-
-
+
```
go install github.com/Tylous/SourcePoint
@@ -40,17 +40,21 @@ Usage of ./SourcePoint:
-CDN-Value string
CDN cookie value (typically used for AzureEdge profiles)
-Customuri string
- The base URI for custom HTTP GET/POST profile (default "0") - Cannot be used with CustomuriGET or CustomuriPOST
+ The base URI for custom HTTP GET/POST profile - Cannot be used with CustomuriGET or CustomuriPOST
-CustomuriGET string
- The base URI for custom HTTP GET profile (default "0") - Must be used with CustomuriPOST
+ The base URI for custom HTTP GET profile - Must be used with CustomuriPOST
-CustomuriPOST string
- The base URI for custom HTTP POST profile (default "0") - Must be used with CustomuriGET
+ The base URI for custom HTTP POST profile - Must be used with CustomuriGET
-Datajitter string
Appends a value to HTTP-Get and HTTP-Post server output (default "50")
-Forwarder
Enabled the X-forwarded-For header (Good for when your C2 is behind a redirector)
-Host string
Team server domain name
+ -Httplib string
+ Select the default HTTP Beacon library:
+ [*] wininet
+ [*] winhttp' (default "winhttp")
-Injector string
Select the preferred method to allocate memory in the remote process:
[*] VirtualAllocEx (Great for cross architecture i.e x86 -> x64 and x64->x86)
@@ -73,36 +77,36 @@ Usage of ./SourcePoint:
Name of output file
-PE_Clone string
PE file beacon will mimic (Use the number):
- [1] srv.dll
- [2] ActivationManager.dll
- [3] audioeng.dll
- [4] AzureSettingSyncProvider.dll
- [5] BingMaps.dll
- [6] BootMenuUX.dll
- [7] DIAGCPL.dll
+ [1] ActivationManager.dll
+ [2] audioeng.dll
+ [3] AzureSettingSyncProvider.dll
+ [4] BingMaps.dll
+ [5] DIAGCPL.dll
+ [6] EDGEHTML.dll
+ [7] FILEMGMT.dll
[8] FIREWALLCONTROLPANEL.dll
- [9] WMNetMgr.dll
- [10] wwanapi.dll
- [11] Windows.Storage.Search.dll
- [12] Windows.System.Diagnostics.dll
- [13] Windows.System.Launcher.dll
- [14] Windows.System.SystemManagement.dll
- [15] Windows.UI.BioFeedback.dll
- [16] Windows.UI.BlockedShutdown.dll
- [17] Windows.UI.Core.TextInput.dll
- [18] FILEMGMT.dll
- [19] polprocl.dll
- [20] GPSVC.dll
- [21] libcrypto.dll
- [22] rdpcomapi.dll
- [23] winsqlite3.dll
- [24] wow64.dll
+ [9] GPSVC.dll
+ [10] gpupvdev.dll
+ [11] libcrypto.dll
+ [12] srvcli.dll
+ [13] srvsvc.dll
+ [14] Windows.Storage.Search.dll
+ [15] Windows.System.Diagnostics.dll
+ [16] Windows.System.Launcher.dll
+ [17] Windows.System.SystemManagement.dll
+ [18] Windows.UI.BioFeedback.dll
+ [19] Windows.UI.BlockedShutdown.dll
+ [20] Windows.UI.Core.TextInput.DLL
+ [21] winsqlite3.dll
+ [22] WMNetMgr.DLL
+ [23] wwanapi.dll
+ [24] WWANSVC.DLL
[25] wow64win.dll
- [26] WWANSVC.dll
- [27] CyMemDef64.dll (Cylance's DLL)
+ [26] wow64.dll
+ [27] ctiuser.dll (Carbon Black's DLL)
[28] InProcessClient.dll (SentinelOne's DLL)
- [29] ctiuser.dll (Carbon Black's DLL)
- [30] umppc.dll (CrowdStrike's DLL)
+ [29] umppc.dll (CrowdStrike's DLL)
+ [30] CyMemDef64.dll (Cylance's DLL)
-Password string
SSL certificate password
-PostEX_Name string
@@ -140,7 +144,20 @@ Usage of ./SourcePoint:
-Sleep string
Initial beacon sleep time
-Stage string
- Disable host staging (Default: False) (default "False")
+ Disable host staging (Default: False) (default "false")
+ -Syscall string
+ Defines the ability to use direct/indirect system calls instead of the standard Windows API functions calls:
+ [*] None
+ [*] Direct
+ [*] Indirect (default "None")
+ -TasksDnsProxyMaxSize string
+ The maximum size (in bytes) of proxy data to transfer via the DNS communication channel at a check in
+ -TasksMaxSize string
+ The maximum size (in bytes) of task(s) and proxy data that can be transferred through a communication channel at a check in
+ -TasksProxyMaxSize string
+ The maximum size (in bytes) of proxy data to transfer via the communication channel at a check in
+ -ThreadSpoof
+ Sets post-ex DLLs to spawn threads with a spoofed start address. These are generated randomly (default true)
-Uri string
The number URIs a profile for beacons to choose from
-Useragent string
@@ -152,13 +169,6 @@ Usage of ./SourcePoint:
[*] Win6.3
[*] Linux
[*] Mac
- [*] Custom - Whatever string you specify will be used as the user agent
- -TasksMaxSize string
- The maximum size (in bytes) of task(s) and proxy data that can be transferred through a communication channel at a check in
- -TasksProxyMaxSize string
- The maximum size (in bytes) of proxy data to transfer via the communication channel at a check in.
- -TasksDnsProxyMaxSize string
- The maximum size (in bytes) of proxy data to transfer via the DNS communication channel at a check in.
-Yaml string
Path to the Yaml config file
```
@@ -186,6 +196,7 @@ This part of your profile modifies how the beacon operators. Some of the feature
* TCP Frame Header - Adds a header value to the TCP beacon messages
* SSH Banner - The SSH banner used
* SSH Pipename - The name used for the SSH banner
+* HttpLib - The library attribute allows the user to specify the default library used by the generated beacons used by the profile. The value can be "wininet" or "winhttp"
### Stage
This part of your profile controls how beacon is loaded into memory and edit the content of the beacon DLL. Some of the features used to modify the behaviour are:
@@ -194,10 +205,14 @@ This part of your profile controls how beacon is loaded into memory and edit the
* Stomppe - Asks the payload to stomp MZ, PE and, e_lfanen values after loading
* Clean up - Tells the beacon to free up memory assoicated with the refelctive DLL that initalized it
* UseRWX - Ensures shellcode does not use Read, Write Execute permissions
+* Magic_MZ - Overrides the first bytes (MZ header included) of Beacon's Reflective DLL (currently only for x64)
+* Magic_PE - Overrides the PE character marker used by Beacon's Reflective Loader with another value
+* Syscall - Defines the ability to use system calls instead of the standard Windows API functions
* Smart Inject - Uses embedded function pointer hints to bootstrap the beacon agent without walking kernel32 EAT
* Sleep Mask - TCP and SMB beacons will obfuscate themselves at rest while they wait for the connection to be established
* PE Header - Changes the characteristics of your beacon Reflective DLL to look like something else in memory
-* Transformation - Transform beacon's Reflective DLL stage by removing or adding strings to the .rdata section
+* Transformation - Transform beacon's Reflective DLL stage by removing or adding strings to the .rdata
+
### Process-Inject
This part of your profile controls how the beacon shapes injected content and controls process injection behavior. Some of the features used to modify the behaviour are:
@@ -217,6 +232,8 @@ This part of your profile controls how the beacon handles post-exploitation modu
* Smart Inject - Pass key function pointers from beacon to its child jobs
* AMSI disable - Disable AMSI for powerpick, execute-assembly, and psinject (Certain EDRs can detect this best avoid using these tools)
* Keylogger - Determines how the keystroker logging API use to capture keystrokes
+* Cleanup - Cleanups the post-ex User Defined Reflective DLL ("UDRL") memory when the post-ex DLL is loaded
+* Threadhint - Allows post-ex DLLs to spawn threads with a spoofed start address
### Profiles
@@ -238,6 +255,11 @@ The last option (8) is designed to input a custom profile. This option is design
To do so, use the following options `-Customuri` and `-ProfilePath` along with `-Profile 8`. To use a different URI base for GET and POST, `-CustomuriGET` and `-CustomuriPOST` should be used in place of `-Customuri`. While developing a profile, it’s highly recommended to use the native ./c2lint to verify everything is working.
+## Sample Example
+By combining these options into one profile you can create a highly effective beacon that can circumvent preventive and detective controls. While this remains an evolving cat-and-mouse game, combining the right options against a specific security stack can be quite effective.
+
+
+
## Sample Yaml Configs
@@ -264,7 +286,16 @@ Customuri:
CDN:
CDN_Value:
ProfilePath:
+Syscall_method:
+Httplib:
+ThreadSpoof: true
+Customuri:
+CustomuriGET:
+CustomuriPOST:
Forwarder: False
+TasksMaxSize:
+TasksProxyMaxSize:
+TasksDnsProxyMaxSize:
```
diff --git a/Sample.yaml b/Sample.yaml
index 3ab46f4..c82e4e4 100644
--- a/Sample.yaml
+++ b/Sample.yaml
@@ -20,6 +20,9 @@ Customuri:
CDN:
CDN_Value:
ProfilePath:
+Syscall_method:
+Httplib:
+ThreadSpoof: True
Customuri:
CustomuriGET:
CustomuriPOST:
diff --git a/Screenshots/C2int_p2.png b/Screenshots/C2int_p2.png
index 52d91b5..73bb730 100644
Binary files a/Screenshots/C2int_p2.png and b/Screenshots/C2int_p2.png differ
diff --git a/Screenshots/MDE_Example.png b/Screenshots/MDE_Example.png
new file mode 100644
index 0000000..00804a8
Binary files /dev/null and b/Screenshots/MDE_Example.png differ
diff --git a/SourcePoint.go b/SourcePoint.go
index e7bfe90..43cc544 100644
--- a/SourcePoint.go
+++ b/SourcePoint.go
@@ -39,6 +39,9 @@ type FlagOptions struct {
tasks_max_size string
tasks_proxy_max_size string
tasks_dns_proxy_max_size string
+ syscall_method string
+ httplib string
+ threadspoof bool
Yaml string
}
@@ -71,6 +74,9 @@ type conf struct {
TasksMaxSize string `yaml:"TasksMaxSize"`
TasksProxyMaxSize string `yaml:"TasksProxyMaxSize"`
TasksDnsProxyMaxSize string `yaml:"TasksDnsProxyMaxSize"`
+ Syscall_method string `yaml:"Syscall_method"`
+ Httplib string `yaml:"Httplib"`
+ Threadspoof bool `yaml:"ThreadSpoof"`
}
func (c *conf) getConf(yamlfile string) *conf {
@@ -104,36 +110,36 @@ func options() *FlagOptions {
customuriGET := flag.String("CustomuriGET", "", "The base URI for custom HTTP GET profile - Must be used with CustomuriPOST")
customuriPOST := flag.String("CustomuriPOST", "", "The base URI for custom HTTP POST profile - Must be used with CustomuriGET")
beacon_PE := flag.String("PE_Clone", "", `PE file beacon will mimic (Use the number):
-[1] srv.dll
-[2] ActivationManager.dll
-[3] audioeng.dll
-[4] AzureSettingSyncProvider.dll
-[5] BingMaps.dll
-[6] BootMenuUX.dll
-[7] DIAGCPL.dll
+[1] ActivationManager.dll
+[2] audioeng.dll
+[3] AzureSettingSyncProvider.dll
+[4] BingMaps.dll
+[5] DIAGCPL.dll
+[6] EDGEHTML.dll
+[7] FILEMGMT.dll
[8] FIREWALLCONTROLPANEL.dll
-[9] WMNetMgr.dll
-[10] wwanapi.dll
-[11] Windows.Storage.Search.dll
-[12] Windows.System.Diagnostics.dll
-[13] Windows.System.Launcher.dll
-[14] Windows.System.SystemManagement.dll
-[15] Windows.UI.BioFeedback.dll
-[16] Windows.UI.BlockedShutdown.dll
-[17] Windows.UI.Core.TextInput.dll
-[18] FILEMGMT.dll
-[19] polprocl.dll
-[20] GPSVC.dll
-[21] libcrypto.dll
-[22] rdpcomapi.dll
-[23] winsqlite3.dll
-[24] wow64.dll
+[9] GPSVC.dll
+[10] gpupvdev.dll
+[11] libcrypto.dll
+[12] srvcli.dll
+[13] srvsvc.dll
+[14] Windows.Storage.Search.dll
+[15] Windows.System.Diagnostics.dll
+[16] Windows.System.Launcher.dll
+[17] Windows.System.SystemManagement.dll
+[18] Windows.UI.BioFeedback.dll
+[19] Windows.UI.BlockedShutdown.dll
+[20] Windows.UI.Core.TextInput.DLL
+[21] winsqlite3.dll
+[22] WMNetMgr.DLL
+[23] wwanapi.dll
+[24] WWANSVC.DLL
[25] wow64win.dll
-[26] WWANSVC.dll
-[27] CyMemDef64.dll (Cylance's DLL)
+[26] wow64.dll
+[27] ctiuser.dll (Carbon Black's DLL)
[28] InProcessClient.dll (SentinelOne's DLL)
-[29] ctiuser.dll (Carbon Black's DLL)
-[30] umppc.dll (CrowdStrike's DLL)`)
+[29] umppc.dll (CrowdStrike's DLL)
+[30] CyMemDef64.dll (Cylance's DLL)`)
processinject_min_alloc := flag.String("Allocation", "", "Minimum amount of memory to request for injected content (must be higher than 4096)")
Post_EX_Process_Name := flag.String("PostEX_Name", "", `File Post-Ex activities will spawn and inject into (Use the number):
[1] WerFault.exe
@@ -186,9 +192,17 @@ func options() *FlagOptions {
tasks_max_size := flag.String("TasksMaxSize", "", "The maximum size (in bytes) of task(s) and proxy data that can be transferred through a communication channel at a check in")
tasks_proxy_max_size := flag.String("TasksProxyMaxSize", "", "The maximum size (in bytes) of proxy data to transfer via the communication channel at a check in")
tasks_dns_proxy_max_size := flag.String("TasksDnsProxyMaxSize", "", "The maximum size (in bytes) of proxy data to transfer via the DNS communication channel at a check in")
+ syscall_method := flag.String("Syscall", "None", `Defines the ability to use direct/indirect system calls instead of the standard Windows API functions calls:
+[*] None
+[*] Direct
+[*] Indirect`)
+ httplib := flag.String("Httplib", "winhttp", `Select the default HTTP Beacon library:
+[*] wininet
+[*] winhttp'`)
+ threadspoof := flag.Bool("ThreadSpoof", true, "Sets post-ex DLLs to spawn threads with a spoofed start address. These are generated randomly")
Yaml := flag.String("Yaml", "", "Path to the Yaml config file")
flag.Parse()
- return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, customuriGET: *customuriGET, customuriPOST: *customuriPOST, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder, tasks_max_size: *tasks_max_size, tasks_proxy_max_size: *tasks_proxy_max_size, tasks_dns_proxy_max_size: *tasks_dns_proxy_max_size}
+ return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, customuriGET: *customuriGET, customuriPOST: *customuriPOST, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder, tasks_max_size: *tasks_max_size, tasks_proxy_max_size: *tasks_proxy_max_size, tasks_dns_proxy_max_size: *tasks_dns_proxy_max_size, syscall_method: *syscall_method, httplib: *httplib, threadspoof: *threadspoof}
}
@@ -235,6 +249,9 @@ func main() {
opt.tasks_max_size = c.TasksMaxSize
opt.tasks_proxy_max_size = c.TasksProxyMaxSize
opt.tasks_dns_proxy_max_size = c.TasksDnsProxyMaxSize
+ opt.syscall_method = c.Syscall_method
+ opt.httplib = c.Httplib
+ opt.threadspoof = c.Threadspoof
}
if opt.outFile == "" {
log.Fatal("Error: Please provide a file name to save the profile into")
@@ -249,5 +266,5 @@ func main() {
log.Fatal("Error: When using CustomuriGET/CustomuriPOST, both must be sepecified")
}
fmt.Println(c.TasksMaxSize)
- Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.customuriGET, opt.customuriPOST, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder, opt.tasks_max_size, opt.tasks_proxy_max_size, opt.tasks_dns_proxy_max_size)
+ Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.customuriGET, opt.customuriPOST, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder, opt.tasks_max_size, opt.tasks_proxy_max_size, opt.tasks_dns_proxy_max_size, opt.syscall_method, opt.httplib, opt.threadspoof)
}
diff --git a/Struct/Struct.go b/Struct/Struct.go
index 5f9a199..9aa33c7 100644
--- a/Struct/Struct.go
+++ b/Struct/Struct.go
@@ -17,21 +17,12 @@ var Post_EX_Process_Name = []string{`
`, `
set spawnto_x86 "%windir%\\syswow64\\WWAHost.exe";
set spawnto_x64 "%windir%\\sysnative\\WWAHost.exe";
-`, `
- set spawnto_x86 "%windir%\\syswow64\\wlanext.exe";
- set spawnto_x64 "%windir%\\sysnative\\wlanext.exe";
-`, `
- set spawnto_x86 "%windir%\\syswow64\\auditpol.exe";
- set spawnto_x64 "%windir%\\sysnative\\auditpol.exe";
-`, `
- set spawnto_x86 "%windir%\\syswow64\\bootcfg.exe";
- set spawnto_x64 "%windir%\\sysnative\\bootcfg.exe";
`, `
set spawnto_x86 "%windir%\\syswow64\\choice.exe";
set spawnto_x64 "%windir%\\sysnative\\choice.exe";
`, `
set spawnto_x86 "%windir%\\syswow64\\bootcfg.exe";
- set spawnto_x64 "%windir%\sysnative\\bootcfg.exe";
+ set spawnto_x64 "%windir%\\sysnative\\bootcfg.exe";
`, `
set spawnto_x86 "%windir%\\syswow64\\dtdump.exe";
set spawnto_x64 "%windir%\\sysnative\\dtdump.exe";
@@ -68,14 +59,42 @@ var Post_EX_Process_Name = []string{`
`}
var Pipename_list = []string{
- "SapIServerPipes-1-5-5-0",
- "epmapper-",
- "atsvc-",
- "plugplay+",
- "srvsvc-1-5-5-0",
- "W32TIME_ALT_",
- "tapsrv_",
- "Printer_Spools_",
+ "SapIServerPipes-1-##",
+ "epmapper-##",
+ "atsvc-##",
+ "plugplay+##",
+ "srvsvc-1-5-5-0_##",
+ "W32TIME_ALT_##",
+ "tapsrv_##",
+ "Printer_Spools_##",
+}
+
+var Thread_list = []string{
+ "ucrtbase.dll!configthreadlocale+0x",
+ "combase.dll!InternalTlsAllocData+0x",
+ "ntdll.dll!TpReleaseCleanupGroupMemembers+0x",
+ "ntdll.dll!ZwWaitForSingleObjectEx+0x",
+ "ntdll.dll!RtlUserThreadStart+0x",
+ "sechost.dll!WaitServiceState+0x",
+ "sechost.dll!StartServiceCtrlDispatcherW+0x",
+ "svchost.exe!WaitServiceState+0x",
+ "kernel32.dll!BaseThreadInitThunk+0x",
+}
+
+var Syscall_Method = []string{
+ "None",
+ "Direct",
+ "Indirect",
+}
+
+var Magic_PE = []string{
+ "AXAP",
+ "AZAR",
+ "A[AS",
+ "A\\AT",
+ "A]AU",
+ "A^AV",
+ "A_AW",
}
var SSH_Banner = []string{
@@ -90,266 +109,240 @@ var SSH_Banner = []string{
}
var Peclone_list = []string{`
- set checksum "0";
- set compile_time "11 Nov 2016 04:08:32";
- set entry_point "650688";
- set image_size_x86 "4661248";
- set image_size_x64 "4661248";
- set name "srv.dll";
- set rich_header "\x3e\x98\xfe\x75\x7a\xf9\x90\x26\x7a\xf9\x90\x26\x7a\xf9\x90\x26\x73\x81\x03\x26\xfc\xf9\x90\x26\x17\xa4\x93\x27\x79\xf9\x90\x26\x7a\xf9\x91\x26\x83\xfd\x90\x26\x17\xa4\x91\x27\x65\xf9\x90\x26\x17\xa4\x95\x27\x77\xf9\x90\x26\x17\xa4\x94\x27\x6c\xf9\x90\x26\x17\xa4\x9e\x27\x56\xf8\x90\x26\x17\xa4\x6f\x26\x7b\xf9\x90\x26\x17\xa4\x92\x27\x7b\xf9\x90\x26\x52\x69\x63\x68\x7a\xf9\x90\x26\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `, `
- set checksum "0";
- set compile_time "09 Jul 1995 05:50:04";
- set entry_point "137648";
- set image_size_x86 "761856";
- set image_size_x64 "761856";
- set name "ActivationManager.dll";
- set rich_header "\x80\x48\xf3\x2d\xc4\x29\x9d\x7e\xc4\x29\x9d\x7e\xc4\x29\x9d\x7e\xcd\x51\x0e\x7e\x6f\x29\x9d\x7e\x9f\x41\x99\x7f\xd0\x29\x9d\x7e\x9f\x41\x9e\x7f\xc7\x29\x9d\x7e\x9f\x41\x98\x7f\xdb\x29\x9d\x7e\xc4\x29\x9c\x7e\x37\x2c\x9d\x7e\x9f\x41\x9c\x7f\xcc\x29\x9d\x7e\x9f\x41\x9d\x7f\xc5\x29\x9d\x7e\x9f\x41\x93\x7f\x97\x29\x9d\x7e\x9f\x41\x60\x7e\xc5\x29\x9d\x7e\x9f\x41\x62\x7e\xc5\x29\x9d\x7e\x9f\x41\x9f\x7f\xc5\x29\x9d\x7e\x52\x69\x63\x68\xc4\x29\x9d\x7e\x00\x00\x00\x00\x00\x00\x00\x00";
+set checksum "717619";
+set compile_time "28 Mar 2101 20:42:06";
+set entry_point "223696";
+set image_size_x86 "679936";
+set image_size_x64 "679936";
+set name "ActivationManager.dll";
+set rich_header "\xa5\xe5\x05\x4a\xe1\x84\x6b\x19\xe1\x84\x6b\x19\xe1\x84\x6b\x19\xe8\xfc\xf8\x19\x4c\x84\x6b\x19\xf5\xef\x68\x18\xe9\x84\x6b\x19\xf5\xef\x6f\x18\xfb\x84\x6b\x19\xe1\x84\x6a\x19\xd1\x82\x6b\x19\xf5\xef\x6a\x18\xe9\x84\x6b\x19\xf5\xef\x6b\x18\xe0\x84\x6b\x19\xf5\xef\x65\x18\xb7\x84\x6b\x19\xf5\xef\x6e\x18\xff\x84\x6b\x19\xf5\xef\x96\x19\xe0\x84\x6b\x19\xf5\xef\x94\x19\xe0\x84\x6b\x19\xf5\xef\x69\x18\xe0\x84\x6b\x19\x52\x69\x63\x68\xe1\x84\x6b\x19\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "1930882";
+set compile_time "08 Aug 1976 22:34:44";
+set entry_point "905152";
+set image_size_x86 "1908736";
+set image_size_x64 "1908736";
+set name "audioeng.dll";
+set rich_header "\x66\x9f\xd4\x63\x22\xfe\xba\x30\x22\xfe\xba\x30\x22\xfe\xba\x30\x36\x95\xb9\x31\x28\xfe\xba\x30\x36\x95\xbe\x31\x2d\xfe\xba\x30\x36\x95\xbb\x31\x26\xfe\xba\x30\x2b\x86\x29\x30\x41\xfe\xba\x30\x22\xfe\xbb\x30\x53\xfb\xba\x30\x36\x95\xba\x31\x23\xfe\xba\x30\x36\x95\xb4\x31\x01\xff\xba\x30\x36\x95\xbf\x31\x3e\xfe\xba\x30\x36\x95\x47\x30\x23\xfe\xba\x30\x36\x95\x45\x30\x23\xfe\xba\x30\x36\x95\xb8\x31\x23\xfe\xba\x30\x52\x69\x63\x68\x22\xfe\xba\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "1309288";
+set compile_time "13 Jun 2029 04:04:37";
+set entry_point "877248";
+set image_size_x86 "1347584";
+set image_size_x64 "1347584";
+set name "AzureSettingSyncProvider.DLL";
+set rich_header "\x49\x0f\xf5\x64\x0d\x6e\x9b\x37\x0d\x6e\x9b\x37\x0d\x6e\x9b\x37\x04\x16\x08\x37\x61\x6e\x9b\x37\x19\x05\x98\x36\x04\x6e\x9b\x37\x0d\x6e\x9a\x37\xaf\x6f\x9b\x37\x19\x05\x9a\x36\x04\x6e\x9b\x37\x19\x05\x9e\x36\x15\x6e\x9b\x37\x19\x05\x9f\x36\x4f\x6e\x9b\x37\x19\x05\x9b\x36\x0c\x6e\x9b\x37\x19\x05\x92\x36\x77\x6e\x9b\x37\x19\x05\x64\x37\x0c\x6e\x9b\x37\x19\x05\x99\x36\x0c\x6e\x9b\x37\x52\x69\x63\x68\x0d\x6e\x9b\x37\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "6985379";
+set compile_time "27 Mar 2094 19:17:55";
+set entry_point "5586624";
+set image_size_x86 "6950912";
+set image_size_x64 "6950912";
+set name "BingMaps.dll";
+set rich_header "\x3b\x53\x7d\x55\x7f\x32\x13\x06\x7f\x32\x13\x06\x7f\x32\x13\x06\x76\x4a\x80\x06\x19\x32\x13\x06\x6b\x59\x10\x07\x73\x32\x13\x06\x6b\x59\x17\x07\x70\x32\x13\x06\x7f\x32\x12\x06\xcd\x37\x13\x06\x6b\x59\x12\x07\x6c\x32\x13\x06\x6b\x59\x13\x07\x7e\x32\x13\x06\x6b\x59\x1a\x07\xc8\x33\x13\x06\x6b\x59\x16\x07\x5e\x32\x13\x06\x6b\x59\xee\x06\x7e\x32\x13\x06\x6b\x59\xec\x06\x7e\x32\x13\x06\x6b\x59\x11\x07\x7e\x32\x13\x06\x52\x69\x63\x68\x7f\x32\x13\x06\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "398105";
+set compile_time "11 Apr 2029 18:35:06";
+set entry_point "264064";
+set compile_time "26 Mar 2011 12:53:09";
+set entry_point "258048";
+set image_size_x86 "1122304";
+set image_size_x64 "1122304";
+set name "DIAGCPL.dll";
+set rich_header "\x52\x82\x23\xb2\x16\xe3\x4d\xe1\x16\xe3\x4d\xe1\x16\xe3\x4d\xe1\x02\x88\x49\xe0\x03\xe3\x4d\xe1\x02\x88\x4e\xe0\x15\xe3\x4d\xe1\x02\x88\x48\xe0\x15\xe3\x4d\xe1\x16\xe3\x4c\xe1\xff\xe2\x4d\xe1\x02\x88\x4c\xe0\x35\xe3\x4d\xe1\x02\x88\x4d\xe0\x17\xe3\x4d\xe1\x02\x88\x45\xe0\x27\xe3\x4d\xe1\x02\x88\xb2\xe1\x17\xe3\x4d\xe1\x02\x88\x4f\xe0\x17\xe3\x4d\xe1\x52\x69\x63\x68\x16\xe3\x4d\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "26291599";
+set compile_time "30 Jun 2071 19:09:00";
+set entry_point "5578048";
+set image_size_x86 "26411008";
+set image_size_x64 "26411008";
+set name "EDGEHTML.dll";
+set rich_header "\x57\xdf\x63\x23\x13\xbe\x0d\x70\x13\xbe\x0d\x70\x13\xbe\x0d\x70\x1a\xc6\x9e\x70\xdb\xbe\x0d\x70\x07\xd5\x0e\x71\x17\xbe\x0d\x70\x13\xbe\x0c\x70\x16\xb9\x0d\x70\x07\xd5\x0c\x71\x1c\xbe\x0d\x70\x07\xd5\x08\x71\x05\xbe\x0d\x70\x07\xd5\x09\x71\x98\xbe\x0d\x70\x07\xd5\x0d\x71\x12\xbe\x0d\x70\x07\xd5\x00\x71\xa8\xb1\x0d\x70\x07\xd5\xf2\x70\x12\xbe\x0d\x70\x07\xd5\x0f\x71\x12\xbe\x0d\x70\x52\x69\x63\x68\x13\xbe\x0d\x70\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "327597";
+set compile_time "08 Oct 2014 07:55:29";
+set entry_point "76608";
+set image_size_x86 "311296";
+set image_size_x64 "311296";
+set name "FILEMGMT.DLL";
+set rich_header "\xc9\x32\x31\x5c\x8d\x53\x5f\x0f\x8d\x53\x5f\x0f\x8d\x53\x5f\x0f\x99\x38\x5c\x0e\x89\x53\x5f\x0f\x99\x38\x5b\x0e\x9e\x53\x5f\x0f\x99\x38\x5e\x0e\x98\x53\x5f\x0f\x8d\x53\x5e\x0f\xbe\x51\x5f\x0f\x99\x38\x5a\x0e\x87\x53\x5f\x0f\x99\x38\x5f\x0e\x8c\x53\x5f\x0f\x99\x38\x51\x0e\xb6\x53\x5f\x0f\x99\x38\xa0\x0f\x8c\x53\x5f\x0f\x99\x38\x5d\x0e\x8c\x53\x5f\x0f\x52\x69\x63\x68\x8d\x53\x5f\x0f\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "323973";
+set compile_time "05 Sep 2093 14:25:32";
+set entry_point "238272";
+set image_size_x86 "327680";
+set image_size_x64 "327680";
+set name "FIREWALLCONTROLPANEL.dll";
+set rich_header "\x62\x54\xcc\x5c\x26\x35\xa2\x0f\x26\x35\xa2\x0f\x26\x35\xa2\x0f\x2f\x4d\x31\x0f\x60\x35\xa2\x0f\x32\x5e\xa1\x0e\x22\x35\xa2\x0f\x32\x5e\xa6\x0e\x31\x35\xa2\x0f\x32\x5e\xa7\x0e\x2f\x35\xa2\x0f\x26\x35\xa3\x0f\x1b\x37\xa2\x0f\x32\x5e\xa3\x0e\x31\x35\xa2\x0f\x32\x5e\xa2\x0e\x27\x35\xa2\x0f\x32\x5e\xab\x0e\x0b\x35\xa2\x0f\x32\x5e\x5d\x0f\x27\x35\xa2\x0f\x32\x5e\xa0\x0e\x27\x35\xa2\x0f\x52\x69\x63\x68\x26\x35\xa2\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "1351672";
+set compile_time "14 Jul 2081 14:16:28";
+set entry_point "160064";
+set image_size_x86 "1368064";
+set image_size_x64 "1368064";
+set name "GPSVC.dll";
+set rich_header "\x49\xf1\x6f\x1f\x0d\x90\x01\x4c\x0d\x90\x01\x4c\x0d\x90\x01\x4c\x04\xe8\x92\x4c\x5b\x90\x01\x4c\x19\xfb\x02\x4d\x0e\x90\x01\x4c\x0d\x90\x00\x4c\xfb\x91\x01\x4c\x19\xfb\x00\x4d\x06\x90\x01\x4c\x19\xfb\x04\x4d\x01\x90\x01\x4c\x19\xfb\x05\x4d\x19\x90\x01\x4c\x19\xfb\x01\x4d\x0c\x90\x01\x4c\x19\xfb\x0c\x4d\x96\x90\x01\x4c\x19\xfb\xfe\x4c\x0c\x90\x01\x4c\x19\xfb\x03\x4d\x0c\x90\x01\x4c\x52\x69\x63\x68\x0d\x90\x01\x4c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "250984";
+set compile_time "11 Feb 2078 05:07:28";
+set entry_point "96336";
+set name "gpupvdev.dll";
+set rich_header "\x71\xf3\x1c\xe1\x35\x92\x72\xb2\x35\x92\x72\xb2\x35\x92\x72\xb2\x21\xf9\x73\xb3\x37\x92\x72\xb2\x3c\xea\xe1\xb2\x02\x92\x72\xb2\x35\x92\x73\xb2\x48\x96\x72\xb2\x21\xf9\x76\xb3\x3c\x92\x72\xb2\x21\xf9\x71\xb3\x36\x92\x72\xb2\x21\xf9\x72\xb3\x34\x92\x72\xb2\x21\xf9\x7a\xb3\x3d\x92\x72\xb2\x21\xf9\x77\xb3\x2b\x92\x72\xb2\x21\xf9\x8f\xb2\x34\x92\x72\xb2\x21\xf9\x8d\xb2\x34\x92\x72\xb2\x21\xf9\x70\xb3\x34\x92\x72\xb2\x52\x69\x63\x68\x35\x92\x72\xb2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "1741697";
+set compile_time "31 Mar 2020 14:08:56";
+set entry_point "948912";
+set image_size_x86 "1716224";
+set image_size_x64 "1716224";
+set name "libcrypto.dll";
+set rich_header "\xf4\x6e\xae\xe7\xb0\x0f\xc0\xb4\xb0\x0f\xc0\xb4\xb0\x0f\xc0\xb4\xd5\x69\xc4\xb5\xba\x0f\xc0\xb4\xd5\x69\xc3\xb5\xb6\x0f\xc0\xb4\xd5\x69\xc5\xb5\x1c\x0f\xc0\xb4\x2e\xaf\x07\xb4\xb7\x0f\xc0\xb4\xe2\x67\xc5\xb5\xae\x0f\xc0\xb4\xe2\x67\xc4\xb5\xbf\x0f\xc0\xb4\xe2\x67\xc3\xb5\xb9\x0f\xc0\xb4\xb9\x77\x53\xb4\x85\x0f\xc0\xb4\xb0\x0f\xc1\xb4\x38\x0f\xc0\xb4\x2b\x66\xc4\xb5\x82\x0d\xc0\xb4\x2b\x66\xc3\xb5\xbf\x0f\xc0\xb4\x2b\x66\xc0\xb5\xb1\x0f\xc0\xb4\x2b\x66\x3f\xb4\xb1\x0f\xc0\xb4\xb0\x0f\x57\xb4\xb1\x0f\xc0\xb4\x2b\x66\xc2\xb5\xb1\x0f\xc0\xb4\x52\x69\x63\x68\xb0\x0f\xc0\xb4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "132564";
+set compile_time "08 Oct 2004 06:45:39";
+set entry_point "19840";
+set name "srvcli.dll";
+set rich_header "\x31\xe1\x11\x7c\x75\x80\x7f\x2f\x75\x80\x7f\x2f\x75\x80\x7f\x2f\x61\xeb\x7e\x2e\x77\x80\x7f\x2f\x7c\xf8\xec\x2f\x58\x80\x7f\x2f\x75\x80\x7e\x2f\xea\x84\x7f\x2f\x61\xeb\x7c\x2e\x74\x80\x7f\x2f\x61\xeb\x7b\x2e\x7f\x80\x7f\x2f\x61\xeb\x7f\x2e\x74\x80\x7f\x2f\x61\xeb\x72\x2e\x58\x80\x7f\x2f\x61\xeb\x7a\x2e\x65\x80\x7f\x2f\x61\xeb\x82\x2f\x74\x80\x7f\x2f\x61\xeb\x80\x2f\x74\x80\x7f\x2f\x61\xeb\x7d\x2e\x74\x80\x7f\x2f\x52\x69\x63\x68\x75\x80\x7f\x2f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "328248";
+set compile_time "26 Jun 2065 19:36:37";
+set entry_point "16240";
+set image_size_x86 "335872";
+set image_size_x64 "335872";
+set name "srvsvc.dll";
+set rich_header "\x05\x47\xfc\xc1\x41\x26\x92\x92\x41\x26\x92\x92\x41\x26\x92\x92\x55\x4d\x93\x93\x45\x26\x92\x92\x48\x5e\x01\x92\x10\x26\x92\x92\x41\x26\x93\x92\x7d\x23\x92\x92\x55\x4d\x96\x93\x4b\x26\x92\x92\x55\x4d\x91\x93\x43\x26\x92\x92\x55\x4d\x92\x93\x40\x26\x92\x92\x55\x4d\x9f\x93\x7d\x26\x92\x92\x55\x4d\x97\x93\x53\x26\x92\x92\x55\x4d\x6f\x92\x40\x26\x92\x92\x55\x4d\x6d\x92\x40\x26\x92\x92\x55\x4d\x90\x93\x40\x26\x92\x92\x52\x69\x63\x68\x41\x26\x92\x92\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "664082";
+set compile_time "15 May 2075 06:23:45";
+set entry_point "187552";
+set image_size_x86 "643072";
+set image_size_x64 "643072";
+set name "Windows.Storage.Search.dll";
+set rich_header "\x70\xb5\x96\x9c\x34\xd4\xf8\xcf\x34\xd4\xf8\xcf\x34\xd4\xf8\xcf\x3d\xac\x6b\xcf\x40\xd4\xf8\xcf\x20\xbf\x05\xcf\x23\xd4\xf8\xcf\x20\xbf\xfc\xce\x2f\xd4\xf8\xcf\x20\xbf\xfd\xce\x36\xd4\xf8\xcf\x34\xd4\xf9\xcf\x66\xd6\xf8\xcf\x20\xbf\xf9\xce\x3d\xd4\xf8\xcf\x20\xbf\xfb\xce\x33\xd4\xf8\xcf\x20\xbf\xf8\xce\x35\xd4\xf8\xcf\x20\xbf\xf6\xce\x5c\xd4\xf8\xcf\x20\xbf\x07\xcf\x35\xd4\xf8\xcf\x20\xbf\xfa\xce\x35\xd4\xf8\xcf\x52\x69\x63\x68\x34\xd4\xf8\xcf\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "299753";
+set compile_time "24 Jun 1984 09:44:59";
+set entry_point "244672";
+set image_size_x86 "315392";
+set image_size_x64 "315392";
+set name "Windows.System.Diagnostics.dll";
+set rich_header "\x2e\x58\xbc\xf0\x6a\x39\xd2\xa3\x6a\x39\xd2\xa3\x6a\x39\xd2\xa3\x63\x41\x41\xa3\x03\x39\xd2\xa3\x7e\x52\xd1\xa2\x69\x39\xd2\xa3\x7e\x52\xd6\xa2\x65\x39\xd2\xa3\x6a\x39\xd3\xa3\x3b\x3c\xd2\xa3\x7e\x52\xd3\xa2\x62\x39\xd2\xa3\x7e\x52\xd2\xa2\x6b\x39\xd2\xa3\x7e\x52\xdb\xa2\x47\x39\xd2\xa3\x7e\x52\xd7\xa2\x77\x39\xd2\xa3\x7e\x52\x2f\xa3\x6b\x39\xd2\xa3\x7e\x52\x2d\xa3\x6b\x39\xd2\xa3\x7e\x52\xd0\xa2\x6b\x39\xd2\xa3\x52\x69\x63\x68\x6a\x39\xd2\xa3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "809225";
+set compile_time "27 Jul 2082 08:34:13";
+set entry_point "519664";
+set image_size_x86 "774144";
+set image_size_x64 "774144";
+set name "Windows.System.Launcher.dll";
+set rich_header "\xdf\xfc\x35\x37\x9b\x9d\x5b\x64\x9b\x9d\x5b\x64\x9b\x9d\x5b\x64\x92\xe5\xc8\x64\xeb\x9d\x5b\x64\x8f\xf6\x58\x65\x98\x9d\x5b\x64\x8f\xf6\x5f\x65\x89\x9d\x5b\x64\x9b\x9d\x5a\x64\xb8\x9c\x5b\x64\x8f\xf6\x5a\x65\x92\x9d\x5b\x64\x8f\xf6\x5e\x65\x97\x9d\x5b\x64\x8f\xf6\x5b\x65\x9a\x9d\x5b\x64\x8f\xf6\x53\x65\x81\x9d\x5b\x64\x8f\xf6\xa4\x64\x9a\x9d\x5b\x64\x8f\xf6\x59\x65\x9a\x9d\x5b\x64\x52\x69\x63\x68\x9b\x9d\x5b\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+
+set checksum "263876";
+set compile_time "21 Jul 2003 14:15:10";
+set entry_point "179728";
+set name "Windows.System.SystemManagement.dll";
+set rich_header "\xab\xb4\x71\xb4\xef\xd5\x1f\xe7\xef\xd5\x1f\xe7\xef\xd5\x1f\xe7\xe6\xad\x8c\xe7\x9e\xd5\x1f\xe7\xfb\xbe\x1c\xe6\xe9\xd5\x1f\xe7\xfb\xbe\x1b\xe6\xe1\xd5\x1f\xe7\xef\xd5\x1e\xe7\x8c\xd0\x1f\xe7\xfb\xbe\x1e\xe6\xe7\xd5\x1f\xe7\xfb\xbe\x1f\xe6\xee\xd5\x1f\xe7\xfb\xbe\x16\xe6\xc7\xd5\x1f\xe7\xfb\xbe\x1a\xe6\xf1\xd5\x1f\xe7\xfb\xbe\xe2\xe7\xee\xd5\x1f\xe7\xfb\xbe\xe0\xe7\xee\xd5\x1f\xe7\xfb\xbe\x1d\xe6\xee\xd5\x1f\xe7\x52\x69\x63\x68\xef\xd5\x1f\xe7\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "393009";
+set compile_time "04 Jan 2037 11:02:03";
+set entry_point "237072";
+set image_size_x86 "380928";
+set image_size_x64 "380928";
+set name "Windows.UI.BioFeedback.dll";
+set rich_header "\xc9\x8a\xc6\x41\x8d\xeb\xa8\x12\x8d\xeb\xa8\x12\x8d\xeb\xa8\x12\x84\x93\x3b\x12\xb5\xeb\xa8\x12\x99\x80\xab\x13\x8e\xeb\xa8\x12\x99\x80\xac\x13\x87\xeb\xa8\x12\x8d\xeb\xa9\x12\x63\xef\xa8\x12\x99\x80\xa9\x13\x8a\xeb\xa8\x12\x99\x80\xa8\x13\x8c\xeb\xa8\x12\x99\x80\xa1\x13\x81\xeb\xa8\x12\x99\x80\xad\x13\xae\xeb\xa8\x12\x99\x80\x55\x12\x8c\xeb\xa8\x12\x99\x80\x57\x12\x8c\xeb\xa8\x12\x99\x80\xaa\x13\x8c\xeb\xa8\x12\x52\x69\x63\x68\x8d\xeb\xa8\x12\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "442600";
+set compile_time "05 Aug 2033 07:05:57";
+set entry_point "259936";
+set image_size_x86 "434176";
+set image_size_x64 "434176";
+set name "Windows.UI.BlockedShutdown.dll";
+set rich_header "\xec\x0c\xe9\x21\xa8\x6d\x87\x72\xa8\x6d\x87\x72\xa8\x6d\x87\x72\xa1\x15\x14\x72\x94\x6d\x87\x72\xbc\x06\x84\x73\xab\x6d\x87\x72\xbc\x06\x83\x73\xa2\x6d\x87\x72\xa8\x6d\x86\x72\x8a\x68\x87\x72\xbc\x06\x86\x73\xa1\x6d\x87\x72\xbc\x06\x87\x73\xa9\x6d\x87\x72\xbc\x06\x8e\x73\xa5\x6d\x87\x72\xbc\x06\x82\x73\x8b\x6d\x87\x72\xbc\x06\x7a\x72\xa9\x6d\x87\x72\xbc\x06\x78\x72\xa9\x6d\x87\x72\xbc\x06\x85\x73\xa9\x6d\x87\x72\x52\x69\x63\x68\xa8\x6d\x87\x72\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "733746";
+set compile_time "01 Jul 2091 22:01:31";
+set entry_point "610752";
+set image_size_x86 "729088";
+set image_size_x64 "729088";
+set name "Windows.UI.Core.TextInput.DLL";
+set rich_header "\xcf\xa6\x1b\x17\x8b\xc7\x75\x44\x8b\xc7\x75\x44\x8b\xc7\x75\x44\x82\xbf\xe6\x44\xd5\xc7\x75\x44\x9f\xac\x76\x45\x8c\xc7\x75\x44\x9f\xac\x71\x45\x98\xc7\x75\x44\x8b\xc7\x74\x44\x84\xc6\x75\x44\x9f\xac\x74\x45\x80\xc7\x75\x44\x9f\xac\x70\x45\x85\xc7\x75\x44\x9f\xac\x75\x45\x8a\xc7\x75\x44\x9f\xac\x7c\x45\xc4\xc7\x75\x44\x9f\xac\x8a\x44\x8a\xc7\x75\x44\x9f\xac\x77\x45\x8a\xc7\x75\x44\x52\x69\x63\x68\x8b\xc7\x75\x44\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "926377";
+set compile_time "10 Jul 2019 14:32:11";
+set entry_point "672064";
+set image_size_x86 "897024";
+set image_size_x64 "897024";
+set name "winsqlite3.dll";
+set rich_header "\x86\xdf\xa4\x64\xc2\xbe\xca\x37\xc2\xbe\xca\x37\xc2\xbe\xca\x37\xf9\xe0\xc9\x36\xc4\xbe\xca\x37\xf9\xe0\xcf\x36\xd4\xbe\xca\x37\xf9\xe0\xce\x36\xcc\xbe\xca\x37\xcb\xc6\x59\x37\xf1\xbe\xca\x37\xc2\xbe\xcb\x37\xba\xbe\xca\x37\x55\xe0\xce\x36\xc3\xbe\xca\x37\x55\xe0\xca\x36\xc3\xbe\xca\x37\x50\xe0\x35\x37\xc3\xbe\xca\x37\x55\xe0\xc8\x36\xc3\xbe\xca\x37\x52\x69\x63\x68\xc2\xbe\xca\x37\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "1134746";
+set compile_time "26 Jun 2021 18:31:54";
+set entry_point "244784";
+set image_size_x86 "1224704";
+set image_size_x64 "1224704";
+set name "WMNetMgr.DLL";
+set rich_header "\x99\xde\x8b\xfc\xdd\xbf\xe5\xaf\xdd\xbf\xe5\xaf\xdd\xbf\xe5\xaf\xc9\xd4\xe6\xae\xd6\xbf\xe5\xaf\xc9\xd4\xe1\xae\xcb\xbf\xe5\xaf\xdd\xbf\xe4\xaf\xa2\xbe\xe5\xaf\xc9\xd4\xe4\xae\xd0\xbf\xe5\xaf\xc9\xd4\xe0\xae\xd5\xbf\xe5\xaf\xc9\xd4\xe5\xae\xdc\xbf\xe5\xaf\xc9\xd4\xeb\xae\x15\xbf\xe5\xaf\xc9\xd4\x1a\xaf\xdc\xbf\xe5\xaf\xc9\xd4\xe7\xae\xdc\xbf\xe5\xaf\x52\x69\x63\x68\xdd\xbf\xe5\xaf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "475685";
+set compile_time "10 Nov 2015 18:25:50";
+set entry_point "50064";
+set image_size_x86 "471040";
+set image_size_x64 "471040";
+set name "wwanapi.dll";
+set rich_header "\x8b\x47\x1f\x57\xcf\x26\x71\x04\xcf\x26\x71\x04\xcf\x26\x71\x04\xc6\x5e\xe2\x04\x89\x26\x71\x04\xdb\x4d\x72\x05\xca\x26\x71\x04\xdb\x4d\x75\x05\xdb\x26\x71\x04\xcf\x26\x70\x04\x09\x26\x71\x04\xdb\x4d\x70\x05\xca\x26\x71\x04\xdb\x4d\x74\x05\xc3\x26\x71\x04\xdb\x4d\x71\x05\xce\x26\x71\x04\xdb\x4d\x7f\x05\xac\x26\x71\x04\xdb\x4d\x8e\x04\xce\x26\x71\x04\xdb\x4d\x73\x05\xce\x26\x71\x04\x52\x69\x63\x68\xcf\x26\x71\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "1540872";
+set compile_time "23 May 2072 01:26:12";
+set entry_point "887952";
+set image_size_x86 "1544192";
+set image_size_x64 "1544192";
+set name "WWANSVC.DLL";
+set rich_header "\xec\xba\xa6\xda\xa8\xdb\xc8\x89\xa8\xdb\xc8\x89\xa8\xdb\xc8\x89\xa1\xa3\x5b\x89\x2c\xdb\xc8\x89\xbc\xb0\xcc\x88\xa7\xdb\xc8\x89\xbc\xb0\xcb\x88\xab\xdb\xc8\x89\xa8\xdb\xc9\x89\x78\xde\xc8\x89\xbc\xb0\xc9\x88\xa5\xdb\xc8\x89\xbc\xb0\xc8\x88\xa9\xdb\xc8\x89\xbc\xb0\xc0\x88\x2f\xdb\xc8\x89\xbc\xb0\xcd\x88\x88\xdb\xc8\x89\xbc\xb0\x35\x89\xa9\xdb\xc8\x89\xbc\xb0\x37\x89\xa9\xdb\xc8\x89\xbc\xb0\xca\x88\xa9\xdb\xc8\x89\x52\x69\x63\x68\xa8\xdb\xc8\x89\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
`, `
- set checksum "0";
- set compile_time "30 Apr 2074 10:15:36";
- set entry_point "148048";
- set image_size_x86 "2142208";
- set image_size_x64 "2142208";
- set name "audioeng.dll";
- set rich_header "\x4a\xed\xf6\x67\x0e\x8c\x98\x34\x0e\x8c\x98\x34\x0e\x8c\x98\x34\x55\xe4\x9c\x35\x02\x8c\x98\x34\x55\xe4\x9b\x35\x0d\x8c\x98\x34\x55\xe4\x9d\x35\x12\x8c\x98\x34\x55\xe4\x99\x35\x0a\x8c\x98\x34\x07\xf4\x0b\x34\x6d\x8c\x98\x34\x0e\x8c\x99\x34\x41\x89\x98\x34\x55\xe4\x98\x35\x0f\x8c\x98\x34\x55\xe4\x96\x35\x2a\x8d\x98\x34\x55\xe4\x65\x34\x0f\x8c\x98\x34\x55\xe4\x67\x34\x0f\x8c\x98\x34\x55\xe4\x9a\x35\x0f\x8c\x98\x34\x52\x69\x63\x68\x0e\x8c\x98\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "26 Jan 2091 14:16:43";
- set entry_point "1064336";
- set image_size_x86 "1966080";
- set image_size_x64 "1966080";
- set name "AzureSettingSyncProvider.DLL";
- set rich_header "\x44\xba\xe1\x13\x00\xdb\x8f\x40\x00\xdb\x8f\x40\x00\xdb\x8f\x40\x09\xa3\x1c\x40\x6e\xdb\x8f\x40\x5b\xb3\x8c\x41\x03\xdb\x8f\x40\x00\xdb\x8e\x40\xa6\xda\x8f\x40\x5b\xb3\x8e\x41\x09\xdb\x8f\x40\x5b\xb3\x8a\x41\x18\xdb\x8f\x40\x5b\xb3\x8b\x41\x41\xdb\x8f\x40\x5b\xb3\x8f\x41\x01\xdb\x8f\x40\x5b\xb3\x86\x41\x7a\xdb\x8f\x40\x5b\xb3\x70\x40\x01\xdb\x8f\x40\x5b\xb3\x8d\x41\x01\xdb\x8f\x40\x52\x69\x63\x68\x00\xdb\x8f\x40\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "21 Dec 2053 07:47:21";
- set entry_point "5266400";
- set image_size_x86 "9375744";
- set image_size_x64 "9375744";
- set name "BingMaps.dll";
- set rich_header "\xd0\xc8\x67\xde\x94\xa9\x09\x8d\x94\xa9\x09\x8d\x94\xa9\x09\x8d\x9d\xd1\x9a\x8d\xf2\xa9\x09\x8d\xcf\xc1\x0d\x8c\x9f\xa9\x09\x8d\xcf\xc1\x0a\x8c\x97\xa9\x09\x8d\xcf\xc1\x0c\x8c\xb5\xa9\x09\x8d\x94\xa9\x08\x8d\x1a\xac\x09\x8d\xcf\xc1\x08\x8c\x87\xa9\x09\x8d\xcf\xc1\x09\x8c\x95\xa9\x09\x8d\xcf\xc1\x00\x8c\x3e\xa8\x09\x8d\xcf\xc1\xf4\x8d\x96\xa9\x09\x8d\xcf\xc1\xf6\x8d\x95\xa9\x09\x8d\xcf\xc1\x0b\x8c\x95\xa9\x09\x8d\x52\x69\x63\x68\x94\xa9\x09\x8d\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "13 Aug 2104 07:50:19";
- set entry_point "231008";
- set image_size_x86 "339968";
- set image_size_x64 "339968";
- set name "BootMenuUX.dll";
- set rich_header "\x9f\xd8\xba\x57\xdb\xb9\xd4\x04\xdb\xb9\xd4\x04\xdb\xb9\xd4\x04\xd2\xc1\x47\x04\xb5\xb9\xd4\x04\x80\xd1\xd7\x05\xd8\xb9\xd4\x04\x80\xd1\xd0\x05\xd4\xb9\xd4\x04\xdb\xb9\xd5\x04\x6c\xb8\xd4\x04\x80\xd1\xd5\x05\xf8\xb9\xd4\x04\x80\xd1\xd4\x05\xda\xb9\xd4\x04\x80\xd1\xdd\x05\xb2\xb9\xd4\x04\x80\xd1\xd1\x05\xdd\xb9\xd4\x04\x80\xd1\x2b\x04\xda\xb9\xd4\x04\x80\xd1\xd6\x05\xda\xb9\xd4\x04\x52\x69\x63\x68\xdb\xb9\xd4\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "25 Jan 2020 23:17:33";
- set entry_point "217152";
- set image_size_x86 "1077248";
- set image_size_x64 "1077248";
- set name "DIAGCPL.dll";
- set rich_header "\x2d\xf1\x0e\x49\x69\x90\x60\x1a\x69\x90\x60\x1a\x69\x90\x60\x1a\x32\xf8\x64\x1b\x7c\x90\x60\x1a\x32\xf8\x63\x1b\x6a\x90\x60\x1a\x32\xf8\x65\x1b\x6a\x90\x60\x1a\x69\x90\x61\x1a\xba\x91\x60\x1a\x32\xf8\x61\x1b\x4a\x90\x60\x1a\x32\xf8\x60\x1b\x68\x90\x60\x1a\x32\xf8\x69\x1b\x59\x90\x60\x1a\x32\xf8\x9f\x1a\x68\x90\x60\x1a\x32\xf8\x62\x1b\x68\x90\x60\x1a\x52\x69\x63\x68\x69\x90\x60\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "20 Jan 2030 21:55:22";
- set entry_point "216032";
- set image_size_x86 "352256";
- set image_size_x64 "352256";
- set name "FIREWALLCONTROLPANEL.dll";
- set rich_header "\xf9\xc2\xa0\x1b\xbd\xa3\xce\x48\xbd\xa3\xce\x48\xbd\xa3\xce\x48\xb4\xdb\x5d\x48\xf9\xa3\xce\x48\xe6\xcb\xcd\x49\xbe\xa3\xce\x48\xe6\xcb\xca\x49\xab\xa3\xce\x48\xe6\xcb\xcb\x49\xb4\xa3\xce\x48\xbd\xa3\xcf\x48\x84\xa1\xce\x48\xe6\xcb\xcf\x49\xaa\xa3\xce\x48\xe6\xcb\xce\x49\xbc\xa3\xce\x48\xe6\xcb\xc7\x49\x93\xa3\xce\x48\xe6\xcb\x31\x48\xbc\xa3\xce\x48\xe6\xcb\xcc\x49\xbc\xa3\xce\x48\x52\x69\x63\x68\xbd\xa3\xce\x48\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "31 Jul 2090 12:56:16";
- set entry_point "186192";
- set image_size_x86 "1490944";
- set image_size_x64 "1490944";
- set name "WMNetMgr.DLL";
- set rich_header "\x35\xe0\x65\x56\x71\x81\x0b\x05\x71\x81\x0b\x05\x71\x81\x0b\x05\x2a\xe9\x08\x04\x72\x81\x0b\x05\x2a\xe9\x0f\x04\x66\x81\x0b\x05\x71\x81\x0a\x05\xf7\x80\x0b\x05\x2a\xe9\x0a\x04\x7c\x81\x0b\x05\x2a\xe9\x0e\x04\x79\x81\x0b\x05\x2a\xe9\x0b\x04\x70\x81\x0b\x05\x2a\xe9\x05\x04\xb9\x81\x0b\x05\x2a\xe9\xf4\x05\x70\x81\x0b\x05\x2a\xe9\x09\x04\x70\x81\x0b\x05\x52\x69\x63\x68\x71\x81\x0b\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "19 Apr 2070 21:37:24";
- set entry_point "13760";
- set image_size_x86 "548864";
- set image_size_x64 "548864";
- set name "wwanapi.dll";
- set rich_header "\x39\x39\x83\xe8\x7d\x58\xed\xbb\x7d\x58\xed\xbb\x7d\x58\xed\xbb\x74\x20\x7e\xbb\x3b\x58\xed\xbb\x26\x30\xee\xba\x7e\x58\xed\xbb\x26\x30\xe9\xba\x69\x58\xed\xbb\x7d\x58\xec\xbb\xbf\x58\xed\xbb\x26\x30\xec\xba\x78\x58\xed\xbb\x26\x30\xe8\xba\x71\x58\xed\xbb\x26\x30\xed\xba\x7c\x58\xed\xbb\x26\x30\xe3\xba\x1f\x58\xed\xbb\x26\x30\x12\xbb\x7c\x58\xed\xbb\x26\x30\xef\xba\x7c\x58\xed\xbb\x52\x69\x63\x68\x7d\x58\xed\xbb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "17 Nov 2003 16:56:11";
- set entry_point "194608";
- set image_size_x86 "770048";
- set image_size_x64 "770048";
- set name "Windows.Storage.Search.dll";
- set rich_header "\xa9\xbc\xd1\xd5\xed\xdd\xbf\x86\xed\xdd\xbf\x86\xed\xdd\xbf\x86\xe4\xa5\x2c\x86\x99\xdd\xbf\x86\xb6\xb5\x42\x86\xfa\xdd\xbf\x86\xb6\xb5\xbc\x87\xee\xdd\xbf\x86\xb6\xb5\xbb\x87\xf1\xdd\xbf\x86\xed\xdd\xbe\x86\xbe\xdf\xbf\x86\xb6\xb5\xbe\x87\xe4\xdd\xbf\x86\xb6\xb5\xba\x87\xee\xdd\xbf\x86\xb6\xb5\xbf\x87\xec\xdd\xbf\x86\xb6\xb5\xb1\x87\x8a\xdd\xbf\x86\xb6\xb5\x40\x86\xec\xdd\xbf\x86\xb6\xb5\xbd\x87\xec\xdd\xbf\x86\x52\x69\x63\x68\xed\xdd\xbf\x86\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "05 Jun 2028 09:16:06";
- set entry_point "229200";
- set image_size_x86 "397312";
- set image_size_x64 "397312";
- set name "Windows.System.Diagnostics.dll";
- set rich_header "\x56\xb8\x3f\x82\x12\xd9\x51\xd1\x12\xd9\x51\xd1\x12\xd9\x51\xd1\x1b\xa1\xc2\xd1\x7b\xd9\x51\xd1\x49\xb1\x55\xd0\x19\xd9\x51\xd1\x49\xb1\x52\xd0\x11\xd9\x51\xd1\x49\xb1\x54\xd0\x0c\xd9\x51\xd1\x12\xd9\x50\xd1\x0f\xdc\x51\xd1\x49\xb1\x50\xd0\x1a\xd9\x51\xd1\x49\xb1\x51\xd0\x13\xd9\x51\xd1\x49\xb1\x58\xd0\x3f\xd9\x51\xd1\x49\xb1\xac\xd1\x13\xd9\x51\xd1\x49\xb1\xae\xd1\x13\xd9\x51\xd1\x49\xb1\x53\xd0\x13\xd9\x51\xd1\x52\x69\x63\x68\x12\xd9\x51\xd1\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "04 Jul 2034 11:53:44";
- set entry_point "499072";
- set image_size_x86 "749568";
- set image_size_x64 "749568";
- set name "Windows.System.Launcher.dll";
- set rich_header "\x47\xa6\x6c\x0f\x03\xc7\x02\x5c\x03\xc7\x02\x5c\x03\xc7\x02\x5c\x0a\xbf\x91\x5c\x69\xc7\x02\x5c\x58\xaf\x01\x5d\x00\xc7\x02\x5c\x58\xaf\x06\x5d\x13\xc7\x02\x5c\x03\xc7\x03\x5c\x1d\xc6\x02\x5c\x58\xaf\x03\x5d\x0a\xc7\x02\x5c\x58\xaf\x07\x5d\x0f\xc7\x02\x5c\x58\xaf\x02\x5d\x02\xc7\x02\x5c\x58\xaf\x0b\x5d\x1a\xc7\x02\x5c\x58\xaf\xfd\x5c\x02\xc7\x02\x5c\x58\xaf\x00\x5d\x02\xc7\x02\x5c\x52\x69\x63\x68\x03\xc7\x02\x5c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `, `
- set checksum "0";
- set compile_time "22 Nov 2077 06:35:05";
- set entry_point "174288";
- set image_size_x86 "352256";
- set image_size_x64 "352256";
- set name "Windows.System.SystemManagement.dll";
- set rich_header "\x1e\x43\xad\x11\x5a\x22\xc3\x42\x5a\x22\xc3\x42\x5a\x22\xc3\x42\x53\x5a\x50\x42\x35\x22\xc3\x42\x01\x4a\xc7\x43\x51\x22\xc3\x42\x01\x4a\xc0\x43\x59\x22\xc3\x42\x01\x4a\xc6\x43\x44\x22\xc3\x42\x5a\x22\xc2\x42\x6f\x27\xc3\x42\x01\x4a\xc2\x43\x52\x22\xc3\x42\x01\x4a\xc3\x43\x5b\x22\xc3\x42\x01\x4a\xca\x43\x72\x22\xc3\x42\x01\x4a\x3e\x42\x5b\x22\xc3\x42\x01\x4a\x3c\x42\x5b\x22\xc3\x42\x01\x4a\xc1\x43\x5b\x22\xc3\x42\x52\x69\x63\x68\x5a\x22\xc3\x42\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `, `
- set checksum "0";
- set compile_time "02 Sep 1979 16:19:10";
- set entry_point "244336";
- set image_size_x86 "450560";
- set image_size_x64 "450560";
- set name "Windows.UI.BioFeedback.dll";
- set rich_header "\x2e\xc5\x24\x6b\x6a\xa4\x4a\x38\x6a\xa4\x4a\x38\x6a\xa4\x4a\x38\x63\xdc\xd9\x38\x58\xa4\x4a\x38\x31\xcc\x49\x39\x69\xa4\x4a\x38\x31\xcc\x4e\x39\x54\xa4\x4a\x38\x31\xcc\x4f\x39\x72\xa4\x4a\x38\x31\xcc\x4b\x39\x6d\xa4\x4a\x38\x6a\xa4\x4b\x38\x6f\xa5\x4a\x38\x31\xcc\x4a\x39\x6b\xa4\x4a\x38\x31\xcc\x43\x39\x60\xa4\x4a\x38\x31\xcc\xb5\x38\x6b\xa4\x4a\x38\x31\xcc\x48\x39\x6b\xa4\x4a\x38\x52\x69\x63\x68\x6a\xa4\x4a\x38\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "21 Apr 2088 08:58:42";
- set entry_point "263424";
- set image_size_x86 "495616";
- set image_size_x64 "495616";
- set name "Windows.UI.BlockedShutdown.dll";
- set rich_header "\xe4\xce\xe6\x5e\xa0\xaf\x88\x0d\xa0\xaf\x88\x0d\xa0\xaf\x88\x0d\xa9\xd7\x1b\x0d\x96\xaf\x88\x0d\xfb\xc7\x8b\x0c\xa3\xaf\x88\x0d\xfb\xc7\x8c\x0c\x9f\xaf\x88\x0d\xfb\xc7\x8d\x0c\xb8\xaf\x88\x0d\xfb\xc7\x89\x0c\xa9\xaf\x88\x0d\xa0\xaf\x89\x0d\xb9\xae\x88\x0d\xfb\xc7\x88\x0c\xa1\xaf\x88\x0d\xfb\xc7\x81\x0c\xac\xaf\x88\x0d\xfb\xc7\x77\x0d\xa1\xaf\x88\x0d\xfb\xc7\x8a\x0c\xa1\xaf\x88\x0d\x52\x69\x63\x68\xa0\xaf\x88\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "09 Apr 2088 13:20:50";
- set entry_point "622480";
- set image_size_x86 "942080";
- set image_size_x64 "942080";
- set name "Windows.UI.Core.TextInput.DLL";
- set rich_header "\x15\xc1\x87\x6a\x51\xa0\xe9\x39\x51\xa0\xe9\x39\x51\xa0\xe9\x39\x58\xd8\x7a\x39\x0f\xa0\xe9\x39\x0a\xc8\xea\x38\x52\xa0\xe9\x39\x0a\xc8\xed\x38\x43\xa0\xe9\x39\x51\xa0\xe8\x39\x4c\xa1\xe9\x39\x0a\xc8\xe8\x38\x5a\xa0\xe9\x39\x0a\xc8\xec\x38\x5d\xa0\xe9\x39\x0a\xc8\xe9\x38\x50\xa0\xe9\x39\x0a\xc8\xe0\x38\x0c\xa0\xe9\x39\x0a\xc8\x16\x39\x50\xa0\xe9\x39\x0a\xc8\xeb\x38\x50\xa0\xe9\x39\x52\x69\x63\x68\x51\xa0\xe9\x39\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "29 May 2067 18:44:41";
- set entry_point "29296";
- set image_size_x86 "413696";
- set image_size_x64 "413696";
- set name "FILEMGMT.DLL";
- set rich_header "\x75\x90\x3e\x81\x31\xf1\x50\xd2\x31\xf1\x50\xd2\x31\xf1\x50\xd2\x6a\x99\x53\xd3\x32\xf1\x50\xd2\x6a\x99\x54\xd3\x22\xf1\x50\xd2\x6a\x99\x51\xd3\x24\xf1\x50\xd2\x31\xf1\x51\xd2\x06\xf3\x50\xd2\x6a\x99\x55\xd3\x3b\xf1\x50\xd2\x6a\x99\x50\xd3\x30\xf1\x50\xd2\x6a\x99\x5e\xd3\x0a\xf1\x50\xd2\x6a\x99\xaf\xd2\x30\xf1\x50\xd2\x6a\x99\x52\xd3\x30\xf1\x50\xd2\x52\x69\x63\x68\x31\xf1\x50\xd2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "20 Oct 1984 19:23:49";
- set entry_point "376848";
- set image_size_x86 "712704";
- set image_size_x64 "712704";
- set name "polprocl.dll";
- set rich_header "\xdc\xa9\xe7\xf1\x98\xc8\x89\xa2\x98\xc8\x89\xa2\x98\xc8\x89\xa2\x91\xb0\x1a\xa2\xda\xc8\x89\xa2\xc3\xa0\x8a\xa3\x9b\xc8\x89\xa2\xc3\xa0\x8d\xa3\x8e\xc8\x89\xa2\x98\xc8\x88\xa2\x82\xca\x89\xa2\xc3\xa0\x88\xa3\xab\xc8\x89\xa2\xc3\xa0\x89\xa3\x99\xc8\x89\xa2\xc3\xa0\x80\xa3\x0f\xc8\x89\xa2\xc3\xa0\x8c\xa3\x9f\xc8\x89\xa2\xc3\xa0\x76\xa2\x99\xc8\x89\xa2\xc3\xa0\x8b\xa3\x99\xc8\x89\xa2\x52\x69\x63\x68\x98\xc8\x89\xa2\x00\x00\x00\x00\x00\x00\x00\x00";
- `, `
- set checksum "0";
- set compile_time "30 Mar 1994 00:05:14";
- set entry_point "113632";
- set image_size_x86 "1277952";
- set image_size_x64 "1277952";
- set name "GPSVC.dll";
- set rich_header "\xd5\x3a\xd3\x63\x91\x5b\xbd\x30\x91\x5b\xbd\x30\x91\x5b\xbd\x30\x98\x23\x2e\x30\xc5\x5b\xbd\x30\xca\x33\xbe\x31\x92\x5b\xbd\x30\xca\x33\xb9\x31\x82\x5b\xbd\x30\x91\x5b\xbc\x30\x47\x5a\xbd\x30\xca\x33\xbc\x31\x9a\x5b\xbd\x30\xca\x33\xb8\x31\x9b\x5b\xbd\x30\xca\x33\xbd\x31\x90\x5b\xbd\x30\xca\x33\xb3\x31\x08\x5b\xbd\x30\xca\x33\x42\x30\x90\x5b\xbd\x30\xca\x33\xbf\x31\x90\x5b\xbd\x30\x52\x69\x63\x68\x91\x5b\xbd\x30\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "10 Aug 2018 19:22:06";
- set entry_point "869360";
- set image_size_x86 "1638400";
- set image_size_x64 "1638400";
- set name "libcrypto.dll";
- set rich_header "\xbe\xf7\xf9\xa0\xfa\x96\x97\xf3\xfa\x96\x97\xf3\xfa\x96\x97\xf3\x89\xf4\x93\xf2\xf0\x96\x97\xf3\x89\xf4\x94\xf2\xfc\x96\x97\xf3\x89\xf4\x92\xf2\x52\x96\x97\xf3\x64\x36\x50\xf3\xf2\x96\x97\xf3\x28\xf2\x94\xf2\xf3\x96\x97\xf3\x28\xf2\x92\xf2\xef\x96\x97\xf3\x28\xf2\x93\xf2\xeb\x96\x97\xf3\xf3\xee\x04\xf3\xc9\x96\x97\xf3\xfa\x96\x96\xf3\x7d\x96\x97\xf3\x11\xf2\x93\xf2\xd4\x94\x97\xf3\x11\xf2\x97\xf2\xfb\x96\x97\xf3\x11\xf2\x68\xf3\xfb\x96\x97\xf3\xfa\x96\x00\xf3\xfb\x96\x97\xf3\x11\xf2\x95\xf2\xfb\x96\x97\xf3\x52\x69\x63\x68\xfa\x96\x97\xf3\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "06 Jul 1990 07:33:20";
- set entry_point "210752";
- set image_size_x86 "344064";
- set image_size_x64 "344064";
- set name "rdpcomapi.DLL";
- set rich_header "\x40\x89\xc2\x2f\x04\xe8\xac\x7c\x04\xe8\xac\x7c\x04\xe8\xac\x7c\x0d\x90\x3f\x7c\x50\xe8\xac\x7c\x5f\x80\xa8\x7d\x12\xe8\xac\x7c\x04\xe8\xad\x7c\x20\xe9\xac\x7c\x5f\x80\xad\x7d\x03\xe8\xac\x7c\x5f\x80\xaf\x7d\x00\xe8\xac\x7c\x5f\x80\xa9\x7d\x02\xe8\xac\x7c\x5f\x80\xac\x7d\x05\xe8\xac\x7c\x5f\x80\xa5\x7d\x23\xe8\xac\x7c\x5f\x80\x53\x7c\x05\xe8\xac\x7c\x5f\x80\xae\x7d\x05\xe8\xac\x7c\x52\x69\x63\x68\x04\xe8\xac\x7c\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "05 Nov 2018 23:03:21";
- set entry_point "657360";
- set image_size_x86 "880640";
- set image_size_x64 "880640";
- set name "winsqlite3.dll";
- set rich_header "\xe5\x3e\x6d\xff\xa1\x5f\x03\xac\xa1\x5f\x03\xac\xa1\x5f\x03\xac\x9a\x01\x00\xad\xa7\x5f\x03\xac\x9a\x01\x06\xad\xb7\x5f\x03\xac\x9a\x01\x07\xad\xac\x5f\x03\xac\xa8\x27\x90\xac\x92\x5f\x03\xac\xa1\x5f\x02\xac\xd8\x5f\x03\xac\x36\x01\x07\xad\xa0\x5f\x03\xac\x36\x01\x03\xad\xa0\x5f\x03\xac\x33\x01\xfc\xac\xa0\x5f\x03\xac\x36\x01\x01\xad\xa0\x5f\x03\xac\x52\x69\x63\x68\xa1\x5f\x03\xac\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "14 Oct 2074 07:37:20";
- set entry_point "96192";
- set image_size_x86 "348160";
- set image_size_x64 "348160";
- set name "wow64.dll";
- set rich_header "\x81\xe8\xb7\x79\xc5\x89\xd9\x2a\xc5\x89\xd9\x2a\xc5\x89\xd9\x2a\x9e\xe1\xd8\x2b\xc0\x89\xd9\x2a\xc5\x89\xd8\x2a\x85\x8b\xd9\x2a\x9e\xe1\xdd\x2b\xc3\x89\xd9\x2a\x9e\xe1\xd9\x2b\xc4\x89\xd9\x2a\x9e\xe1\xda\x2b\xc0\x89\xd9\x2a\x9e\xe1\xd4\x2b\xec\x89\xd9\x2a\x9e\xe1\x26\x2a\xc4\x89\xd9\x2a\x9e\xe1\xdb\x2b\xc4\x89\xd9\x2a\x52\x69\x63\x68\xc5\x89\xd9\x2a\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "16 Aug 2035 01:40:28";
- set entry_point "63504";
- set image_size_x86 "512000";
- set image_size_x64 "512000";
- set name "wow64win.dll";
- set rich_header "\x78\x0f\x70\x56\x3c\x6e\x1e\x05\x3c\x6e\x1e\x05\x3c\x6e\x1e\x05\x67\x06\x1f\x04\x39\x6e\x1e\x05\x3c\x6e\x1f\x05\x27\x6e\x1e\x05\x67\x06\x13\x04\x34\x6e\x1e\x05\x67\x06\x1a\x04\x3a\x6e\x1e\x05\x67\x06\x1e\x04\x3d\x6e\x1e\x05\x67\x06\x1d\x04\x3f\x6e\x1e\x05\x67\x06\xe1\x05\x3d\x6e\x1e\x05\x67\x06\x1c\x04\x3d\x6e\x1e\x05\x52\x69\x63\x68\x3c\x6e\x1e\x05\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "0";
- set compile_time "02 Feb 2020 19:59:15";
- set entry_point "1056672";
- set image_size_x86 "1785856";
- set image_size_x64 "1785856";
- set name "WWANSVC.DLL";
- set rich_header "\x77\xf3\x15\x7d\x33\x92\x7b\x2e\x33\x92\x7b\x2e\x33\x92\x7b\x2e\x3a\xea\xe8\x2e\xb3\x92\x7b\x2e\x68\xfa\x7f\x2f\x3c\x92\x7b\x2e\x68\xfa\x78\x2f\x30\x92\x7b\x2e\x68\xfa\x7e\x2f\x2d\x92\x7b\x2e\x33\x92\x7a\x2e\xf8\x97\x7b\x2e\x68\xfa\x7a\x2f\x3e\x92\x7b\x2e\x68\xfa\x7b\x2f\x32\x92\x7b\x2e\x68\xfa\x72\x2f\xa9\x92\x7b\x2e\x68\xfa\x86\x2e\x32\x92\x7b\x2e\x68\xfa\x84\x2e\x32\x92\x7b\x2e\x68\xfa\x79\x2f\x32\x92\x7b\x2e\x52\x69\x63\x68\x33\x92\x7b\x2e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "164653";
- set compile_time "06 Nov 2020 18:42:28";
- set entry_point "63072";
- set name "CyMemDef64.dll";
- set rich_header "\x5f\x64\xdb\xae\x1b\x05\xb5\xfd\x1b\x05\xb5\xfd\x1b\x05\xb5\xfd\x1b\x05\xb4\xfd\x30\x05\xb5\xfd\xe7\x72\x0c\xfd\x18\x05\xb5\xfd\x7d\xeb\x66\xfd\x07\x05\xb5\xfd\x3c\xc3\x78\xfd\x1a\x05\xb5\xfd\x7d\xeb\x7f\xfd\x1a\x05\xb5\xfd\x3c\xc3\x7c\xfd\x1a\x05\xb5\xfd\x1b\x05\x22\xfd\x1a\x05\xb5\xfd\x7d\xeb\x79\xfd\x1a\x05\xb5\xfd\x52\x69\x63\x68\x1b\x05\xb5\xfd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "1968945";
- set compile_time "26 Jul 2021 18:09:30";
- set entry_point "1099888";
- set image_size_x86 "2072576";
- set image_size_x64 "2072576";
- set name "InProcessClient.dll";
- set rich_header "\xd5\x71\x0e\xb3\x91\x10\x60\xe0\x91\x10\x60\xe0\x91\x10\x60\xe0\x85\x7b\x63\xe1\x84\x10\x60\xe0\x85\x7b\x65\xe1\x24\x10\x60\xe0\x48\x64\x64\xe1\x83\x10\x60\xe0\x48\x64\x63\xe1\x9d\x10\x60\xe0\xf7\x7f\x9d\xe0\x92\x10\x60\xe0\x4a\x64\x61\xe1\x93\x10\x60\xe0\x85\x7b\x64\xe1\xb2\x10\x60\xe0\x85\x7b\x61\xe1\x94\x10\x60\xe0\x48\x64\x65\xe1\x0e\x10\x60\xe0\xfb\x78\x65\xe1\x80\x10\x60\xe0\x85\x7b\x66\xe1\x93\x10\x60\xe0\x91\x10\x61\xe0\x5c\x11\x60\xe0\x4a\x64\x69\xe1\x03\x10\x60\xe0\x4a\x64\x63\xe1\x93\x10\x60\xe0\x4a\x64\x60\xe1\x90\x10\x60\xe0\x4a\x64\x9f\xe0\x90\x10\x60\xe0\x91\x10\xf7\xe0\x90\x10\x60\xe0\x4a\x64\x62\xe1\x90\x10\x60\xe0\x52\x69\x63\x68\x91\x10\x60\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "2817694";
- set compile_time "19 May 2021 13:31:53";
- set entry_point "1253200";
- set image_size_x86 "2863104";
- set image_size_x64 "2863104";
- set name "ctiuser.dll";
- set rich_header "\x15\xd9\xb0\x30\x51\xb8\xde\x63\x51\xb8\xde\x63\x51\xb8\xde\x63\x45\xd3\xda\x62\x47\xb8\xde\x63\x45\xd3\xdd\x62\x5f\xb8\xde\x63\x45\xd3\xdb\x62\x90\xb8\xde\x63\xcf\x18\x19\x63\x52\xb8\xde\x63\xa9\xc8\xda\x62\x40\xb8\xde\x63\xa9\xc8\xdd\x62\x5b\xb8\xde\x63\xa9\xc8\xdb\x62\xdf\xb8\xde\x63\x45\xd3\xdf\x62\x54\xb8\xde\x63\x45\xd3\xd8\x62\x53\xb8\xde\x63\x51\xb8\xdf\x63\x29\xb9\xde\x63\xe9\xc9\xda\x62\x69\xb8\xde\x63\xe9\xc9\xdb\x62\x13\xb8\xde\x63\xe9\xc9\xde\x62\x50\xb8\xde\x63\xe9\xc9\x21\x63\x50\xb8\xde\x63\x51\xb8\x49\x63\x50\xb8\xde\x63\xe9\xc9\xdc\x62\x50\xb8\xde\x63\x52\x69\x63\x68\x51\xb8\xde\x63\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
- `
- set checksum "83724";
- set compile_time "05 Aug 2020 16:06:20";
- set entry_point "5664";
- set name "umppc.dll";
- set rich_header "\xba\xf0\x63\x99\xfe\x91\x0d\xca\xfe\x91\x0d\xca\xfe\x91\x0d\xca\x92\xf9\x0e\xcb\xff\x91\x0d\xca\x92\xf9\x05\xcb\xf3\x91\x0d\xca\x9b\xf7\x0e\xcb\xfc\x91\x0d\xca\x9b\xf7\x09\xcb\xfb\x91\x0d\xca\x9b\xf7\x0c\xcb\xfd\x91\x0d\xca\xfe\x91\x0c\xca\xc6\x91\x0d\xca\x92\xf9\x0d\xcb\xff\x91\x0d\xca\x92\xf9\xf2\xca\xff\x91\x0d\xca\x92\xf9\x0f\xcb\xff\x91\x0d\xca\x52\x69\x63\x68\xfe\x91\x0d\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
- `,
+set checksum "564120";
+set compile_time "08 Sep 2007 15:58:23";
+set entry_point "64272";
+set image_size_x86 "536576";
+set image_size_x64 "536576";
+set name "wow64win.dll";
+set rich_header "\xff\x46\xc6\x00\xbb\x27\xa8\x53\xbb\x27\xa8\x53\xbb\x27\xa8\x53\xaf\x4c\xa9\x52\xbe\x27\xa8\x53\xbb\x27\xa9\x53\xa1\x27\xa8\x53\xaf\x4c\xac\x52\xbc\x27\xa8\x53\xaf\x4c\xa5\x52\xb2\x27\xa8\x53\xaf\x4c\xa8\x52\xba\x27\xa8\x53\xaf\x4c\xab\x52\xb8\x27\xa8\x53\xaf\x4c\x57\x53\xba\x27\xa8\x53\xaf\x4c\xaa\x52\xba\x27\xa8\x53\x52\x69\x63\x68\xbb\x27\xa8\x53\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "367366";
+set compile_time "25 Jun 2044 21:28:59";
+set entry_point "102608";
+set image_size_x86 "364544";
+set image_size_x64 "364544";
+set name "wow64.dll";
+set rich_header "\x1e\xc2\x53\x5c\x5a\xa3\x3d\x0f\x5a\xa3\x3d\x0f\x5a\xa3\x3d\x0f\x4e\xc8\x3c\x0e\x5f\xa3\x3d\x0f\x5a\xa3\x3c\x0f\x13\xa1\x3d\x0f\x4e\xc8\x39\x0e\x5c\xa3\x3d\x0f\x4e\xc8\x3d\x0e\x5b\xa3\x3d\x0f\x4e\xc8\x3e\x0e\x5e\xa3\x3d\x0f\x4e\xc8\x30\x0e\x72\xa3\x3d\x0f\x4e\xc8\xc2\x0f\x5b\xa3\x3d\x0f\x4e\xc8\x3f\x0e\x5b\xa3\x3d\x0f\x52\x69\x63\x68\x5a\xa3\x3d\x0f\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "4372458";
+set compile_time "29 Nov 2022 18:59:21";
+set entry_point "1605936";
+set image_size_x86 "4423680";
+set image_size_x64 "4423680";
+set name "ctiuser.dll";
+set rich_header "\xb9\x56\x40\x85\xfd\x37\x2e\xd6\xfd\x37\x2e\xd6\xfd\x37\x2e\xd6\xe9\x5c\x2a\xd7\xea\x37\x2e\xd6\xe9\x5c\x2d\xd7\xf3\x37\x2e\xd6\xe9\x5c\x2b\xd7\x3d\x37\x2e\xd6\x05\x47\x2a\xd7\xec\x37\x2e\xd6\x05\x47\x2d\xd7\xf7\x37\x2e\xd6\xe9\x5c\x28\xd7\xff\x37\x2e\xd6\x45\x46\x2a\xd7\xb3\x37\x2e\xd6\xfd\x37\x2f\xd6\x61\x36\x2e\xd6\xe9\x5c\x2f\xd7\xfa\x37\x2e\xd6\x05\x47\x2b\xd7\x6c\x37\x2e\xd6\x45\x46\x2b\xd7\x8b\x37\x2e\xd6\x45\x46\x2e\xd7\xfc\x37\x2e\xd6\x45\x46\xd1\xd6\xfc\x37\x2e\xd6\xfd\x37\xb9\xd6\xfc\x37\x2e\xd6\x45\x46\x2c\xd7\xfc\x37\x2e\xd6\x52\x69\x63\x68\xfd\x37\x2e\xd6\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "2434978";
+set compile_time "12 Dec 2022 11:46:37";
+set entry_point "1310336";
+set image_size_x86 "2519040";
+set image_size_x64 "2519040";
+set name "InProcessClient.dll";
+set rich_header "\x50\x58\xa2\x76\x14\x39\xcc\x25\x14\x39\xcc\x25\x14\x39\xcc\x25\x5f\x41\xcf\x24\x01\x39\xcc\x25\x5f\x41\xc9\x24\xaa\x39\xcc\x25\x74\x43\x31\x25\x15\x39\xcc\x25\x74\x43\xc8\x24\x05\x39\xcc\x25\x74\x43\xcf\x24\x1a\x39\xcc\x25\x76\x41\xc9\x24\x16\x39\xcc\x25\x70\x43\xcd\x24\x16\x39\xcc\x25\x74\x43\xc9\x24\xb5\x39\xcc\x25\x70\x43\xc9\x24\x17\x39\xcc\x25\x7e\x51\xc9\x24\x05\x39\xcc\x25\x5f\x41\xcd\x24\x1d\x39\xcc\x25\x5f\x41\xca\x24\x15\x39\xcc\x25\x5f\x41\xc8\x24\x37\x39\xcc\x25\x14\x39\xcd\x25\xf7\x38\xcc\x25\x70\x43\xc5\x24\xb6\x39\xcc\x25\x70\x43\xcf\x24\x16\x39\xcc\x25\x70\x43\xcc\x24\x15\x39\xcc\x25\x70\x43\x33\x25\x15\x39\xcc\x25\x70\x43\xce\x24\x15\x39\xcc\x25\x52\x69\x63\x68\x14\x39\xcc\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "73958";
+set compile_time "21 Jul 2023 12:15:13";
+set entry_point "5712";
+set name "umppc.dll";
+set rich_header "\xbe\x81\x57\xa3\xfa\xe0\x39\xf0\xfa\xe0\x39\xf0\xfa\xe0\x39\xf0\x23\x94\x3a\xf1\xfb\xe0\x39\xf0\x23\x94\x31\xf1\xf7\xe0\x39\xf0\x29\x92\x3a\xf1\xf9\xe0\x39\xf0\x29\x92\x3d\xf1\xfc\xe0\x39\xf0\x29\x92\x38\xf1\xf9\xe0\x39\xf0\xfa\xe0\x38\xf0\xc0\xe0\x39\xf0\x23\x94\x39\xf1\xfb\xe0\x39\xf0\x23\x94\xc6\xf0\xfb\xe0\x39\xf0\x23\x94\x3b\xf1\xfb\xe0\x39\xf0\x52\x69\x63\x68\xfa\xe0\x39\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`, `
+set checksum "715814";
+set compile_time "14 Oct 2021 19:50:52";
+set entry_point "78800";
+set image_size_x86 "704512";
+set image_size_x64 "704512";
+set name "CylanceMemDef64.dll";
+set rich_header "\xd7\xf6\x0c\x93\x93\x97\x62\xc0\x93\x97\x62\xc0\x93\x97\x62\xc0\x6f\xe0\xdc\xc0\x91\x97\x62\xc0\x6f\xe0\xde\xc0\x97\x97\x62\xc0\x6f\xe0\xdb\xc0\x90\x97\x62\xc0\x93\x97\x63\xc0\xeb\x97\x62\xc0\xb0\x78\xb0\xc0\xd6\x97\x62\xc0\xb4\x51\xaf\xc0\x91\x97\x62\xc0\xf5\x79\xa8\xc0\x92\x97\x62\xc0\xb4\x51\xab\xc0\x92\x97\x62\xc0\x93\x97\xf5\xc0\x92\x97\x62\xc0\xf5\x79\xae\xc0\x92\x97\x62\xc0\x52\x69\x63\x68\x93\x97\x62\xc0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+`,
}
var Useragent_list = []string{
@@ -1279,6 +1272,11 @@ set sleeptime "{{.Variables.sleep}}";
set jitter "{{.Variables.jitter}}";
set useragent "{{.Variables.useragent}}";
+http-beacon {
+ set library "{{.Variables.httplib}}";
+}
+
+
# Task and Proxy Max Size
set tasks_max_size "{{.Variables.tasks_max_size}}";
set tasks_proxy_max_size "{{.Variables.tasks_proxy_max_size}}";
@@ -1324,7 +1322,12 @@ stage {
set cleanup "true";
set userwx "false";
set smartinject "true";
-
+
+ set syscall_method "{{.Variables.syscall_method}}"; #### needs a varible
+ ###will change down the road but 32-bit shouldn't be used that much
+ set magic_mz_x86 "MZRE";
+ set magic_mz_x64 "{{.Variables.magic_mz_x64}}";
+ set magic_pe "{{.Variables.magic_pe}}";
#TCP and SMB beacons will obfuscate themselves while they wait for a new connection.
#They will also obfuscate themselves while they wait to read information from their parent Beacon.
@@ -1333,7 +1336,7 @@ stage {
}
func Beacon_Stage_p2_Stuct() string {
return `
-{{.Variables.pe}}
+ {{.Variables.pe}}
`
}
func Beacon_GETPOST_Profile_Struct() string {
@@ -1356,7 +1359,6 @@ func Beacon_Stage_Struct_p3() string {
strrep "ReflectiveLoader" "";
strrep "This program cannot be run in DOS mode" "";
strrep "NtQueueApcThread" "";
- strrep "HTTP/1.1 200 OK" "";
strrep "Stack memory was corrupted" "";
strrep "beacon.dll" "";
strrep "ADVAPI32.dll" "";
@@ -1445,6 +1447,11 @@ func Beacon_Stage_Struct_p3() string {
strrep "Wow64DisableWow64FsRedirection" "";
strrep "Wow64RevertWow64FsRedirection" "";
strrep "Kerberos" "";
+ strrep "msvcrt.dll" "";
+ strrep "C:\\Windows\\System32\\msvcrt.dll" "";
+ strrep "Stack around the variable" "";
+ strrep "' was corrupted." "" ;
+ strrep "The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention." "";
}
@@ -1454,7 +1461,6 @@ func Beacon_Stage_Struct_p3() string {
strrep "This program cannot be run in DOS mode" "";
strrep "beacon.x64.dll" "";
strrep "NtQueueApcThread" "";
- strrep "HTTP/1.1 200 OK" "";
strrep "Stack memory was corrupted" "";
strrep "beacon.dll" "";
strrep "ADVAPI32.dll" "";
@@ -1482,8 +1488,6 @@ func Beacon_Stage_Struct_p3() string {
strrep "CloseThreadpoolTimer" "";
strrep "CreateThreadpoolWait" "";
strrep "SetThreadpoolWait" "";
- strrep "CloseThreadpoolWait" "";
- strrep "FlushProcessWriteBuffers" "";
strrep "FreeLibraryWhenCallbackReturns" "";
strrep "GetCurrentProcessorNumber" "";
strrep "GetLogicalProcessorInformation" "";
@@ -1543,6 +1547,12 @@ func Beacon_Stage_Struct_p3() string {
strrep "Wow64DisableWow64FsRedirection" "";
strrep "Wow64RevertWow64FsRedirection" "";
strrep "Kerberos" "";
+ strrep "msvcrt.dll" "";
+ strrep "C:\\Windows\\System32\\msvcrt.dll" "";
+ strrep "Stack around the variable" "";
+ strrep "' was corrupted." "" ;
+ strrep "The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention." "";
+
}
}
`
@@ -1558,7 +1568,7 @@ process-inject {
set min_alloc "{{.Variables.processinject_min_alloc}}";
set userwx "false";
set startrwx "true";
-
+
transform-x86 {
prepend "\x90\x90\x90\x90\x90\x90\x90\x90\x90"; # NOP, NOP!
}
@@ -1584,17 +1594,25 @@ func Beacon_PostEX_Struct() string {
post-ex {
# control the temporary process we spawn to
{{.Variables.Post_EX_Process_Name}}
+
# change the permissions and content of our post-ex DLLs
set obfuscate "true";
-
+
+ # Allows multi-threaded post-ex DLLs to spawn threads with a spoofed start address
+ {{.Variables.thread_hint}}
+
# pass key function pointers from Beacon to its child jobs
set smartinject "true";
# disable AMSI in powerpick, execute-assembly, and psinject
- set amsi_disable "true";
+ set amsi_disable "false";
+ # do not enable this unless needed. Disabling AMSI is an IOC
# control the method used to log keystrokes
set keylogger "{{.Variables.Keylogger}}";
+
+ # cleanup the post-ex UDRL memory when the post-ex DLL is loaded
+ set cleanup "true";
}
`
}
diff --git a/Utils/Utils.go b/Utils/Utils.go
index 6e33522..369927e 100644
--- a/Utils/Utils.go
+++ b/Utils/Utils.go
@@ -1,7 +1,7 @@
package Utils
import (
- "io/ioutil"
+ "fmt"
"log"
"math/rand"
"os"
@@ -14,6 +14,7 @@ const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
const numbers = "1234567890"
const capital = "ABCDEF"
const alpha = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-"
+const alphanum = "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
const lowercasealpha = "abcdefghijklmnopqrstuvwxyz"
func check(e error) {
@@ -23,7 +24,7 @@ func check(e error) {
}
func Readfile(inputFile string) string {
- output, err := ioutil.ReadFile(inputFile)
+ output, err := os.ReadFile(inputFile)
if err != nil {
log.Fatal(err)
}
@@ -86,6 +87,23 @@ func GenerateValue(min, max int) string {
return string(b)
}
+func GenerateSingleValue(num int) string {
+ n := num
+ b := make([]byte, n)
+ for i := range b {
+ b[i] = alphanum[rand.Intn(len(alpha))]
+ }
+ return string(b)
+}
+
+func GenHex() string {
+ rand.Seed(time.Now().UnixNano())
+
+ // Generate a random number and convert it to a hexadecimal string
+ hexString := fmt.Sprintf("%x", rand.Intn(4096)) // 4096 is 16^3, ensuring up to 3 hex characters
+ return hexString
+}
+
func GenerateURIValues(numb int, profile_type int, Post bool, customuri string) string {
var uri string
var baseuri string