I think you are right. You can find the actual evidence gathering on the clients like in this file, where it's also enriched with metadata and encoded the same

I think you are right. You can find the actual evidence gathering on the clients like in this file, where it's also enriched with metadata and encoded the same way the ruby script does (at least to me, not a c++ programmer, it seems to be the case). https://github.com/hackedteam/soldier-win/blob/master/Soldier/url.cpp#L1085 https://github.com/hackedteam/soldier-win/blob/master/Soldie... Also, while there are plenty of functions for getting data from the target device like `URL_GetBrowserHistory` there are as far i can tell, no obvious equivalents for putting them.