%\\sysnative\\wlanext.exe";
-`, `
-	set spawnto_x86 "%windir%\\syswow64\\auditpol.exe";
-	set spawnto_x64 "%windir%\\sysnative\\auditpol.exe";
-`, `
-	set spawnto_x86 "%windir%\\syswow64\\bootcfg.exe";
-	set spawnto_x64 "%windir%\\sysnative\\bootcfg.exe";
 `, `
 	set spawnto_x86 "%windir%\\syswow64\\choice.exe";
 	set spawnto_x64 "%windir%\\sysnative\\choice.exe";
 `, `
 	set spawnto_x86 "%windir%\\syswow64\\bootcfg.exe";
-	set spawnto_x64 "%windir%\sysnative\\bootcfg.exe";
+	set spawnto_x64 "%windir%\\sysnative\\bootcfg.exe";
 `, `
 	set spawnto_x86 "%windir%\\syswow64\\dtdump.exe";
 	set spawnto_x64 "%windir%\\sysnative\\dtdump.exe";
@@ -68,14 +59,42 @@ var Post_EX_Process_Name = []string{`
 `}

 var Pipename_list = []string{
-	"SapIServerPipes-1-5-5-0",
-	"epmapper-",
-	"atsvc-",
-	"plugplay+",
-	"srvsvc-1-5-5-0",
-	"W32TIME_ALT_",
-	"tapsrv_",
-	"Printer_Spools_",
+	"SapIServerPipes-1-##",
+	"epmapper-##",
+	"atsvc-##",
+	"plugplay+##",
+	"srvsvc-1-5-5-0_##",
+	"W32TIME_ALT_##",
+	"tapsrv_##",
+	"Printer_Spools_##",
+}
+
+var Thread_list = []string{
+	"ucrtbase.dll!configthreadlocale+0x",
+	"combase.dll!InternalTlsAllocData+0x",
+	"ntdll.dll!TpReleaseCleanupGroupMemembers+0x",
+	"ntdll.dll!ZwWaitForSingleObjectEx+0x",
+	"ntdll.dll!RtlUserThreadStart+0x",
+	"sechost.dll!WaitServiceState+0x",
+	"sechost.dll!StartServiceCtrlDispatcherW+0x",
+	"svchost.exe!WaitServiceState+0x",
+	"kernel32.dll!BaseThreadInitThunk+0x",
+}
+
+var Syscall_Method = []string{
+	"None",
+	"Direct",
+	"Indirect",
+}
+
+var Magic_PE = []string{
+	"AXAP",
+	"AZAR",
+	"A[AS",
+	"A\\AT",
+	"A]AU",
+	"A^AV",
+	"A_AW",
 }

 var SSH_Banner = []string{
@@ -90,266 +109,240 @@ var SSH_Banner = []string{
 }

 var Peclone_list = []string{`
-	set checksum       "0";
-	set compile_time   "11 Nov 2016 04:08:32";
-	set entry_point    "650688";
-	set image_size_x86 "4661248";
-	set image_size_x64 "4661248";
-	set name   "srv.dll";
-	set rich_header    "\x3e\x98\xfe\x75\x7a\xf9\x90\x26\x7a\xf9\x90\x26\x7a\xf9\x90\x26\x73\x81\x03\x26\xfc\xf9\x90\x26\x17\xa4\x93\x27\x79\xf9\x90\x26\x7a\xf9\x91\x26\x83\xfd\x90\x26\x17\xa4\x91\x27\x65\xf9\x90\x26\x17\xa4\x95\x27\x77\xf9\x90\x26\x17\xa4\x94\x27\x6c\xf9\x90\x26\x17\xa4\x9e\x27\x56\xf8\x90\x26\x17\xa4\x6f\x26\x7b\xf9\x90\x26\x17\xa4\x92\x27\x7b\xf9\x90\x26\x52\x69\x63\x68\x7a\xf9\x90\x26\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-		`, `  
-	set checksum       "0";
-	set compile_time   "09 Jul 1995 05:50:04";
-	set entry_point    "137648";
-	set image_size_x86 "761856";
-	set image_size_x64 "761856";
-	set name           "ActivationManager.dll";
-	set rich_header    "\x80\x48\xf3\x2d\xc4\x29\x9d\x7e\xc4\x29\x9d\x7e\xc4\x29\x9d\x7e\xcd\x51\x0e\x7e\x6f\x29\x9d\x7e\x9f\x41\x99\x7f\xd0\x29\x9d\x7e\x9f\x41\x9e\x7f\xc7\x29\x9d\x7e\x9f\x41\x98\x7f\xdb\x29\x9d\x7e\xc4\x29\x9c\x7e\x37\x2c\x9d\x7e\x9f\x41\x9c\x7f\xcc\x29\x9d\x7e\x9f\x41\x9d\x7f\xc5\x29\x9d\x7e\x9f\x41\x93\x7f\x97\x29\x9d\x7e\x9f\x41\x60\x7e\xc5\x29\x9d\x7e\x9f\x41\x62\x7e\xc5\x29\x9d\x7e\x9f\x41\x9f\x7f\xc5\x29\x9d\x7e\x52\x69\x63\x68\xc4\x29\x9d\x7e\x00\x00\x00\x00\x00\x00\x00\x00";
+set checksum       "717619";
+set compile_time   "28 Mar 2101 20:42:06";
+set entry_point    "223696";
+set image_size_x86 "679936";
+set image_size_x64 "679936";
+set name           "ActivationManager.dll";
+set rich_header    "\xa5\xe5\x05\x4a\xe1\x84\x6b\x19\xe1\x84\x6b\x19\xe1\x84\x6b\x19\xe8\xfc\xf8\x19\x4c\x84\x6b\x19\xf5\xef\x68\x18\xe9\x84\x6b\x19\xf5\xef\x6f\x18\xfb\x84\x6b\x19\xe1\x84\x6a\x19\xd1\x82\x6b\x19\xf5\xef\x6a\x18\xe9\x84\x6b\x19\xf5\xef\x6b\x18\xe0\x84\x6b\x19\xf5\xef\x65\x18\xb7\x84\x6b\x19\xf5\xef\x6e\x18\xff\x84\x6b\x19\xf5\xef\x96\x19\xe0\x84\x6b\x19\xf5\xef\x94\x19\xe0\x84\x6b\x19\xf5\xef\x69\x18\xe0\x84\x6b\x19\x52\x69\x63\x68\xe1\x84\x6b\x19\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "1930882";
+set compile_time   "08 Aug 1976 22:34:44";
+set entry_point    "905152";
+set image_size_x86 "1908736";
+set image_size_x64 "1908736";
+set name           "audioeng.dll";
+set rich_header    "\x66\x9f\xd4\x63\x22\xfe\xba\x30\x22\xfe\xba\x30\x22\xfe\xba\x30\x36\x95\xb9\x31\x28\xfe\xba\x30\x36\x95\xbe\x31\x2d\xfe\xba\x30\x36\x95\xbb\x31\x26\xfe\xba\x30\x2b\x86\x29\x30\x41\xfe\xba\x30\x22\xfe\xbb\x30\x53\xfb\xba\x30\x36\x95\xba\x31\x23\xfe\xba\x30\x36\x95\xb4\x31\x01\xff\xba\x30\x36\x95\xbf\x31\x3e\xfe\xba\x30\x36\x95\x47\x30\x23\xfe\xba\x30\x36\x95\x45\x30\x23\xfe\xba\x30\x36\x95\xb8\x31\x23\xfe\xba\x30\x52\x69\x63\x68\x22\xfe\xba\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "1309288";
+set compile_time   "13 Jun 2029 04:04:37";
+set entry_point    "877248";
+set image_size_x86 "1347584";
+set image_size_x64 "1347584";
+set name           "AzureSettingSyncProvider.DLL";
+set rich_header    "\x49\x0f\xf5\x64\x0d\x6e\x9b\x37\x0d\x6e\x9b\x37\x0d\x6e\x9b\x37\x04\x16\x08\x37\x61\x6e\x9b\x37\x19\x05\x98\x36\x04\x6e\x9b\x37\x0d\x6e\x9a\x37\xaf\x6f\x9b\x37\x19\x05\x9a\x36\x04\x6e\x9b\x37\x19\x05\x9e\x36\x15\x6e\x9b\x37\x19\x05\x9f\x36\x4f\x6e\x9b\x37\x19\x05\x9b\x36\x0c\x6e\x9b\x37\x19\x05\x92\x36\x77\x6e\x9b\x37\x19\x05\x64\x37\x0c\x6e\x9b\x37\x19\x05\x99\x36\x0c\x6e\x9b\x37\x52\x69\x63\x68\x0d\x6e\x9b\x37\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "6985379";
+set compile_time   "27 Mar 2094 19:17:55";
+set entry_point    "5586624";
+set image_size_x86 "6950912";
+set image_size_x64 "6950912";
+set name           "BingMaps.dll";
+set rich_header    "\x3b\x53\x7d\x55\x7f\x32\x13\x06\x7f\x32\x13\x06\x7f\x32\x13\x06\x76\x4a\x80\x06\x19\x32\x13\x06\x6b\x59\x10\x07\x73\x32\x13\x06\x6b\x59\x17\x07\x70\x32\x13\x06\x7f\x32\x12\x06\xcd\x37\x13\x06\x6b\x59\x12\x07\x6c\x32\x13\x06\x6b\x59\x13\x07\x7e\x32\x13\x06\x6b\x59\x1a\x07\xc8\x33\x13\x06\x6b\x59\x16\x07\x5e\x32\x13\x06\x6b\x59\xee\x06\x7e\x32\x13\x06\x6b\x59\xec\x06\x7e\x32\x13\x06\x6b\x59\x11\x07\x7e\x32\x13\x06\x52\x69\x63\x68\x7f\x32\x13\x06\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "398105";
+set compile_time   "11 Apr 2029 18:35:06";
+set entry_point    "264064";		
+set compile_time   "26 Mar 2011 12:53:09";
+set entry_point    "258048";
+set image_size_x86 "1122304";
+set image_size_x64 "1122304";
+set name           "DIAGCPL.dll";
+set rich_header    "\x52\x82\x23\xb2\x16\xe3\x4d\xe1\x16\xe3\x4d\xe1\x16\xe3\x4d\xe1\x02\x88\x49\xe0\x03\xe3\x4d\xe1\x02\x88\x4e\xe0\x15\xe3\x4d\xe1\x02\x88\x48\xe0\x15\xe3\x4d\xe1\x16\xe3\x4c\xe1\xff\xe2\x4d\xe1\x02\x88\x4c\xe0\x35\xe3\x4d\xe1\x02\x88\x4d\xe0\x17\xe3\x4d\xe1\x02\x88\x45\xe0\x27\xe3\x4d\xe1\x02\x88\xb2\xe1\x17\xe3\x4d\xe1\x02\x88\x4f\xe0\x17\xe3\x4d\xe1\x52\x69\x63\x68\x16\xe3\x4d\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "26291599";
+set compile_time   "30 Jun 2071 19:09:00";
+set entry_point    "5578048";
+set image_size_x86 "26411008";
+set image_size_x64 "26411008";
+set name           "EDGEHTML.dll";
+set rich_header    "\x57\xdf\x63\x23\x13\xbe\x0d\x70\x13\xbe\x0d\x70\x13\xbe\x0d\x70\x1a\xc6\x9e\x70\xdb\xbe\x0d\x70\x07\xd5\x0e\x71\x17\xbe\x0d\x70\x13\xbe\x0c\x70\x16\xb9\x0d\x70\x07\xd5\x0c\x71\x1c\xbe\x0d\x70\x07\xd5\x08\x71\x05\xbe\x0d\x70\x07\xd5\x09\x71\x98\xbe\x0d\x70\x07\xd5\x0d\x71\x12\xbe\x0d\x70\x07\xd5\x00\x71\xa8\xb1\x0d\x70\x07\xd5\xf2\x70\x12\xbe\x0d\x70\x07\xd5\x0f\x71\x12\xbe\x0d\x70\x52\x69\x63\x68\x13\xbe\x0d\x70\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "327597";
+set compile_time   "08 Oct 2014 07:55:29";
+set entry_point    "76608";
+set image_size_x86 "311296";
+set image_size_x64 "311296";
+set name           "FILEMGMT.DLL";
+set rich_header    "\xc9\x32\x31\x5c\x8d\x53\x5f\x0f\x8d\x53\x5f\x0f\x8d\x53\x5f\x0f\x99\x38\x5c\x0e\x89\x53\x5f\x0f\x99\x38\x5b\x0e\x9e\x53\x5f\x0f\x99\x38\x5e\x0e\x98\x53\x5f\x0f\x8d\x53\x5e\x0f\xbe\x51\x5f\x0f\x99\x38\x5a\x0e\x87\x53\x5f\x0f\x99\x38\x5f\x0e\x8c\x53\x5f\x0f\x99\x38\x51\x0e\xb6\x53\x5f\x0f\x99\x38\xa0\x0f\x8c\x53\x5f\x0f\x99\x38\x5d\x0e\x8c\x53\x5f\x0f\x52\x69\x63\x68\x8d\x53\x5f\x0f\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "323973";
+set compile_time   "05 Sep 2093 14:25:32";
+set entry_point    "238272";
+set image_size_x86 "327680";
+set image_size_x64 "327680";
+set name           "FIREWALLCONTROLPANEL.dll";
+set rich_header    "\x62\x54\xcc\x5c\x26\x35\xa2\x0f\x26\x35\xa2\x0f\x26\x35\xa2\x0f\x2f\x4d\x31\x0f\x60\x35\xa2\x0f\x32\x5e\xa1\x0e\x22\x35\xa2\x0f\x32\x5e\xa6\x0e\x31\x35\xa2\x0f\x32\x5e\xa7\x0e\x2f\x35\xa2\x0f\x26\x35\xa3\x0f\x1b\x37\xa2\x0f\x32\x5e\xa3\x0e\x31\x35\xa2\x0f\x32\x5e\xa2\x0e\x27\x35\xa2\x0f\x32\x5e\xab\x0e\x0b\x35\xa2\x0f\x32\x5e\x5d\x0f\x27\x35\xa2\x0f\x32\x5e\xa0\x0e\x27\x35\xa2\x0f\x52\x69\x63\x68\x26\x35\xa2\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "1351672";
+set compile_time   "14 Jul 2081 14:16:28";
+set entry_point    "160064";
+set image_size_x86 "1368064";
+set image_size_x64 "1368064";
+set name           "GPSVC.dll";
+set rich_header    "\x49\xf1\x6f\x1f\x0d\x90\x01\x4c\x0d\x90\x01\x4c\x0d\x90\x01\x4c\x04\xe8\x92\x4c\x5b\x90\x01\x4c\x19\xfb\x02\x4d\x0e\x90\x01\x4c\x0d\x90\x00\x4c\xfb\x91\x01\x4c\x19\xfb\x00\x4d\x06\x90\x01\x4c\x19\xfb\x04\x4d\x01\x90\x01\x4c\x19\xfb\x05\x4d\x19\x90\x01\x4c\x19\xfb\x01\x4d\x0c\x90\x01\x4c\x19\xfb\x0c\x4d\x96\x90\x01\x4c\x19\xfb\xfe\x4c\x0c\x90\x01\x4c\x19\xfb\x03\x4d\x0c\x90\x01\x4c\x52\x69\x63\x68\x0d\x90\x01\x4c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "250984";
+set compile_time   "11 Feb 2078 05:07:28";
+set entry_point    "96336";
+set name           "gpupvdev.dll";
+set rich_header    "\x71\xf3\x1c\xe1\x35\x92\x72\xb2\x35\x92\x72\xb2\x35\x92\x72\xb2\x21\xf9\x73\xb3\x37\x92\x72\xb2\x3c\xea\xe1\xb2\x02\x92\x72\xb2\x35\x92\x73\xb2\x48\x96\x72\xb2\x21\xf9\x76\xb3\x3c\x92\x72\xb2\x21\xf9\x71\xb3\x36\x92\x72\xb2\x21\xf9\x72\xb3\x34\x92\x72\xb2\x21\xf9\x7a\xb3\x3d\x92\x72\xb2\x21\xf9\x77\xb3\x2b\x92\x72\xb2\x21\xf9\x8f\xb2\x34\x92\x72\xb2\x21\xf9\x8d\xb2\x34\x92\x72\xb2\x21\xf9\x70\xb3\x34\x92\x72\xb2\x52\x69\x63\x68\x35\x92\x72\xb2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "1741697";
+set compile_time   "31 Mar 2020 14:08:56";
+set entry_point    "948912";
+set image_size_x86 "1716224";
+set image_size_x64 "1716224";
+set name           "libcrypto.dll";
+set rich_header    "\xf4\x6e\xae\xe7\xb0\x0f\xc0\xb4\xb0\x0f\xc0\xb4\xb0\x0f\xc0\xb4\xd5\x69\xc4\xb5\xba\x0f\xc0\xb4\xd5\x69\xc3\xb5\xb6\x0f\xc0\xb4\xd5\x69\xc5\xb5\x1c\x0f\xc0\xb4\x2e\xaf\x07\xb4\xb7\x0f\xc0\xb4\xe2\x67\xc5\xb5\xae\x0f\xc0\xb4\xe2\x67\xc4\xb5\xbf\x0f\xc0\xb4\xe2\x67\xc3\xb5\xb9\x0f\xc0\xb4\xb9\x77\x53\xb4\x85\x0f\xc0\xb4\xb0\x0f\xc1\xb4\x38\x0f\xc0\xb4\x2b\x66\xc4\xb5\x82\x0d\xc0\xb4\x2b\x66\xc3\xb5\xbf\x0f\xc0\xb4\x2b\x66\xc0\xb5\xb1\x0f\xc0\xb4\x2b\x66\x3f\xb4\xb1\x0f\xc0\xb4\xb0\x0f\x57\xb4\xb1\x0f\xc0\xb4\x2b\x66\xc2\xb5\xb1\x0f\xc0\xb4\x52\x69\x63\x68\xb0\x0f\xc0\xb4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "132564";
+set compile_time   "08 Oct 2004 06:45:39";
+set entry_point    "19840";
+set name           "srvcli.dll";
+set rich_header    "\x31\xe1\x11\x7c\x75\x80\x7f\x2f\x75\x80\x7f\x2f\x75\x80\x7f\x2f\x61\xeb\x7e\x2e\x77\x80\x7f\x2f\x7c\xf8\xec\x2f\x58\x80\x7f\x2f\x75\x80\x7e\x2f\xea\x84\x7f\x2f\x61\xeb\x7c\x2e\x74\x80\x7f\x2f\x61\xeb\x7b\x2e\x7f\x80\x7f\x2f\x61\xeb\x7f\x2e\x74\x80\x7f\x2f\x61\xeb\x72\x2e\x58\x80\x7f\x2f\x61\xeb\x7a\x2e\x65\x80\x7f\x2f\x61\xeb\x82\x2f\x74\x80\x7f\x2f\x61\xeb\x80\x2f\x74\x80\x7f\x2f\x61\xeb\x7d\x2e\x74\x80\x7f\x2f\x52\x69\x63\x68\x75\x80\x7f\x2f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "328248";
+set compile_time   "26 Jun 2065 19:36:37";
+set entry_point    "16240";
+set image_size_x86 "335872";
+set image_size_x64 "335872";
+set name           "srvsvc.dll";
+set rich_header    "\x05\x47\xfc\xc1\x41\x26\x92\x92\x41\x26\x92\x92\x41\x26\x92\x92\x55\x4d\x93\x93\x45\x26\x92\x92\x48\x5e\x01\x92\x10\x26\x92\x92\x41\x26\x93\x92\x7d\x23\x92\x92\x55\x4d\x96\x93\x4b\x26\x92\x92\x55\x4d\x91\x93\x43\x26\x92\x92\x55\x4d\x92\x93\x40\x26\x92\x92\x55\x4d\x9f\x93\x7d\x26\x92\x92\x55\x4d\x97\x93\x53\x26\x92\x92\x55\x4d\x6f\x92\x40\x26\x92\x92\x55\x4d\x6d\x92\x40\x26\x92\x92\x55\x4d\x90\x93\x40\x26\x92\x92\x52\x69\x63\x68\x41\x26\x92\x92\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "664082";
+set compile_time   "15 May 2075 06:23:45";
+set entry_point    "187552";
+set image_size_x86 "643072";
+set image_size_x64 "643072";
+set name           "Windows.Storage.Search.dll";
+set rich_header    "\x70\xb5\x96\x9c\x34\xd4\xf8\xcf\x34\xd4\xf8\xcf\x34\xd4\xf8\xcf\x3d\xac\x6b\xcf\x40\xd4\xf8\xcf\x20\xbf\x05\xcf\x23\xd4\xf8\xcf\x20\xbf\xfc\xce\x2f\xd4\xf8\xcf\x20\xbf\xfd\xce\x36\xd4\xf8\xcf\x34\xd4\xf9\xcf\x66\xd6\xf8\xcf\x20\xbf\xf9\xce\x3d\xd4\xf8\xcf\x20\xbf\xfb\xce\x33\xd4\xf8\xcf\x20\xbf\xf8\xce\x35\xd4\xf8\xcf\x20\xbf\xf6\xce\x5c\xd4\xf8\xcf\x20\xbf\x07\xcf\x35\xd4\xf8\xcf\x20\xbf\xfa\xce\x35\xd4\xf8\xcf\x52\x69\x63\x68\x34\xd4\xf8\xcf\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "299753";
+set compile_time   "24 Jun 1984 09:44:59";
+set entry_point    "244672";
+set image_size_x86 "315392";
+set image_size_x64 "315392";
+set name           "Windows.System.Diagnostics.dll";
+set rich_header    "\x2e\x58\xbc\xf0\x6a\x39\xd2\xa3\x6a\x39\xd2\xa3\x6a\x39\xd2\xa3\x63\x41\x41\xa3\x03\x39\xd2\xa3\x7e\x52\xd1\xa2\x69\x39\xd2\xa3\x7e\x52\xd6\xa2\x65\x39\xd2\xa3\x6a\x39\xd3\xa3\x3b\x3c\xd2\xa3\x7e\x52\xd3\xa2\x62\x39\xd2\xa3\x7e\x52\xd2\xa2\x6b\x39\xd2\xa3\x7e\x52\xdb\xa2\x47\x39\xd2\xa3\x7e\x52\xd7\xa2\x77\x39\xd2\xa3\x7e\x52\x2f\xa3\x6b\x39\xd2\xa3\x7e\x52\x2d\xa3\x6b\x39\xd2\xa3\x7e\x52\xd0\xa2\x6b\x39\xd2\xa3\x52\x69\x63\x68\x6a\x39\xd2\xa3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "809225";
+set compile_time   "27 Jul 2082 08:34:13";
+set entry_point    "519664";
+set image_size_x86 "774144";
+set image_size_x64 "774144";
+set name           "Windows.System.Launcher.dll";
+set rich_header    "\xdf\xfc\x35\x37\x9b\x9d\x5b\x64\x9b\x9d\x5b\x64\x9b\x9d\x5b\x64\x92\xe5\xc8\x64\xeb\x9d\x5b\x64\x8f\xf6\x58\x65\x98\x9d\x5b\x64\x8f\xf6\x5f\x65\x89\x9d\x5b\x64\x9b\x9d\x5a\x64\xb8\x9c\x5b\x64\x8f\xf6\x5a\x65\x92\x9d\x5b\x64\x8f\xf6\x5e\x65\x97\x9d\x5b\x64\x8f\xf6\x5b\x65\x9a\x9d\x5b\x64\x8f\xf6\x53\x65\x81\x9d\x5b\x64\x8f\xf6\xa4\x64\x9a\x9d\x5b\x64\x8f\xf6\x59\x65\x9a\x9d\x5b\x64\x52\x69\x63\x68\x9b\x9d\x5b\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+
+set checksum       "263876";
+set compile_time   "21 Jul 2003 14:15:10";
+set entry_point    "179728";
+set name           "Windows.System.SystemManagement.dll";
+set rich_header    "\xab\xb4\x71\xb4\xef\xd5\x1f\xe7\xef\xd5\x1f\xe7\xef\xd5\x1f\xe7\xe6\xad\x8c\xe7\x9e\xd5\x1f\xe7\xfb\xbe\x1c\xe6\xe9\xd5\x1f\xe7\xfb\xbe\x1b\xe6\xe1\xd5\x1f\xe7\xef\xd5\x1e\xe7\x8c\xd0\x1f\xe7\xfb\xbe\x1e\xe6\xe7\xd5\x1f\xe7\xfb\xbe\x1f\xe6\xee\xd5\x1f\xe7\xfb\xbe\x16\xe6\xc7\xd5\x1f\xe7\xfb\xbe\x1a\xe6\xf1\xd5\x1f\xe7\xfb\xbe\xe2\xe7\xee\xd5\x1f\xe7\xfb\xbe\xe0\xe7\xee\xd5\x1f\xe7\xfb\xbe\x1d\xe6\xee\xd5\x1f\xe7\x52\x69\x63\x68\xef\xd5\x1f\xe7\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "393009";
+set compile_time   "04 Jan 2037 11:02:03";
+set entry_point    "237072";
+set image_size_x86 "380928";
+set image_size_x64 "380928";
+set name           "Windows.UI.BioFeedback.dll";
+set rich_header    "\xc9\x8a\xc6\x41\x8d\xeb\xa8\x12\x8d\xeb\xa8\x12\x8d\xeb\xa8\x12\x84\x93\x3b\x12\xb5\xeb\xa8\x12\x99\x80\xab\x13\x8e\xeb\xa8\x12\x99\x80\xac\x13\x87\xeb\xa8\x12\x8d\xeb\xa9\x12\x63\xef\xa8\x12\x99\x80\xa9\x13\x8a\xeb\xa8\x12\x99\x80\xa8\x13\x8c\xeb\xa8\x12\x99\x80\xa1\x13\x81\xeb\xa8\x12\x99\x80\xad\x13\xae\xeb\xa8\x12\x99\x80\x55\x12\x8c\xeb\xa8\x12\x99\x80\x57\x12\x8c\xeb\xa8\x12\x99\x80\xaa\x13\x8c\xeb\xa8\x12\x52\x69\x63\x68\x8d\xeb\xa8\x12\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "442600";
+set compile_time   "05 Aug 2033 07:05:57";
+set entry_point    "259936";
+set image_size_x86 "434176";
+set image_size_x64 "434176";
+set name           "Windows.UI.BlockedShutdown.dll";
+set rich_header    "\xec\x0c\xe9\x21\xa8\x6d\x87\x72\xa8\x6d\x87\x72\xa8\x6d\x87\x72\xa1\x15\x14\x72\x94\x6d\x87\x72\xbc\x06\x84\x73\xab\x6d\x87\x72\xbc\x06\x83\x73\xa2\x6d\x87\x72\xa8\x6d\x86\x72\x8a\x68\x87\x72\xbc\x06\x86\x73\xa1\x6d\x87\x72\xbc\x06\x87\x73\xa9\x6d\x87\x72\xbc\x06\x8e\x73\xa5\x6d\x87\x72\xbc\x06\x82\x73\x8b\x6d\x87\x72\xbc\x06\x7a\x72\xa9\x6d\x87\x72\xbc\x06\x78\x72\xa9\x6d\x87\x72\xbc\x06\x85\x73\xa9\x6d\x87\x72\x52\x69\x63\x68\xa8\x6d\x87\x72\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "733746";
+set compile_time   "01 Jul 2091 22:01:31";
+set entry_point    "610752";
+set image_size_x86 "729088";
+set image_size_x64 "729088";
+set name           "Windows.UI.Core.TextInput.DLL";
+set rich_header    "\xcf\xa6\x1b\x17\x8b\xc7\x75\x44\x8b\xc7\x75\x44\x8b\xc7\x75\x44\x82\xbf\xe6\x44\xd5\xc7\x75\x44\x9f\xac\x76\x45\x8c\xc7\x75\x44\x9f\xac\x71\x45\x98\xc7\x75\x44\x8b\xc7\x74\x44\x84\xc6\x75\x44\x9f\xac\x74\x45\x80\xc7\x75\x44\x9f\xac\x70\x45\x85\xc7\x75\x44\x9f\xac\x75\x45\x8a\xc7\x75\x44\x9f\xac\x7c\x45\xc4\xc7\x75\x44\x9f\xac\x8a\x44\x8a\xc7\x75\x44\x9f\xac\x77\x45\x8a\xc7\x75\x44\x52\x69\x63\x68\x8b\xc7\x75\x44\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "926377";
+set compile_time   "10 Jul 2019 14:32:11";
+set entry_point    "672064";
+set image_size_x86 "897024";
+set image_size_x64 "897024";
+set name           "winsqlite3.dll";
+set rich_header    "\x86\xdf\xa4\x64\xc2\xbe\xca\x37\xc2\xbe\xca\x37\xc2\xbe\xca\x37\xf9\xe0\xc9\x36\xc4\xbe\xca\x37\xf9\xe0\xcf\x36\xd4\xbe\xca\x37\xf9\xe0\xce\x36\xcc\xbe\xca\x37\xcb\xc6\x59\x37\xf1\xbe\xca\x37\xc2\xbe\xcb\x37\xba\xbe\xca\x37\x55\xe0\xce\x36\xc3\xbe\xca\x37\x55\xe0\xca\x36\xc3\xbe\xca\x37\x50\xe0\x35\x37\xc3\xbe\xca\x37\x55\xe0\xc8\x36\xc3\xbe\xca\x37\x52\x69\x63\x68\xc2\xbe\xca\x37\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "1134746";
+set compile_time   "26 Jun 2021 18:31:54";
+set entry_point    "244784";
+set image_size_x86 "1224704";
+set image_size_x64 "1224704";
+set name           "WMNetMgr.DLL";
+set rich_header    "\x99\xde\x8b\xfc\xdd\xbf\xe5\xaf\xdd\xbf\xe5\xaf\xdd\xbf\xe5\xaf\xc9\xd4\xe6\xae\xd6\xbf\xe5\xaf\xc9\xd4\xe1\xae\xcb\xbf\xe5\xaf\xdd\xbf\xe4\xaf\xa2\xbe\xe5\xaf\xc9\xd4\xe4\xae\xd0\xbf\xe5\xaf\xc9\xd4\xe0\xae\xd5\xbf\xe5\xaf\xc9\xd4\xe5\xae\xdc\xbf\xe5\xaf\xc9\xd4\xeb\xae\x15\xbf\xe5\xaf\xc9\xd4\x1a\xaf\xdc\xbf\xe5\xaf\xc9\xd4\xe7\xae\xdc\xbf\xe5\xaf\x52\x69\x63\x68\xdd\xbf\xe5\xaf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "475685";
+set compile_time   "10 Nov 2015 18:25:50";
+set entry_point    "50064";
+set image_size_x86 "471040";
+set image_size_x64 "471040";
+set name           "wwanapi.dll";
+set rich_header    "\x8b\x47\x1f\x57\xcf\x26\x71\x04\xcf\x26\x71\x04\xcf\x26\x71\x04\xc6\x5e\xe2\x04\x89\x26\x71\x04\xdb\x4d\x72\x05\xca\x26\x71\x04\xdb\x4d\x75\x05\xdb\x26\x71\x04\xcf\x26\x70\x04\x09\x26\x71\x04\xdb\x4d\x70\x05\xca\x26\x71\x04\xdb\x4d\x74\x05\xc3\x26\x71\x04\xdb\x4d\x71\x05\xce\x26\x71\x04\xdb\x4d\x7f\x05\xac\x26\x71\x04\xdb\x4d\x8e\x04\xce\x26\x71\x04\xdb\x4d\x73\x05\xce\x26\x71\x04\x52\x69\x63\x68\xcf\x26\x71\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "1540872";
+set compile_time   "23 May 2072 01:26:12";
+set entry_point    "887952";
+set image_size_x86 "1544192";
+set image_size_x64 "1544192";
+set name           "WWANSVC.DLL";
+set rich_header    "\xec\xba\xa6\xda\xa8\xdb\xc8\x89\xa8\xdb\xc8\x89\xa8\xdb\xc8\x89\xa1\xa3\x5b\x89\x2c\xdb\xc8\x89\xbc\xb0\xcc\x88\xa7\xdb\xc8\x89\xbc\xb0\xcb\x88\xab\xdb\xc8\x89\xa8\xdb\xc9\x89\x78\xde\xc8\x89\xbc\xb0\xc9\x88\xa5\xdb\xc8\x89\xbc\xb0\xc8\x88\xa9\xdb\xc8\x89\xbc\xb0\xc0\x88\x2f\xdb\xc8\x89\xbc\xb0\xcd\x88\x88\xdb\xc8\x89\xbc\xb0\x35\x89\xa9\xdb\xc8\x89\xbc\xb0\x37\x89\xa9\xdb\xc8\x89\xbc\xb0\xca\x88\xa9\xdb\xc8\x89\x52\x69\x63\x68\xa8\xdb\xc8\x89\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
 `, `
-	set checksum       "0";
-	set compile_time   "30 Apr 2074 10:15:36";
-	set entry_point    "148048";
-	set image_size_x86 "2142208";
-	set image_size_x64 "2142208";
-	set name           "audioeng.dll";
-	set rich_header    "\x4a\xed\xf6\x67\x0e\x8c\x98\x34\x0e\x8c\x98\x34\x0e\x8c\x98\x34\x55\xe4\x9c\x35\x02\x8c\x98\x34\x55\xe4\x9b\x35\x0d\x8c\x98\x34\x55\xe4\x9d\x35\x12\x8c\x98\x34\x55\xe4\x99\x35\x0a\x8c\x98\x34\x07\xf4\x0b\x34\x6d\x8c\x98\x34\x0e\x8c\x99\x34\x41\x89\x98\x34\x55\xe4\x98\x35\x0f\x8c\x98\x34\x55\xe4\x96\x35\x2a\x8d\x98\x34\x55\xe4\x65\x34\x0f\x8c\x98\x34\x55\xe4\x67\x34\x0f\x8c\x98\x34\x55\xe4\x9a\x35\x0f\x8c\x98\x34\x52\x69\x63\x68\x0e\x8c\x98\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "26 Jan 2091 14:16:43";
-	set entry_point    "1064336";
-	set image_size_x86 "1966080";
-	set image_size_x64 "1966080";
-	set name           "AzureSettingSyncProvider.DLL";
-	set rich_header    "\x44\xba\xe1\x13\x00\xdb\x8f\x40\x00\xdb\x8f\x40\x00\xdb\x8f\x40\x09\xa3\x1c\x40\x6e\xdb\x8f\x40\x5b\xb3\x8c\x41\x03\xdb\x8f\x40\x00\xdb\x8e\x40\xa6\xda\x8f\x40\x5b\xb3\x8e\x41\x09\xdb\x8f\x40\x5b\xb3\x8a\x41\x18\xdb\x8f\x40\x5b\xb3\x8b\x41\x41\xdb\x8f\x40\x5b\xb3\x8f\x41\x01\xdb\x8f\x40\x5b\xb3\x86\x41\x7a\xdb\x8f\x40\x5b\xb3\x70\x40\x01\xdb\x8f\x40\x5b\xb3\x8d\x41\x01\xdb\x8f\x40\x52\x69\x63\x68\x00\xdb\x8f\x40\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "21 Dec 2053 07:47:21";
-	set entry_point    "5266400";
-	set image_size_x86 "9375744";
-	set image_size_x64 "9375744";
-	set name           "BingMaps.dll";
-	set rich_header    "\xd0\xc8\x67\xde\x94\xa9\x09\x8d\x94\xa9\x09\x8d\x94\xa9\x09\x8d\x9d\xd1\x9a\x8d\xf2\xa9\x09\x8d\xcf\xc1\x0d\x8c\x9f\xa9\x09\x8d\xcf\xc1\x0a\x8c\x97\xa9\x09\x8d\xcf\xc1\x0c\x8c\xb5\xa9\x09\x8d\x94\xa9\x08\x8d\x1a\xac\x09\x8d\xcf\xc1\x08\x8c\x87\xa9\x09\x8d\xcf\xc1\x09\x8c\x95\xa9\x09\x8d\xcf\xc1\x00\x8c\x3e\xa8\x09\x8d\xcf\xc1\xf4\x8d\x96\xa9\x09\x8d\xcf\xc1\xf6\x8d\x95\xa9\x09\x8d\xcf\xc1\x0b\x8c\x95\xa9\x09\x8d\x52\x69\x63\x68\x94\xa9\x09\x8d\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "13 Aug 2104 07:50:19";
-	set entry_point    "231008";
-	set image_size_x86 "339968";
-	set image_size_x64 "339968";
-	set name           "BootMenuUX.dll";
-	set rich_header    "\x9f\xd8\xba\x57\xdb\xb9\xd4\x04\xdb\xb9\xd4\x04\xdb\xb9\xd4\x04\xd2\xc1\x47\x04\xb5\xb9\xd4\x04\x80\xd1\xd7\x05\xd8\xb9\xd4\x04\x80\xd1\xd0\x05\xd4\xb9\xd4\x04\xdb\xb9\xd5\x04\x6c\xb8\xd4\x04\x80\xd1\xd5\x05\xf8\xb9\xd4\x04\x80\xd1\xd4\x05\xda\xb9\xd4\x04\x80\xd1\xdd\x05\xb2\xb9\xd4\x04\x80\xd1\xd1\x05\xdd\xb9\xd4\x04\x80\xd1\x2b\x04\xda\xb9\xd4\x04\x80\xd1\xd6\x05\xda\xb9\xd4\x04\x52\x69\x63\x68\xdb\xb9\xd4\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "25 Jan 2020 23:17:33";
-	set entry_point    "217152";
-	set image_size_x86 "1077248";
-	set image_size_x64 "1077248";
-	set name           "DIAGCPL.dll";
-	set rich_header    "\x2d\xf1\x0e\x49\x69\x90\x60\x1a\x69\x90\x60\x1a\x69\x90\x60\x1a\x32\xf8\x64\x1b\x7c\x90\x60\x1a\x32\xf8\x63\x1b\x6a\x90\x60\x1a\x32\xf8\x65\x1b\x6a\x90\x60\x1a\x69\x90\x61\x1a\xba\x91\x60\x1a\x32\xf8\x61\x1b\x4a\x90\x60\x1a\x32\xf8\x60\x1b\x68\x90\x60\x1a\x32\xf8\x69\x1b\x59\x90\x60\x1a\x32\xf8\x9f\x1a\x68\x90\x60\x1a\x32\xf8\x62\x1b\x68\x90\x60\x1a\x52\x69\x63\x68\x69\x90\x60\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "20 Jan 2030 21:55:22";
-	set entry_point    "216032";
-	set image_size_x86 "352256";
-	set image_size_x64 "352256";
-	set name           "FIREWALLCONTROLPANEL.dll";
-	set rich_header    "\xf9\xc2\xa0\x1b\xbd\xa3\xce\x48\xbd\xa3\xce\x48\xbd\xa3\xce\x48\xb4\xdb\x5d\x48\xf9\xa3\xce\x48\xe6\xcb\xcd\x49\xbe\xa3\xce\x48\xe6\xcb\xca\x49\xab\xa3\xce\x48\xe6\xcb\xcb\x49\xb4\xa3\xce\x48\xbd\xa3\xcf\x48\x84\xa1\xce\x48\xe6\xcb\xcf\x49\xaa\xa3\xce\x48\xe6\xcb\xce\x49\xbc\xa3\xce\x48\xe6\xcb\xc7\x49\x93\xa3\xce\x48\xe6\xcb\x31\x48\xbc\xa3\xce\x48\xe6\xcb\xcc\x49\xbc\xa3\xce\x48\x52\x69\x63\x68\xbd\xa3\xce\x48\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "31 Jul 2090 12:56:16";
-	set entry_point    "186192";
-	set image_size_x86 "1490944";
-	set image_size_x64 "1490944";
-	set name           "WMNetMgr.DLL";
-	set rich_header    "\x35\xe0\x65\x56\x71\x81\x0b\x05\x71\x81\x0b\x05\x71\x81\x0b\x05\x2a\xe9\x08\x04\x72\x81\x0b\x05\x2a\xe9\x0f\x04\x66\x81\x0b\x05\x71\x81\x0a\x05\xf7\x80\x0b\x05\x2a\xe9\x0a\x04\x7c\x81\x0b\x05\x2a\xe9\x0e\x04\x79\x81\x0b\x05\x2a\xe9\x0b\x04\x70\x81\x0b\x05\x2a\xe9\x05\x04\xb9\x81\x0b\x05\x2a\xe9\xf4\x05\x70\x81\x0b\x05\x2a\xe9\x09\x04\x70\x81\x0b\x05\x52\x69\x63\x68\x71\x81\x0b\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "19 Apr 2070 21:37:24";
-	set entry_point    "13760";
-	set image_size_x86 "548864";
-	set image_size_x64 "548864";
-	set name           "wwanapi.dll";
-	set rich_header    "\x39\x39\x83\xe8\x7d\x58\xed\xbb\x7d\x58\xed\xbb\x7d\x58\xed\xbb\x74\x20\x7e\xbb\x3b\x58\xed\xbb\x26\x30\xee\xba\x7e\x58\xed\xbb\x26\x30\xe9\xba\x69\x58\xed\xbb\x7d\x58\xec\xbb\xbf\x58\xed\xbb\x26\x30\xec\xba\x78\x58\xed\xbb\x26\x30\xe8\xba\x71\x58\xed\xbb\x26\x30\xed\xba\x7c\x58\xed\xbb\x26\x30\xe3\xba\x1f\x58\xed\xbb\x26\x30\x12\xbb\x7c\x58\xed\xbb\x26\x30\xef\xba\x7c\x58\xed\xbb\x52\x69\x63\x68\x7d\x58\xed\xbb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "17 Nov 2003 16:56:11";
-	set entry_point    "194608";
-	set image_size_x86 "770048";
-	set image_size_x64 "770048";
-	set name           "Windows.Storage.Search.dll";
-	set rich_header    "\xa9\xbc\xd1\xd5\xed\xdd\xbf\x86\xed\xdd\xbf\x86\xed\xdd\xbf\x86\xe4\xa5\x2c\x86\x99\xdd\xbf\x86\xb6\xb5\x42\x86\xfa\xdd\xbf\x86\xb6\xb5\xbc\x87\xee\xdd\xbf\x86\xb6\xb5\xbb\x87\xf1\xdd\xbf\x86\xed\xdd\xbe\x86\xbe\xdf\xbf\x86\xb6\xb5\xbe\x87\xe4\xdd\xbf\x86\xb6\xb5\xba\x87\xee\xdd\xbf\x86\xb6\xb5\xbf\x87\xec\xdd\xbf\x86\xb6\xb5\xb1\x87\x8a\xdd\xbf\x86\xb6\xb5\x40\x86\xec\xdd\xbf\x86\xb6\xb5\xbd\x87\xec\xdd\xbf\x86\x52\x69\x63\x68\xed\xdd\xbf\x86\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "05 Jun 2028 09:16:06";
-	set entry_point    "229200";
-	set image_size_x86 "397312";
-	set image_size_x64 "397312";
-	set name           "Windows.System.Diagnostics.dll";
-	set rich_header    "\x56\xb8\x3f\x82\x12\xd9\x51\xd1\x12\xd9\x51\xd1\x12\xd9\x51\xd1\x1b\xa1\xc2\xd1\x7b\xd9\x51\xd1\x49\xb1\x55\xd0\x19\xd9\x51\xd1\x49\xb1\x52\xd0\x11\xd9\x51\xd1\x49\xb1\x54\xd0\x0c\xd9\x51\xd1\x12\xd9\x50\xd1\x0f\xdc\x51\xd1\x49\xb1\x50\xd0\x1a\xd9\x51\xd1\x49\xb1\x51\xd0\x13\xd9\x51\xd1\x49\xb1\x58\xd0\x3f\xd9\x51\xd1\x49\xb1\xac\xd1\x13\xd9\x51\xd1\x49\xb1\xae\xd1\x13\xd9\x51\xd1\x49\xb1\x53\xd0\x13\xd9\x51\xd1\x52\x69\x63\x68\x12\xd9\x51\xd1\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "04 Jul 2034 11:53:44";
-	set entry_point    "499072";
-	set image_size_x86 "749568";
-	set image_size_x64 "749568";
-	set name           "Windows.System.Launcher.dll";
-	set rich_header    "\x47\xa6\x6c\x0f\x03\xc7\x02\x5c\x03\xc7\x02\x5c\x03\xc7\x02\x5c\x0a\xbf\x91\x5c\x69\xc7\x02\x5c\x58\xaf\x01\x5d\x00\xc7\x02\x5c\x58\xaf\x06\x5d\x13\xc7\x02\x5c\x03\xc7\x03\x5c\x1d\xc6\x02\x5c\x58\xaf\x03\x5d\x0a\xc7\x02\x5c\x58\xaf\x07\x5d\x0f\xc7\x02\x5c\x58\xaf\x02\x5d\x02\xc7\x02\x5c\x58\xaf\x0b\x5d\x1a\xc7\x02\x5c\x58\xaf\xfd\x5c\x02\xc7\x02\x5c\x58\xaf\x00\x5d\x02\xc7\x02\x5c\x52\x69\x63\x68\x03\xc7\x02\x5c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`, `
-	set checksum       "0";
-	set compile_time   "22 Nov 2077 06:35:05";
-	set entry_point    "174288";
-	set image_size_x86 "352256";
-	set image_size_x64 "352256";
-	set name           "Windows.System.SystemManagement.dll";
-	set rich_header    "\x1e\x43\xad\x11\x5a\x22\xc3\x42\x5a\x22\xc3\x42\x5a\x22\xc3\x42\x53\x5a\x50\x42\x35\x22\xc3\x42\x01\x4a\xc7\x43\x51\x22\xc3\x42\x01\x4a\xc0\x43\x59\x22\xc3\x42\x01\x4a\xc6\x43\x44\x22\xc3\x42\x5a\x22\xc2\x42\x6f\x27\xc3\x42\x01\x4a\xc2\x43\x52\x22\xc3\x42\x01\x4a\xc3\x43\x5b\x22\xc3\x42\x01\x4a\xca\x43\x72\x22\xc3\x42\x01\x4a\x3e\x42\x5b\x22\xc3\x42\x01\x4a\x3c\x42\x5b\x22\xc3\x42\x01\x4a\xc1\x43\x5b\x22\xc3\x42\x52\x69\x63\x68\x5a\x22\xc3\x42\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`, `
-	set checksum       "0";
-	set compile_time   "02 Sep 1979 16:19:10";
-	set entry_point    "244336";
-	set image_size_x86 "450560";
-	set image_size_x64 "450560";
-	set name           "Windows.UI.BioFeedback.dll";
-	set rich_header    "\x2e\xc5\x24\x6b\x6a\xa4\x4a\x38\x6a\xa4\x4a\x38\x6a\xa4\x4a\x38\x63\xdc\xd9\x38\x58\xa4\x4a\x38\x31\xcc\x49\x39\x69\xa4\x4a\x38\x31\xcc\x4e\x39\x54\xa4\x4a\x38\x31\xcc\x4f\x39\x72\xa4\x4a\x38\x31\xcc\x4b\x39\x6d\xa4\x4a\x38\x6a\xa4\x4b\x38\x6f\xa5\x4a\x38\x31\xcc\x4a\x39\x6b\xa4\x4a\x38\x31\xcc\x43\x39\x60\xa4\x4a\x38\x31\xcc\xb5\x38\x6b\xa4\x4a\x38\x31\xcc\x48\x39\x6b\xa4\x4a\x38\x52\x69\x63\x68\x6a\xa4\x4a\x38\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "21 Apr 2088 08:58:42";
-	set entry_point    "263424";
-	set image_size_x86 "495616";
-	set image_size_x64 "495616";
-	set name           "Windows.UI.BlockedShutdown.dll";
-	set rich_header    "\xe4\xce\xe6\x5e\xa0\xaf\x88\x0d\xa0\xaf\x88\x0d\xa0\xaf\x88\x0d\xa9\xd7\x1b\x0d\x96\xaf\x88\x0d\xfb\xc7\x8b\x0c\xa3\xaf\x88\x0d\xfb\xc7\x8c\x0c\x9f\xaf\x88\x0d\xfb\xc7\x8d\x0c\xb8\xaf\x88\x0d\xfb\xc7\x89\x0c\xa9\xaf\x88\x0d\xa0\xaf\x89\x0d\xb9\xae\x88\x0d\xfb\xc7\x88\x0c\xa1\xaf\x88\x0d\xfb\xc7\x81\x0c\xac\xaf\x88\x0d\xfb\xc7\x77\x0d\xa1\xaf\x88\x0d\xfb\xc7\x8a\x0c\xa1\xaf\x88\x0d\x52\x69\x63\x68\xa0\xaf\x88\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "09 Apr 2088 13:20:50";
-	set entry_point    "622480";
-	set image_size_x86 "942080";
-	set image_size_x64 "942080";
-	set name           "Windows.UI.Core.TextInput.DLL";
-	set rich_header    "\x15\xc1\x87\x6a\x51\xa0\xe9\x39\x51\xa0\xe9\x39\x51\xa0\xe9\x39\x58\xd8\x7a\x39\x0f\xa0\xe9\x39\x0a\xc8\xea\x38\x52\xa0\xe9\x39\x0a\xc8\xed\x38\x43\xa0\xe9\x39\x51\xa0\xe8\x39\x4c\xa1\xe9\x39\x0a\xc8\xe8\x38\x5a\xa0\xe9\x39\x0a\xc8\xec\x38\x5d\xa0\xe9\x39\x0a\xc8\xe9\x38\x50\xa0\xe9\x39\x0a\xc8\xe0\x38\x0c\xa0\xe9\x39\x0a\xc8\x16\x39\x50\xa0\xe9\x39\x0a\xc8\xeb\x38\x50\xa0\xe9\x39\x52\x69\x63\x68\x51\xa0\xe9\x39\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "29 May 2067 18:44:41";
-	set entry_point    "29296";
-	set image_size_x86 "413696";
-	set image_size_x64 "413696";
-	set name           "FILEMGMT.DLL";
-	set rich_header    "\x75\x90\x3e\x81\x31\xf1\x50\xd2\x31\xf1\x50\xd2\x31\xf1\x50\xd2\x6a\x99\x53\xd3\x32\xf1\x50\xd2\x6a\x99\x54\xd3\x22\xf1\x50\xd2\x6a\x99\x51\xd3\x24\xf1\x50\xd2\x31\xf1\x51\xd2\x06\xf3\x50\xd2\x6a\x99\x55\xd3\x3b\xf1\x50\xd2\x6a\x99\x50\xd3\x30\xf1\x50\xd2\x6a\x99\x5e\xd3\x0a\xf1\x50\xd2\x6a\x99\xaf\xd2\x30\xf1\x50\xd2\x6a\x99\x52\xd3\x30\xf1\x50\xd2\x52\x69\x63\x68\x31\xf1\x50\xd2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "20 Oct 1984 19:23:49";
-	set entry_point    "376848";
-	set image_size_x86 "712704";
-	set image_size_x64 "712704";
-	set name           "polprocl.dll";
-	set rich_header    "\xdc\xa9\xe7\xf1\x98\xc8\x89\xa2\x98\xc8\x89\xa2\x98\xc8\x89\xa2\x91\xb0\x1a\xa2\xda\xc8\x89\xa2\xc3\xa0\x8a\xa3\x9b\xc8\x89\xa2\xc3\xa0\x8d\xa3\x8e\xc8\x89\xa2\x98\xc8\x88\xa2\x82\xca\x89\xa2\xc3\xa0\x88\xa3\xab\xc8\x89\xa2\xc3\xa0\x89\xa3\x99\xc8\x89\xa2\xc3\xa0\x80\xa3\x0f\xc8\x89\xa2\xc3\xa0\x8c\xa3\x9f\xc8\x89\xa2\xc3\xa0\x76\xa2\x99\xc8\x89\xa2\xc3\xa0\x8b\xa3\x99\xc8\x89\xa2\x52\x69\x63\x68\x98\xc8\x89\xa2\x00\x00\x00\x00\x00\x00\x00\x00";
-	`, `
-	set checksum       "0";
-	set compile_time   "30 Mar 1994 00:05:14";
-	set entry_point    "113632";
-	set image_size_x86 "1277952";
-	set image_size_x64 "1277952";
-	set name           "GPSVC.dll";
-	set rich_header    "\xd5\x3a\xd3\x63\x91\x5b\xbd\x30\x91\x5b\xbd\x30\x91\x5b\xbd\x30\x98\x23\x2e\x30\xc5\x5b\xbd\x30\xca\x33\xbe\x31\x92\x5b\xbd\x30\xca\x33\xb9\x31\x82\x5b\xbd\x30\x91\x5b\xbc\x30\x47\x5a\xbd\x30\xca\x33\xbc\x31\x9a\x5b\xbd\x30\xca\x33\xb8\x31\x9b\x5b\xbd\x30\xca\x33\xbd\x31\x90\x5b\xbd\x30\xca\x33\xb3\x31\x08\x5b\xbd\x30\xca\x33\x42\x30\x90\x5b\xbd\x30\xca\x33\xbf\x31\x90\x5b\xbd\x30\x52\x69\x63\x68\x91\x5b\xbd\x30\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "10 Aug 2018 19:22:06";
-	set entry_point    "869360";
-	set image_size_x86 "1638400";
-	set image_size_x64 "1638400";
-	set name           "libcrypto.dll";
-	set rich_header  "\xbe\xf7\xf9\xa0\xfa\x96\x97\xf3\xfa\x96\x97\xf3\xfa\x96\x97\xf3\x89\xf4\x93\xf2\xf0\x96\x97\xf3\x89\xf4\x94\xf2\xfc\x96\x97\xf3\x89\xf4\x92\xf2\x52\x96\x97\xf3\x64\x36\x50\xf3\xf2\x96\x97\xf3\x28\xf2\x94\xf2\xf3\x96\x97\xf3\x28\xf2\x92\xf2\xef\x96\x97\xf3\x28\xf2\x93\xf2\xeb\x96\x97\xf3\xf3\xee\x04\xf3\xc9\x96\x97\xf3\xfa\x96\x96\xf3\x7d\x96\x97\xf3\x11\xf2\x93\xf2\xd4\x94\x97\xf3\x11\xf2\x97\xf2\xfb\x96\x97\xf3\x11\xf2\x68\xf3\xfb\x96\x97\xf3\xfa\x96\x00\xf3\xfb\x96\x97\xf3\x11\xf2\x95\xf2\xfb\x96\x97\xf3\x52\x69\x63\x68\xfa\x96\x97\xf3\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "06 Jul 1990 07:33:20";
-	set entry_point    "210752";
-	set image_size_x86 "344064";
-	set image_size_x64 "344064";
-	set name           "rdpcomapi.DLL";
-		set rich_header    "\x40\x89\xc2\x2f\x04\xe8\xac\x7c\x04\xe8\xac\x7c\x04\xe8\xac\x7c\x0d\x90\x3f\x7c\x50\xe8\xac\x7c\x5f\x80\xa8\x7d\x12\xe8\xac\x7c\x04\xe8\xad\x7c\x20\xe9\xac\x7c\x5f\x80\xad\x7d\x03\xe8\xac\x7c\x5f\x80\xaf\x7d\x00\xe8\xac\x7c\x5f\x80\xa9\x7d\x02\xe8\xac\x7c\x5f\x80\xac\x7d\x05\xe8\xac\x7c\x5f\x80\xa5\x7d\x23\xe8\xac\x7c\x5f\x80\x53\x7c\x05\xe8\xac\x7c\x5f\x80\xae\x7d\x05\xe8\xac\x7c\x52\x69\x63\x68\x04\xe8\xac\x7c\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "05 Nov 2018 23:03:21";
-	set entry_point    "657360";
-	set image_size_x86 "880640";
-	set image_size_x64 "880640";
-	set name           "winsqlite3.dll";
-	set rich_header    "\xe5\x3e\x6d\xff\xa1\x5f\x03\xac\xa1\x5f\x03\xac\xa1\x5f\x03\xac\x9a\x01\x00\xad\xa7\x5f\x03\xac\x9a\x01\x06\xad\xb7\x5f\x03\xac\x9a\x01\x07\xad\xac\x5f\x03\xac\xa8\x27\x90\xac\x92\x5f\x03\xac\xa1\x5f\x02\xac\xd8\x5f\x03\xac\x36\x01\x07\xad\xa0\x5f\x03\xac\x36\x01\x03\xad\xa0\x5f\x03\xac\x33\x01\xfc\xac\xa0\x5f\x03\xac\x36\x01\x01\xad\xa0\x5f\x03\xac\x52\x69\x63\x68\xa1\x5f\x03\xac\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "14 Oct 2074 07:37:20";
-	set entry_point    "96192";
-	set image_size_x86 "348160";
-	set image_size_x64 "348160";
-	set name           "wow64.dll";
-	set rich_header    "\x81\xe8\xb7\x79\xc5\x89\xd9\x2a\xc5\x89\xd9\x2a\xc5\x89\xd9\x2a\x9e\xe1\xd8\x2b\xc0\x89\xd9\x2a\xc5\x89\xd8\x2a\x85\x8b\xd9\x2a\x9e\xe1\xdd\x2b\xc3\x89\xd9\x2a\x9e\xe1\xd9\x2b\xc4\x89\xd9\x2a\x9e\xe1\xda\x2b\xc0\x89\xd9\x2a\x9e\xe1\xd4\x2b\xec\x89\xd9\x2a\x9e\xe1\x26\x2a\xc4\x89\xd9\x2a\x9e\xe1\xdb\x2b\xc4\x89\xd9\x2a\x52\x69\x63\x68\xc5\x89\xd9\x2a\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "16 Aug 2035 01:40:28";
-	set entry_point    "63504";
-	set image_size_x86 "512000";
-	set image_size_x64 "512000";
-	set name           "wow64win.dll";
-	set rich_header    "\x78\x0f\x70\x56\x3c\x6e\x1e\x05\x3c\x6e\x1e\x05\x3c\x6e\x1e\x05\x67\x06\x1f\x04\x39\x6e\x1e\x05\x3c\x6e\x1f\x05\x27\x6e\x1e\x05\x67\x06\x13\x04\x34\x6e\x1e\x05\x67\x06\x1a\x04\x3a\x6e\x1e\x05\x67\x06\x1e\x04\x3d\x6e\x1e\x05\x67\x06\x1d\x04\x3f\x6e\x1e\x05\x67\x06\xe1\x05\x3d\x6e\x1e\x05\x67\x06\x1c\x04\x3d\x6e\x1e\x05\x52\x69\x63\x68\x3c\x6e\x1e\x05\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "0";
-	set compile_time   "02 Feb 2020 19:59:15";
-	set entry_point    "1056672";
-	set image_size_x86 "1785856";
-	set image_size_x64 "1785856";
-	set name           "WWANSVC.DLL";
-	set rich_header    "\x77\xf3\x15\x7d\x33\x92\x7b\x2e\x33\x92\x7b\x2e\x33\x92\x7b\x2e\x3a\xea\xe8\x2e\xb3\x92\x7b\x2e\x68\xfa\x7f\x2f\x3c\x92\x7b\x2e\x68\xfa\x78\x2f\x30\x92\x7b\x2e\x68\xfa\x7e\x2f\x2d\x92\x7b\x2e\x33\x92\x7a\x2e\xf8\x97\x7b\x2e\x68\xfa\x7a\x2f\x3e\x92\x7b\x2e\x68\xfa\x7b\x2f\x32\x92\x7b\x2e\x68\xfa\x72\x2f\xa9\x92\x7b\x2e\x68\xfa\x86\x2e\x32\x92\x7b\x2e\x68\xfa\x84\x2e\x32\x92\x7b\x2e\x68\xfa\x79\x2f\x32\x92\x7b\x2e\x52\x69\x63\x68\x33\x92\x7b\x2e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "164653";
-	set compile_time   "06 Nov 2020 18:42:28";
-	set entry_point    "63072";
-	set name           "CyMemDef64.dll";
-	set rich_header    "\x5f\x64\xdb\xae\x1b\x05\xb5\xfd\x1b\x05\xb5\xfd\x1b\x05\xb5\xfd\x1b\x05\xb4\xfd\x30\x05\xb5\xfd\xe7\x72\x0c\xfd\x18\x05\xb5\xfd\x7d\xeb\x66\xfd\x07\x05\xb5\xfd\x3c\xc3\x78\xfd\x1a\x05\xb5\xfd\x7d\xeb\x7f\xfd\x1a\x05\xb5\xfd\x3c\xc3\x7c\xfd\x1a\x05\xb5\xfd\x1b\x05\x22\xfd\x1a\x05\xb5\xfd\x7d\xeb\x79\xfd\x1a\x05\xb5\xfd\x52\x69\x63\x68\x1b\x05\xb5\xfd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
-	`
-	set checksum       "1968945";
-	set compile_time   "26 Jul 2021 18:09:30";
-	set entry_point    "1099888";
-	set image_size_x86 "2072576";
-	set image_size_x64 "2072576";
-	set name           "InProcessClient.dll";
-	set rich_header    "\xd5\x71\x0e\xb3\x91\x10\x60\xe0\x91\x10\x60\xe0\x91\x10\x60\xe0\x85\x7b\x63\xe1\x84\x10\x60\xe0\x85\x7b\x65\xe1\x24\x10\x60\xe0\x48\x64\x64\xe1\x83\x10\x60\xe0\x48\x64\x63\xe1\x9d\x10\x60\xe0\xf7\x7f\x9d\xe0\x92\x10\x60\xe0\x4a\x64\x61\xe1\x93\x10\x60\xe0\x85\x7b\x64\xe1\xb2\x10\x60\xe0\x85\x7b\x61\xe1\x94\x10\x60\xe0\x48\x64\x65\xe1\x0e\x10\x60\xe0\xfb\x78\x65\xe1\x80\x10\x60\xe0\x85\x7b\x66\xe1\x93\x10\x60\xe0\x91\x10\x61\xe0\x5c\x11\x60\xe0\x4a\x64\x69\xe1\x03\x10\x60\xe0\x4a\x64\x63\xe1\x93\x10\x60\xe0\x4a\x64\x60\xe1\x90\x10\x60\xe0\x4a\x64\x9f\xe0\x90\x10\x60\xe0\x91\x10\xf7\xe0\x90\x10\x60\xe0\x4a\x64\x62\xe1\x90\x10\x60\xe0\x52\x69\x63\x68\x91\x10\x60\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-    `,
-	`
-	set checksum       "2817694";
-	set compile_time   "19 May 2021 13:31:53";
-	set entry_point    "1253200";
-	set image_size_x86 "2863104";
-	set image_size_x64 "2863104";
-	set name           "ctiuser.dll";
-	set rich_header    "\x15\xd9\xb0\x30\x51\xb8\xde\x63\x51\xb8\xde\x63\x51\xb8\xde\x63\x45\xd3\xda\x62\x47\xb8\xde\x63\x45\xd3\xdd\x62\x5f\xb8\xde\x63\x45\xd3\xdb\x62\x90\xb8\xde\x63\xcf\x18\x19\x63\x52\xb8\xde\x63\xa9\xc8\xda\x62\x40\xb8\xde\x63\xa9\xc8\xdd\x62\x5b\xb8\xde\x63\xa9\xc8\xdb\x62\xdf\xb8\xde\x63\x45\xd3\xdf\x62\x54\xb8\xde\x63\x45\xd3\xd8\x62\x53\xb8\xde\x63\x51\xb8\xdf\x63\x29\xb9\xde\x63\xe9\xc9\xda\x62\x69\xb8\xde\x63\xe9\xc9\xdb\x62\x13\xb8\xde\x63\xe9\xc9\xde\x62\x50\xb8\xde\x63\xe9\xc9\x21\x63\x50\xb8\xde\x63\x51\xb8\x49\x63\x50\xb8\xde\x63\xe9\xc9\xdc\x62\x50\xb8\xde\x63\x52\x69\x63\x68\x51\xb8\xde\x63\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-    `,
-	`
-	set checksum       "83724";
-	set compile_time   "05 Aug 2020 16:06:20";
-	set entry_point    "5664";
-	set name           "umppc.dll";
-	set rich_header    "\xba\xf0\x63\x99\xfe\x91\x0d\xca\xfe\x91\x0d\xca\xfe\x91\x0d\xca\x92\xf9\x0e\xcb\xff\x91\x0d\xca\x92\xf9\x05\xcb\xf3\x91\x0d\xca\x9b\xf7\x0e\xcb\xfc\x91\x0d\xca\x9b\xf7\x09\xcb\xfb\x91\x0d\xca\x9b\xf7\x0c\xcb\xfd\x91\x0d\xca\xfe\x91\x0c\xca\xc6\x91\x0d\xca\x92\xf9\x0d\xcb\xff\x91\x0d\xca\x92\xf9\xf2\xca\xff\x91\x0d\xca\x92\xf9\x0f\xcb\xff\x91\x0d\xca\x52\x69\x63\x68\xfe\x91\x0d\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
-	`,
+set checksum       "564120";
+set compile_time   "08 Sep 2007 15:58:23";
+set entry_point    "64272";
+set image_size_x86 "536576";
+set image_size_x64 "536576";
+set name           "wow64win.dll";
+set rich_header    "\xff\x46\xc6\x00\xbb\x27\xa8\x53\xbb\x27\xa8\x53\xbb\x27\xa8\x53\xaf\x4c\xa9\x52\xbe\x27\xa8\x53\xbb\x27\xa9\x53\xa1\x27\xa8\x53\xaf\x4c\xac\x52\xbc\x27\xa8\x53\xaf\x4c\xa5\x52\xb2\x27\xa8\x53\xaf\x4c\xa8\x52\xba\x27\xa8\x53\xaf\x4c\xab\x52\xb8\x27\xa8\x53\xaf\x4c\x57\x53\xba\x27\xa8\x53\xaf\x4c\xaa\x52\xba\x27\xa8\x53\x52\x69\x63\x68\xbb\x27\xa8\x53\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "367366";
+set compile_time   "25 Jun 2044 21:28:59";
+set entry_point    "102608";
+set image_size_x86 "364544";
+set image_size_x64 "364544";
+set name           "wow64.dll";
+set rich_header    "\x1e\xc2\x53\x5c\x5a\xa3\x3d\x0f\x5a\xa3\x3d\x0f\x5a\xa3\x3d\x0f\x4e\xc8\x3c\x0e\x5f\xa3\x3d\x0f\x5a\xa3\x3c\x0f\x13\xa1\x3d\x0f\x4e\xc8\x39\x0e\x5c\xa3\x3d\x0f\x4e\xc8\x3d\x0e\x5b\xa3\x3d\x0f\x4e\xc8\x3e\x0e\x5e\xa3\x3d\x0f\x4e\xc8\x30\x0e\x72\xa3\x3d\x0f\x4e\xc8\xc2\x0f\x5b\xa3\x3d\x0f\x4e\xc8\x3f\x0e\x5b\xa3\x3d\x0f\x52\x69\x63\x68\x5a\xa3\x3d\x0f\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "4372458";
+set compile_time   "29 Nov 2022 18:59:21";
+set entry_point    "1605936";
+set image_size_x86 "4423680";
+set image_size_x64 "4423680";
+set name           "ctiuser.dll";
+set rich_header    "\xb9\x56\x40\x85\xfd\x37\x2e\xd6\xfd\x37\x2e\xd6\xfd\x37\x2e\xd6\xe9\x5c\x2a\xd7\xea\x37\x2e\xd6\xe9\x5c\x2d\xd7\xf3\x37\x2e\xd6\xe9\x5c\x2b\xd7\x3d\x37\x2e\xd6\x05\x47\x2a\xd7\xec\x37\x2e\xd6\x05\x47\x2d\xd7\xf7\x37\x2e\xd6\xe9\x5c\x28\xd7\xff\x37\x2e\xd6\x45\x46\x2a\xd7\xb3\x37\x2e\xd6\xfd\x37\x2f\xd6\x61\x36\x2e\xd6\xe9\x5c\x2f\xd7\xfa\x37\x2e\xd6\x05\x47\x2b\xd7\x6c\x37\x2e\xd6\x45\x46\x2b\xd7\x8b\x37\x2e\xd6\x45\x46\x2e\xd7\xfc\x37\x2e\xd6\x45\x46\xd1\xd6\xfc\x37\x2e\xd6\xfd\x37\xb9\xd6\xfc\x37\x2e\xd6\x45\x46\x2c\xd7\xfc\x37\x2e\xd6\x52\x69\x63\x68\xfd\x37\x2e\xd6\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "2434978";
+set compile_time   "12 Dec 2022 11:46:37";
+set entry_point    "1310336";
+set image_size_x86 "2519040";
+set image_size_x64 "2519040";
+set name           "InProcessClient.dll";
+set rich_header    "\x50\x58\xa2\x76\x14\x39\xcc\x25\x14\x39\xcc\x25\x14\x39\xcc\x25\x5f\x41\xcf\x24\x01\x39\xcc\x25\x5f\x41\xc9\x24\xaa\x39\xcc\x25\x74\x43\x31\x25\x15\x39\xcc\x25\x74\x43\xc8\x24\x05\x39\xcc\x25\x74\x43\xcf\x24\x1a\x39\xcc\x25\x76\x41\xc9\x24\x16\x39\xcc\x25\x70\x43\xcd\x24\x16\x39\xcc\x25\x74\x43\xc9\x24\xb5\x39\xcc\x25\x70\x43\xc9\x24\x17\x39\xcc\x25\x7e\x51\xc9\x24\x05\x39\xcc\x25\x5f\x41\xcd\x24\x1d\x39\xcc\x25\x5f\x41\xca\x24\x15\x39\xcc\x25\x5f\x41\xc8\x24\x37\x39\xcc\x25\x14\x39\xcd\x25\xf7\x38\xcc\x25\x70\x43\xc5\x24\xb6\x39\xcc\x25\x70\x43\xcf\x24\x16\x39\xcc\x25\x70\x43\xcc\x24\x15\x39\xcc\x25\x70\x43\x33\x25\x15\x39\xcc\x25\x70\x43\xce\x24\x15\x39\xcc\x25\x52\x69\x63\x68\x14\x39\xcc\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "73958";
+set compile_time   "21 Jul 2023 12:15:13";
+set entry_point    "5712";
+set name           "umppc.dll";
+set rich_header    "\xbe\x81\x57\xa3\xfa\xe0\x39\xf0\xfa\xe0\x39\xf0\xfa\xe0\x39\xf0\x23\x94\x3a\xf1\xfb\xe0\x39\xf0\x23\x94\x31\xf1\xf7\xe0\x39\xf0\x29\x92\x3a\xf1\xf9\xe0\x39\xf0\x29\x92\x3d\xf1\xfc\xe0\x39\xf0\x29\x92\x38\xf1\xf9\xe0\x39\xf0\xfa\xe0\x38\xf0\xc0\xe0\x39\xf0\x23\x94\x39\xf1\xfb\xe0\x39\xf0\x23\x94\xc6\xf0\xfb\xe0\x39\xf0\x23\x94\x3b\xf1\xfb\xe0\x39\xf0\x52\x69\x63\x68\xfa\xe0\x39\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, ` 
+set checksum       "715814";
+set compile_time   "14 Oct 2021 19:50:52";
+set entry_point    "78800";
+set image_size_x86 "704512";
+set image_size_x64 "704512";
+set name           "CylanceMemDef64.dll";
+set rich_header    "\xd7\xf6\x0c\x93\x93\x97\x62\xc0\x93\x97\x62\xc0\x93\x97\x62\xc0\x6f\xe0\xdc\xc0\x91\x97\x62\xc0\x6f\xe0\xde\xc0\x97\x97\x62\xc0\x6f\xe0\xdb\xc0\x90\x97\x62\xc0\x93\x97\x63\xc0\xeb\x97\x62\xc0\xb0\x78\xb0\xc0\xd6\x97\x62\xc0\xb4\x51\xaf\xc0\x91\x97\x62\xc0\xf5\x79\xa8\xc0\x92\x97\x62\xc0\xb4\x51\xab\xc0\x92\x97\x62\xc0\x93\x97\xf5\xc0\x92\x97\x62\xc0\xf5\x79\xae\xc0\x92\x97\x62\xc0\x52\x69\x63\x68\x93\x97\x62\xc0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";	
+`,
 }

 var Useragent_list = []string{
@@ -1279,6 +1272,11 @@ set sleeptime "{{.Variables.sleep}}";
 set jitter    "{{.Variables.jitter}}";
 set useragent "{{.Variables.useragent}}";

+http-beacon {
+    set library "{{.Variables.httplib}}";
+}
+
+
 # Task and Proxy Max Size
 set tasks_max_size "{{.Variables.tasks_max_size}}";
 set tasks_proxy_max_size "{{.Variables.tasks_proxy_max_size}}";
@@ -1324,7 +1322,12 @@ stage {
 	set cleanup "true";
 	set userwx "false";
 	set smartinject "true";
-	
+
+	set syscall_method "{{.Variables.syscall_method}}"; #### needs a varible
+	###will change down the road but 32-bit shouldn't be used that much
+	set magic_mz_x86 "MZRE";
+	set magic_mz_x64 "{{.Variables.magic_mz_x64}}";
+	set magic_pe "{{.Variables.magic_pe}}";

 	#TCP and SMB beacons will obfuscate themselves while they wait for a new connection.
 	#They will also obfuscate themselves while they wait to read information from their parent Beacon.
@@ -1333,7 +1336,7 @@ stage {
 }
 func Beacon_Stage_p2_Stuct() string {
 	return `
-{{.Variables.pe}}
+	{{.Variables.pe}}
 	`
 }
 func Beacon_GETPOST_Profile_Struct() string {
@@ -1356,7 +1359,6 @@ func Beacon_Stage_Struct_p3() string {
 		strrep "ReflectiveLoader" "";
 		strrep "This program cannot be run in DOS mode" "";
 		strrep "NtQueueApcThread" "";
-		strrep "HTTP/1.1 200 OK" "";
 		strrep "Stack memory was corrupted" "";
 		strrep "beacon.dll" "";
 		strrep "ADVAPI32.dll" "";
@@ -1445,6 +1447,11 @@ func Beacon_Stage_Struct_p3() string {
 		strrep "Wow64DisableWow64FsRedirection" "";
 		strrep "Wow64RevertWow64FsRedirection" "";
 		strrep "Kerberos" "";
+		strrep "msvcrt.dll" "";
+		strrep "C:\\Windows\\System32\\msvcrt.dll" "";
+		strrep "Stack around the variable" "";
+		strrep "' was corrupted." "" ;
+		strrep "The value of ESP was not properly saved across a function call.  This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention." "";

 		}

@@ -1454,7 +1461,6 @@ func Beacon_Stage_Struct_p3() string {
 		strrep "This program cannot be run in DOS mode" "";
 		strrep "beacon.x64.dll" "";
 		strrep "NtQueueApcThread" "";
-		strrep "HTTP/1.1 200 OK" "";
 		strrep "Stack memory was corrupted" "";
 		strrep "beacon.dll" "";
 		strrep "ADVAPI32.dll" "";
@@ -1482,8 +1488,6 @@ func Beacon_Stage_Struct_p3() string {
 		strrep "CloseThreadpoolTimer" "";
 		strrep "CreateThreadpoolWait" "";
 		strrep "SetThreadpoolWait" "";
-		strrep "CloseThreadpoolWait" "";
-		strrep "FlushProcessWriteBuffers" "";
 		strrep "FreeLibraryWhenCallbackReturns" "";
 		strrep "GetCurrentProcessorNumber" "";
 		strrep "GetLogicalProcessorInformation" "";
@@ -1543,6 +1547,12 @@ func Beacon_Stage_Struct_p3() string {
 		strrep "Wow64DisableWow64FsRedirection" "";
 		strrep "Wow64RevertWow64FsRedirection" "";
 		strrep "Kerberos" "";
+		strrep "msvcrt.dll" "";
+		strrep "C:\\Windows\\System32\\msvcrt.dll" "";
+		strrep "Stack around the variable" "";
+		strrep "' was corrupted." "" ;
+		strrep "The value of ESP was not properly saved across a function call.  This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention." "";
+
 		}
 }
 `
@@ -1558,7 +1568,7 @@ process-inject {
    set min_alloc "{{.Variables.processinject_min_alloc}}";
    set userwx    "false";
    set startrwx "true";
-
+	
    transform-x86 {
        prepend "\x90\x90\x90\x90\x90\x90\x90\x90\x90"; # NOP, NOP!
    }
@@ -1584,17 +1594,25 @@ func Beacon_PostEX_Struct() string {
 post-ex {
    # control the temporary process we spawn to
 	{{.Variables.Post_EX_Process_Name}}
+
    # change the permissions and content of our post-ex DLLs
    set obfuscate "true";
- 
+
+	# Allows multi-threaded post-ex DLLs to spawn threads with a spoofed start address
+	{{.Variables.thread_hint}}
+
    # pass key function pointers from Beacon to its child jobs
    set smartinject "true";
 
    # disable AMSI in powerpick, execute-assembly, and psinject
-    set amsi_disable "true";
+    set amsi_disable "false";
+	# do not enable this unless needed. Disabling AMSI is an IOC
 	
 	# control the method used to log keystrokes 
 	set keylogger "{{.Variables.Keylogger}}";
+
+	# cleanup the post-ex UDRL memory when the post-ex DLL is loaded 
+	set cleanup "true";
 }
 `
 }
@@ -1,7 +1,7 @@
 package Utils

 import (
-	"io/ioutil"
+	"fmt"
 	"log"
 	"math/rand"
 	"os"
@@ -14,6 +14,7 @@ const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
 const numbers = "1234567890"
 const capital = "ABCDEF"
 const alpha = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-"
+const alphanum = "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
 const lowercasealpha = "abcdefghijklmnopqrstuvwxyz"

 func check(e error) {
@@ -23,7 +24,7 @@ func check(e error) {
 }

 func Readfile(inputFile string) string {
-	output, err := ioutil.ReadFile(inputFile)
+	output, err := os.ReadFile(inputFile)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -86,6 +87,23 @@ func GenerateValue(min, max int) string {
 	return string(b)
 }

+func GenerateSingleValue(num int) string {
+	n := num
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = alphanum[rand.Intn(len(alpha))]
+	}
+	return string(b)
+}
+
+func GenHex() string {
+	rand.Seed(time.Now().UnixNano())
+
+	// Generate a random number and convert it to a hexadecimal string
+	hexString := fmt.Sprintf("%x", rand.Intn(4096)) // 4096 is 16^3, ensuring up to 3 hex characters
+	return hexString
+}
+
 func GenerateURIValues(numb int, profile_type int, Post bool, customuri string) string {
 	var uri string
 	var baseuri string