25-in-1 Native x64 Windows EDR, Memory Forensics & Anti-Stealer
See the codeSee what people are saying
README
⚡ ProxSuite PRO (Apex Edition v2.5 Enterprise)
25-in-1 Native x64 Windows EDR, Live Memory Forensics, Anti-Stealer, Kernel DACL Self-Defense & SIEM Command Center
🌐 Official Interactive Web Portal & Instant Checkout: https://prox0959.github.io/ProxSuite-PRO/
⚡ Direct Standalone .EXE Download (Defender Verified 0/0 Clean): ProxSuitePRO.exe
📦 Full Release Package (.ZIP): ProxSuitePRO_v2.0_Customer_Release.zip
🔑 Licenses (Crypto Only — USDT / BTC / ETH / SOL / LTC / XMR): 24h Free Trial ($0) | 30-Day PRO ($9.99) | Permanent v2.x ($24.99)
💎 Also Selling Full Source Code & White-Label Rights: $499.00 (Crypto Only) — Complete 3,100+ line C# / Win32 / NT Syscall source code for all 25 engines + Standalone Offline AES-256 HWID Keygen + SIEM/Rule modules + full rebrand rights (Note: 3rd-party CGAuth module is excluded) — Order via Portal or DM @prox_0959 on X
⚔️ ProxSuite PRO v2.5 vs. Industry Antivirus & EDR Suites
| Forensic Capability / Attack Vector | ⚡ ProxSuite PRO v2.5 (25-in-1) | 🛡️ Windows Defender | 🦠 Malwarebytes Premium | 🔒 Bitdefender / Kaspersky | 🦅 CrowdStrike / SentinelOne | 🧰 Sysinternals Suite |
|---|---|---|---|---|---|---|
| Unbacked Private RWX Memory & Process Hollowing | ✓ Live MZ/PE & Shellcode RAM Scanner | ✗ Bypassed via AMSI/ETW patch | ⚠️ Signature / heuristic only | ⚠️ Misses custom LOLBIN hollowing | ✓ Kernel sensor (Enterprise) | ✗ Manual hex dump required |
Module Stomping (.text), Process Ghosting & Herpaderping | ✓ Disk vs. RAM .text Diff & Thread Stack Audit | ✗ Trusts MEM_IMAGE backed modules | ✗ Blind to Module Stomping | ✗ Misses Herpaderped PE headers | ✓ Kernel image telemetry | ✗ None |
| NTDLL Syscall Unhooking & SSN Prologue Audit | ✓ Audits 4C 8B D1 B8 & SSNs live | ✗ Blind to user-mode NTDLL hooks | ✗ Not inspected | ✗ No user-visible syscall audit | ⚠️ Internal sensor only | ✗ Requires WinDbg |
LSASS Deep Shield (SSP Injection, PssCaptureSnapshot & comsvcs) | ✓ LSA SSP Audit + Snapshot/dbgcore Hunter | ⚠️ Bypassed when RunAsPPL is off | ✗ No LSA SSP registry verification | ⚠️ Partial LSASS protection | ✓ Enterprise credential guard | ✗ Manual inspection only |
AMSI & ETW Single-Byte (0xC3 RET) Patch + AutoLogger Audit | ✓ Byte Prologue + Kernel AutoLogger Check | ✗ Blinded once patched in RAM | ✗ No prologue verification | ✗ Not reported to user | ⚠️ Partial TI-ETW | ✗ None |
| Self-Deleting Droppers (Kernel BAM & Prefetch) | ✓ GhostTrace BAM + .PF Post-Mortem | ✗ Reports "0 Threats" if file deleted | ✗ Only scans existing files on disk | ✗ Misses post-execution deleted files | ✓ Cloud EDR timeline | ✗ No automated BAM correlation |
| Cobalt Strike / Sliver / Havoc / BRC4 Named Pipe C2 | ✓ Dedicated \\.\pipe\ C2 + Dynamic Rules | ⚠️ Basic static signatures | ✗ Checks TCP/IP web domains only | ✗ Network socket focus only | ✓ Enterprise IPC telemetry | ⚠️ Lists raw pipes without C2 rules |
| LOLBIN RAM Discord / Telegram Webhook C2 Scan | ✓ Live RAM String IOC Hunter | ✗ HTTPS traffic looks like normal chat | ✗ Cannot block legitimate Discord API | ✗ Allows outbound HTTPS to Discord | ⚠️ Requires custom YARA rule | ⚠️ Manual Strings search per PID |
| Vulnerable Kernel Drivers (BYOVD / LOLDrivers + Event 7045) | ✓ Built-in LOLDrivers + Kernel Event 7045 | ⚠️ Blocklist often disabled by admin | ✗ Trusts signed WHQL drivers | ✗ Trusts valid digital signatures | ✓ Kernel driver telemetry | ⚠️ Shows drivers without CVE match |
| Fileless WMI Subscriptions & HKCU COM Hijacks | ✓ Authenticode-Filtered Zero-FP Audit | ⚠️ Misses custom HKCU InprocServer32 | ⚠️ Scans standard Run keys only | ⚠️ Partial startup inspection | ✓ Full persistence telemetry | ⚠️ Dumps 4,000+ noisy legit rows |
| Self-Defense (Kernel DACL Anti-Kill + Binary File Lock) | ✓ Deny Terminate/VM_Write DACL + File Lock | ⚠️ Bypassed via Exclusion/Tamper scripts | ⚠️ Service can be stopped by Admin | ✓ Kernel self-protection driver | ✓ Enterprise tamper protection | ✗ Easily killed by any malware |
| Hot-Reloadable Dynamic IOC Rules & SIEM / Webhook Streaming | ✓ prox_rules.json + CEF/Webhook & EventLog | ✗ No custom user JSON rules or Webhook | ✗ Closed signatures, no SIEM webhook | ✗ Consumer tier lacks SIEM/Webhook | ✓ Enterprise SOC console | ✗ None |
| Real-Time Crypto Clipboard Hijack Shield | ✓ 600ms BTC/ETH/USDT Vault & Revert | ✗ Zero clipboard protection | ✗ Zero clipboard protection | ✗ No wallet auto-restore | ✗ Not built for crypto traders | ✗ None |
| RAM Footprint & System Performance Impact | ~95 KB EXE / ~25 MB On-Demand | ~350 MB RAM (CPU spikes) | ~450 MB RAM + Background Service | ~700 MB RAM + Heavy Filter Drivers | ~300 MB RAM + 24/7 Cloud Upload | ~45 MB (20 separate binaries) |
| Licensing Cost & Availability | $24.99 One-Time (or 24h Free Trial) | Included in OS (#1 Bypass Target) | $44.99 - $59.99 / Year | $59.99 - $89.99 / Year | $100+ / Endpoint / Year (Corp Only) | Free (Manual CLI/GUI tools) |
🧬 All 25 Built-In Proprietary Engines
| # | Engine Module | Detection / Defense Capability |
|---|---|---|
| 01 | MemGuard PRO v2.0 | Direct ntdll.dll syscall prologue verification (4C 8B D1 B8) & comsvcs.dll LSASS dump alert |
| 02 | HollowHunter | Scans MEM_PRIVATE RWX/WC memory pages for unbacked MZ/PE headers & shellcode stubs |
| 03 | GhostTrace | Hunts executed-and-deleted binaries across Windows Kernel BAM, Prefetch (.pf), and USBSTOR |
| 04 | VaultShield | Guards Chrome, Brave, Edge, Discord, Telegram, Exodus & Electrum vaults against Temp stealers |
| 05 | NetSentinel | Native GetExtendedTcpTable C2 port radar & LOLBIN network connection monitor |
| 06 | OmniTriage PRO | Audits HKCU / HKLM registry Run and RunOnce persistence entries |
| 07 | DriverRadar (BYOVD) | Checks loaded kernel drivers against the LOLDrivers BYOVD database & non-System32 paths |
| 08 | AMSIShield & ETW | Detects in-memory blinding patches on ntdll!EtwEventWrite and amsi!AmsiScanBuffer |
| 09 | DefenderTamper Guard | Exposes stealth Windows Defender exclusion folders and etc\hosts security sinkholes |
| 10 | GhostPersist | Hunts Image File Execution Options (IFEO) debugger hijacks & Winlogon\Shell overrides |
| 11 | 10-Point OS Hardener | Audits & applies RunAsPPL, WDigest, Event 4104, Credential Guard, HVCI, Secure Boot, ASR & UAC |
| 12 | TrueVerdict PRO | Computes file Shannon Entropy (0.00 - 8.00) and SHA-256 to detect packers/crypters |
| 13 | PixelTrace OSINT | Binary EXIF parser, GPS coordinate reverse-geocoder, C2PA/AI provenance & EOF stego carver |
| 14 | WMI Persist Hunter | Enumerates root\subscription & root\default for fileless WMI EventConsumer backdoors |
| 15 | NamedPipe C2 Scanner | Hunts Cobalt Strike (MSSE-*, postex_*), Sliver, Havoc, BRC4 & Mythic C2 named pipes |
| 16 | Token Privilege Audit | Exposes unexpected processes holding SeDebugPrivilege, SeTcbPrivilege or SeLoadDriverPrivilege |
| 17 | COM Hijack Detector | Scans HKCU\Software\Classes\CLSID InprocServer32 overrides for unsigned/Temp DLL hijacks |
| 18 | Browser Ext Scanner | Audits Chrome, Edge & Brave extension manifests for stealer permissions and rogue update_url |
| 19 | Memory IOC Scanner | Scans live LOLBIN RAM for Discord webhooks, Telegram bot C2 tokens, Ngrok & PS stagers |
| 20 | Behavioral Correlation | Cross-correlates alerts across engines to flag multi-signal APT & stealer attack chains |
| 21 | Ransomware Honeypot | Deploys hidden decoy files monitored in real time + active NtSuspendProcess PID containment |
| 22 | EvasionHunter (Stomp/Ghost) | Detects Module Stomping (.text byte diff vs. disk), Process Ghosting, Herpaderping & Thread Call-Stack spoofing |
| 23 | Kernel ETW-TI & Driver Stream | Audits WMI\Autologger kernel/security ETW sessions against blinding and inspects Event ID 7045 driver loads |
| 24 | LSASS Deep Shield (SSP/Snap) | Audits Lsa\Security Packages for SSP DLL injection (mimilib) & hunts PssCaptureSnapshot / dbgcore.dll dumpers |
| 25 | Self-Defense, Rules & SIEM | Hardens own Kernel DACL (denies TerminateProcess/VM_Write), locks binary with FILE_SHARE_READ, hot-reloads prox_rules.json & streams SIEM/Webhook alerts |
anti-stealer
byovd
cobalt-strike
csharp
cybersecurity
dfir
edr
endpoint-security
incident-response
infosec
malware-analysis
memory-forensics
osint
process-hollowing
ransomware-protection
reverse-engineering
siem
threat-hunting
win32api
windows-security
Contributors
prox0959
10 commits
Similar repos
Languages
HTML
100.0%
25-in-1 Native x64 Windows EDR, Memory Forensics & Anti-Stealer
See the codeSee what people are saying
README
⚡ ProxSuite PRO (Apex Edition v2.5 Enterprise)
25-in-1 Native x64 Windows EDR, Live Memory Forensics, Anti-Stealer, Kernel DACL Self-Defense & SIEM Command Center
🌐 Official Interactive Web Portal & Instant Checkout: https://prox0959.github.io/ProxSuite-PRO/
⚡ Direct Standalone .EXE Download (Defender Verified 0/0 Clean): ProxSuitePRO.exe
📦 Full Release Package (.ZIP): ProxSuitePRO_v2.0_Customer_Release.zip
🔑 Licenses (Crypto Only — USDT / BTC / ETH / SOL / LTC / XMR): 24h Free Trial ($0) | 30-Day PRO ($9.99) | Permanent v2.x ($24.99)
💎 Also Selling Full Source Code & White-Label Rights: $499.00 (Crypto Only) — Complete 3,100+ line C# / Win32 / NT Syscall source code for all 25 engines + Standalone Offline AES-256 HWID Keygen + SIEM/Rule modules + full rebrand rights (Note: 3rd-party CGAuth module is excluded) — Order via Portal or DM @prox_0959 on X
⚔️ ProxSuite PRO v2.5 vs. Industry Antivirus & EDR Suites
| Forensic Capability / Attack Vector | ⚡ ProxSuite PRO v2.5 (25-in-1) | 🛡️ Windows Defender | 🦠 Malwarebytes Premium | 🔒 Bitdefender / Kaspersky | 🦅 CrowdStrike / SentinelOne | 🧰 Sysinternals Suite |
|---|---|---|---|---|---|---|
| Unbacked Private RWX Memory & Process Hollowing | ✓ Live MZ/PE & Shellcode RAM Scanner | ✗ Bypassed via AMSI/ETW patch | ⚠️ Signature / heuristic only | ⚠️ Misses custom LOLBIN hollowing | ✓ Kernel sensor (Enterprise) | ✗ Manual hex dump required |
Module Stomping (.text), Process Ghosting & Herpaderping | ✓ Disk vs. RAM .text Diff & Thread Stack Audit | ✗ Trusts MEM_IMAGE backed modules | ✗ Blind to Module Stomping | ✗ Misses Herpaderped PE headers | ✓ Kernel image telemetry | ✗ None |
| NTDLL Syscall Unhooking & SSN Prologue Audit | ✓ Audits 4C 8B D1 B8 & SSNs live | ✗ Blind to user-mode NTDLL hooks | ✗ Not inspected | ✗ No user-visible syscall audit | ⚠️ Internal sensor only | ✗ Requires WinDbg |
LSASS Deep Shield (SSP Injection, PssCaptureSnapshot & comsvcs) | ✓ LSA SSP Audit + Snapshot/dbgcore Hunter | ⚠️ Bypassed when RunAsPPL is off | ✗ No LSA SSP registry verification | ⚠️ Partial LSASS protection | ✓ Enterprise credential guard | ✗ Manual inspection only |
AMSI & ETW Single-Byte (0xC3 RET) Patch + AutoLogger Audit | ✓ Byte Prologue + Kernel AutoLogger Check | ✗ Blinded once patched in RAM | ✗ No prologue verification | ✗ Not reported to user | ⚠️ Partial TI-ETW | ✗ None |
| Self-Deleting Droppers (Kernel BAM & Prefetch) | ✓ GhostTrace BAM + .PF Post-Mortem | ✗ Reports "0 Threats" if file deleted | ✗ Only scans existing files on disk | ✗ Misses post-execution deleted files | ✓ Cloud EDR timeline | ✗ No automated BAM correlation |
| Cobalt Strike / Sliver / Havoc / BRC4 Named Pipe C2 | ✓ Dedicated \\.\pipe\ C2 + Dynamic Rules | ⚠️ Basic static signatures | ✗ Checks TCP/IP web domains only | ✗ Network socket focus only | ✓ Enterprise IPC telemetry | ⚠️ Lists raw pipes without C2 rules |
| LOLBIN RAM Discord / Telegram Webhook C2 Scan | ✓ Live RAM String IOC Hunter | ✗ HTTPS traffic looks like normal chat | ✗ Cannot block legitimate Discord API | ✗ Allows outbound HTTPS to Discord | ⚠️ Requires custom YARA rule | ⚠️ Manual Strings search per PID |
| Vulnerable Kernel Drivers (BYOVD / LOLDrivers + Event 7045) | ✓ Built-in LOLDrivers + Kernel Event 7045 | ⚠️ Blocklist often disabled by admin | ✗ Trusts signed WHQL drivers | ✗ Trusts valid digital signatures | ✓ Kernel driver telemetry | ⚠️ Shows drivers without CVE match |
| Fileless WMI Subscriptions & HKCU COM Hijacks | ✓ Authenticode-Filtered Zero-FP Audit | ⚠️ Misses custom HKCU InprocServer32 | ⚠️ Scans standard Run keys only | ⚠️ Partial startup inspection | ✓ Full persistence telemetry | ⚠️ Dumps 4,000+ noisy legit rows |
| Self-Defense (Kernel DACL Anti-Kill + Binary File Lock) | ✓ Deny Terminate/VM_Write DACL + File Lock | ⚠️ Bypassed via Exclusion/Tamper scripts | ⚠️ Service can be stopped by Admin | ✓ Kernel self-protection driver | ✓ Enterprise tamper protection | ✗ Easily killed by any malware |
| Hot-Reloadable Dynamic IOC Rules & SIEM / Webhook Streaming | ✓ prox_rules.json + CEF/Webhook & EventLog | ✗ No custom user JSON rules or Webhook | ✗ Closed signatures, no SIEM webhook | ✗ Consumer tier lacks SIEM/Webhook | ✓ Enterprise SOC console | ✗ None |
| Real-Time Crypto Clipboard Hijack Shield | ✓ 600ms BTC/ETH/USDT Vault & Revert | ✗ Zero clipboard protection | ✗ Zero clipboard protection | ✗ No wallet auto-restore | ✗ Not built for crypto traders | ✗ None |
| RAM Footprint & System Performance Impact | ~95 KB EXE / ~25 MB On-Demand | ~350 MB RAM (CPU spikes) | ~450 MB RAM + Background Service | ~700 MB RAM + Heavy Filter Drivers | ~300 MB RAM + 24/7 Cloud Upload | ~45 MB (20 separate binaries) |
| Licensing Cost & Availability | $24.99 One-Time (or 24h Free Trial) | Included in OS (#1 Bypass Target) | $44.99 - $59.99 / Year | $59.99 - $89.99 / Year | $100+ / Endpoint / Year (Corp Only) | Free (Manual CLI/GUI tools) |
🧬 All 25 Built-In Proprietary Engines
| # | Engine Module | Detection / Defense Capability |
|---|---|---|
| 01 | MemGuard PRO v2.0 | Direct ntdll.dll syscall prologue verification (4C 8B D1 B8) & comsvcs.dll LSASS dump alert |
| 02 | HollowHunter | Scans MEM_PRIVATE RWX/WC memory pages for unbacked MZ/PE headers & shellcode stubs |
| 03 | GhostTrace | Hunts executed-and-deleted binaries across Windows Kernel BAM, Prefetch (.pf), and USBSTOR |
| 04 | VaultShield | Guards Chrome, Brave, Edge, Discord, Telegram, Exodus & Electrum vaults against Temp stealers |
| 05 | NetSentinel | Native GetExtendedTcpTable C2 port radar & LOLBIN network connection monitor |
| 06 | OmniTriage PRO | Audits HKCU / HKLM registry Run and RunOnce persistence entries |
| 07 | DriverRadar (BYOVD) | Checks loaded kernel drivers against the LOLDrivers BYOVD database & non-System32 paths |
| 08 | AMSIShield & ETW | Detects in-memory blinding patches on ntdll!EtwEventWrite and amsi!AmsiScanBuffer |
| 09 | DefenderTamper Guard | Exposes stealth Windows Defender exclusion folders and etc\hosts security sinkholes |
| 10 | GhostPersist | Hunts Image File Execution Options (IFEO) debugger hijacks & Winlogon\Shell overrides |
| 11 | 10-Point OS Hardener | Audits & applies RunAsPPL, WDigest, Event 4104, Credential Guard, HVCI, Secure Boot, ASR & UAC |
| 12 | TrueVerdict PRO | Computes file Shannon Entropy (0.00 - 8.00) and SHA-256 to detect packers/crypters |
| 13 | PixelTrace OSINT | Binary EXIF parser, GPS coordinate reverse-geocoder, C2PA/AI provenance & EOF stego carver |
| 14 | WMI Persist Hunter | Enumerates root\subscription & root\default for fileless WMI EventConsumer backdoors |
| 15 | NamedPipe C2 Scanner | Hunts Cobalt Strike (MSSE-*, postex_*), Sliver, Havoc, BRC4 & Mythic C2 named pipes |
| 16 | Token Privilege Audit | Exposes unexpected processes holding SeDebugPrivilege, SeTcbPrivilege or SeLoadDriverPrivilege |
| 17 | COM Hijack Detector | Scans HKCU\Software\Classes\CLSID InprocServer32 overrides for unsigned/Temp DLL hijacks |
| 18 | Browser Ext Scanner | Audits Chrome, Edge & Brave extension manifests for stealer permissions and rogue update_url |
| 19 | Memory IOC Scanner | Scans live LOLBIN RAM for Discord webhooks, Telegram bot C2 tokens, Ngrok & PS stagers |
| 20 | Behavioral Correlation | Cross-correlates alerts across engines to flag multi-signal APT & stealer attack chains |
| 21 | Ransomware Honeypot | Deploys hidden decoy files monitored in real time + active NtSuspendProcess PID containment |
| 22 | EvasionHunter (Stomp/Ghost) | Detects Module Stomping (.text byte diff vs. disk), Process Ghosting, Herpaderping & Thread Call-Stack spoofing |
| 23 | Kernel ETW-TI & Driver Stream | Audits WMI\Autologger kernel/security ETW sessions against blinding and inspects Event ID 7045 driver loads |
| 24 | LSASS Deep Shield (SSP/Snap) | Audits Lsa\Security Packages for SSP DLL injection (mimilib) & hunts PssCaptureSnapshot / dbgcore.dll dumpers |
| 25 | Self-Defense, Rules & SIEM | Hardens own Kernel DACL (denies TerminateProcess/VM_Write), locks binary with FILE_SHARE_READ, hot-reloads prox_rules.json & streams SIEM/Webhook alerts |
anti-stealer
byovd
cobalt-strike
csharp
cybersecurity
dfir
edr
endpoint-security
incident-response
infosec
malware-analysis
memory-forensics
osint
process-hollowing
ransomware-protection
reverse-engineering
siem
threat-hunting
win32api
windows-security
Similar repos
Contributors
prox0959
10 commits
Languages
HTML
100.0%