diff --git a/detectors/ntlm_reflection.py b/detectors/ntlm_reflection.py
index f1a420e..c8f3d40 100644
--- a/detectors/ntlm_reflection.py
+++ b/detectors/ntlm_reflection.py
@@ -23,11 +23,8 @@ class NTLMReflectionDetector:
 
     # Reference table from MSRC report
     # https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073
+    # must be at least Windows 10/2016 to exploit: https://github.com/Pennyw0rth/NetExec/pull/1245
     MSRC_PATCHES = {    # key = (major, minor, build), value = minimum patched UBR
-        (6, 0, 6003): 23351,      # Windows Server 2008 SP2
-        (6, 1, 7601): 27769,      # Windows Server 2008 R2 SP1
-        (6, 2, 9200): 25522,      # Windows Server 2012
-        (6, 3, 9600): 22620,      # Windows Server 2012 R2
         (10, 0, 14393): 8148,     # Windows Server 2016
         (10, 0, 17763): 7434,     # Windows Server 2019 / Win10 1809
         (10, 0, 20348): 3807,     # Windows Server 2022
diff --git a/protocols/http_detector.py b/protocols/http_detector.py
index 725d3f7..13b0986 100644
--- a/protocols/http_detector.py
+++ b/protocols/http_detector.py
@@ -11,6 +11,7 @@
 import warnings
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from .base_detector import BaseDetector, ProtocolResult
+from importlib.resources import files
 
 # Try to import requests-ntlm for EPA testing
 try:
@@ -300,19 +301,20 @@ def _enumerate_ntlm_paths(self, host: str, port: int, use_ssl: bool) -> list:
         scheme = 'https' if use_ssl else 'http'
 
         # Load wordlist
-        wordlist_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), 'web_ntlm_paths.dict')
-
-        if not os.path.exists(wordlist_path):
+        try:
+            wordlist_ref = files('protocols').joinpath('web_ntlm_paths.dict')
+            paths = [
+                line.strip()
+                for line in wordlist_ref.read_text().splitlines()
+                if line.strip() and not line.startswith('#')
+            ]
+        except (FileNotFoundError, TypeError):
             if self._is_verbose(1):
-                print(f"[!] Wordlist not found: {wordlist_path}")
+                print(f"[!] Wordlist not found: web_ntlm_paths.dict")
             return self._check_basic_paths(host, port, use_ssl)
 
-        with open(wordlist_path, 'r') as f:
-            paths = [line.strip() for line in f if line.strip() and not line.startswith('#')]
-
         if self._is_verbose(2):
             print(f"[*] Enumerating {len(paths)} paths on {scheme}://{host}:{port}")
-
         ntlm_paths = []
 
         # Use thread pool for concurrent path checking (20 threads for speed)
diff --git a/web_ntlm_paths.dict b/protocols/web_ntlm_paths.dict
similarity index 100%
rename from web_ntlm_paths.dict
rename to protocols/web_ntlm_paths.dict
diff --git a/pyproject.toml b/pyproject.toml
index ab0384b..e47753f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "relayking"
-version = "1.0.0"
+version = "1.1.1"
 description = "NTLM & Kerberos Relay Detection and Enumeration Tool"
 readme = "README.md"
 license = {text = "MIT"}
@@ -33,6 +33,9 @@ relayking = "relayking:main"
 [tool.setuptools.packages.find]
 where = ["."]
 
+[tool.setuptools.package-data]
+protocols = ["*.dict"]
+
 [tool.setuptools]
 py-modules = ["relayking"]