cobaltstrike
YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'cobaltstrike' taken from the ThreatHunting-Keywords github project
rule cobaltstrike
{
meta:
description = "Detection patterns for the tool 'cobaltstrike' taken from the ThreatHunting-Keywords github project"
author = "@mthcht"
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
tool = "cobaltstrike"
rule_category = "offensive_tool_keyword"
strings:
$string1 = /\s\$exploit_oneliner/ nocase ascii wide
$string2 = /\s\$payload_oneliner\s/ nocase ascii wide
$string3 = /\s\.beacon_keys\s\-/ nocase ascii wide
$string4 = /\s\/NAME\:.{0,1000}\s\/KILL/ nocase ascii wide
$string5 = /\s\/PID\:.{0,1000}\s\/DRIVER\:/ nocase ascii wide
$string6 = /\s\/PID\:.{0,1000}\s\/KILL/ nocase ascii wide
$string7 = /\s\/ticket\:.{0,1000}\s\/service\:.{0,1000}\s\/targetdomain\:.{0,1000}\s\/targetdc\:/ nocase ascii wide
$string8 = /\s\/user\:.{0,1000}\s\/password\:.{0,1000}\s\/enctype\:.{0,1000}\s\/opsec\s\/ptt/ nocase ascii wide
$string9 = /\s1\.2\.3\.4\:8080/ nocase ascii wide
$string10 = " 4444 meter" nocase ascii wide
$string11 = " 4444 shell" nocase ascii wide
$string12 = " amsi_disable " nocase ascii wide
$string13 = /\sarp\.x64\.o/ nocase ascii wide
$string14 = " --assemblyargs AntiVirus" nocase ascii wide
$string15 = " --assemblyargs AppLocker" nocase ascii wide
$string16 = " base64_encode_shellcode" nocase ascii wide
$string17 = /\sbeacon\.dll/ nocase ascii wide
$string18 = " bof_allocator " nocase ascii wide
$string19 = " bof_reuse_memory " nocase ascii wide
$string20 = " -BOFBytes " nocase ascii wide
$string21 = " BOFNET " nocase ascii wide
$string22 = /\sBofRunner\(/ nocase ascii wide
$string23 = /\sbuild\sDent\.go/ nocase ascii wide
$string24 = " build_letmeout" nocase ascii wide
$string25 = /\sBypassUac.{0,1000}\.bat/ nocase ascii wide
$string26 = /\sBypassUac.{0,1000}\.dll/ nocase ascii wide
$string27 = /\sBypassUac.{0,1000}\.exe/ nocase ascii wide
$string28 = /\s\-c\sCredEnum\.c/ nocase ascii wide
$string29 = " chrome logindata " nocase ascii wide
$string30 = " chrome masterkey " nocase ascii wide
$string31 = " -cobalt " nocase ascii wide
$string32 = " cobaltstrike" nocase ascii wide
$string33 = " CoffeeExecuteFunction" nocase ascii wide
$string34 = /\scom\.blackh4t/ nocase ascii wide
$string35 = " CrossC2 Listener" nocase ascii wide
$string36 = /\sCrossC2\./ nocase ascii wide
$string37 = " CrossC2Kit " nocase ascii wide
$string38 = /\sDelegationBOF\.c\s/ nocase ascii wide
$string39 = /\sdelegationx64\.o/ nocase ascii wide
$string40 = /\sdelegationx86\.o/ nocase ascii wide
$string41 = /\sDesertFox\.go/ nocase ascii wide
$string42 = /\sdetect\-hooks\.c\s/ nocase ascii wide
$string43 = " -dns_stager_prepend " nocase ascii wide
$string44 = " -dns_stager_subhost " nocase ascii wide
$string45 = /\s\-\-dotnetassembly\s.{0,1000}\s\-\-amsi/ nocase ascii wide
$string46 = /\s\-\-dotnetassembly\s.{0,1000}\s\-\-appdomain\s/ nocase ascii wide
$string47 = /\s\-\-dotnetassembly\s.{0,1000}\s\-\-assemblyargs\s/ nocase ascii wide
$string48 = /\s\-\-dotnetassembly\s.{0,1000}\s\-\-mailslot/ nocase ascii wide
$string49 = /\s\-\-dotnetassembly\s.{0,1000}\s\-\-pipe\s/ nocase ascii wide
$string50 = " DraytekScan" nocase ascii wide
$string51 = " dump_memory64" nocase ascii wide
$string52 = " edge logindata " nocase ascii wide
$string53 = " edge masterkey " nocase ascii wide
$string54 = " EfsPotato" nocase ascii wide
$string55 = /\sexclusion\.c\s\/Fodefender\.o/ nocase ascii wide
$string56 = " -FakeCmdLine " nocase ascii wide
$string57 = " FileZillaPwd" nocase ascii wide
$string58 = /\sforgeTGT\(/ nocase ascii wide
$string59 = " FtpSniffer " nocase ascii wide
$string60 = " generate_my_dll" nocase ascii wide
$string61 = " generatePayload" nocase ascii wide
$string62 = " GetAppLockerPolicies" nocase ascii wide
$string63 = " GetLsassPid" nocase ascii wide
$string64 = /\sgophish\-.{0,1000}\.zip/ nocase ascii wide
$string65 = " HackBrowserData" nocase ascii wide
$string66 = " -hasbootstraphint " nocase ascii wide
$string67 = /\sHiddenDesktop\.cna/ nocase ascii wide
$string68 = /\shollow\.x64\./ nocase ascii wide
$string69 = /\shostenum\.py\s/ nocase ascii wide
$string70 = " HTTPSniffer " nocase ascii wide
$string71 = /\s\-i\shavex\.profile\s/ nocase ascii wide
$string72 = " impacket " nocase ascii wide
$string73 = " -Injector NtMapViewOfSection" nocase ascii wide
$string74 = " -Injector VirtualAllocEx" nocase ascii wide
$string75 = " -isbeacon " nocase ascii wide
$string76 = " JspShell ua" nocase ascii wide
$string77 = " k8gege520 " nocase ascii wide
$string78 = /\skdbof\.cpp/ nocase ascii wide
$string79 = /\sLadon\.ps1/ nocase ascii wide
$string80 = /\sLadon\.py/ nocase ascii wide
$string81 = " --load-shellcode " nocase ascii wide
$string82 = /\smalleable\.profile/ nocase ascii wide
$string83 = " malleable-c2-randomizer" nocase ascii wide
$string84 = /\smemreader\.c\s/ nocase ascii wide
$string85 = " MemReader_BoF" nocase ascii wide
$string86 = " ms17010 -i " nocase ascii wide
$string87 = " ms17010 -n " nocase ascii wide
$string88 = " NTLMv1 captured " nocase ascii wide
$string89 = " -o /share/payloads/" nocase ascii wide
$string90 = " oxidfind -i " nocase ascii wide
$string91 = " oxidfind -n " nocase ascii wide
$string92 = " --payload-types all" nocase ascii wide
$string93 = " --payload-types bin" nocase ascii wide
$string94 = " --payload-types dll" nocase ascii wide
$string95 = " --payload-types exe" nocase ascii wide
$string96 = " --payload-types ps1" nocase ascii wide
$string97 = " --payload-types py" nocase ascii wide
$string98 = /\s\-\-payload\-types\ssvc\.exe/ nocase ascii wide
$string99 = " --payload-types vbs" nocase ascii wide
$string100 = " -PE_Clone " nocase ascii wide
$string101 = " Perform S4U constrained delegation abuse" nocase ascii wide
$string102 = " pipename_stager " nocase ascii wide
$string103 = " -pipename_stager " nocase ascii wide
$string104 = " pyasn1 " nocase ascii wide
$string105 = /\spyasn1\./ nocase ascii wide
$string106 = " rai-attack-dns" nocase ascii wide
$string107 = " rai-attack-http" nocase ascii wide
$string108 = " ReadFromLsass" nocase ascii wide
$string109 = " -RealCmdLine " nocase ascii wide
$string110 = " rustbof " nocase ascii wide
$string111 = /\sScareCrow\.go/ nocase ascii wide
$string112 = /\sScareCrow\.go/ nocase ascii wide
$string113 = /\sSeriousSam\.Execute\s/ nocase ascii wide
$string114 = " SetMzLogonPwd " nocase ascii wide
$string115 = /\ssigflip\.c\s/ nocase ascii wide
$string116 = /\sSigFlip\.exe/ nocase ascii wide
$string117 = /\sSigFlip\.PE/ nocase ascii wide
$string118 = /\ssigflip\.x64\./ nocase ascii wide
$string119 = /\ssigflip\.x86\./ nocase ascii wide
$string120 = " SigLoader " nocase ascii wide
$string121 = " Sigwhatever" nocase ascii wide
$string122 = /\sspawn\.x64\.c/ nocase ascii wide
$string123 = /\sspawn\.x64\.o/ nocase ascii wide
$string124 = " spawnto_x64 " nocase ascii wide
$string125 = " spawnto_x86 " nocase ascii wide
$string126 = /\sSpoolFool\s.{0,1000}\.dll/ nocase ascii wide
$string127 = /\sStayKit\.cna/ nocase ascii wide
$string128 = /\sstriker\.py/ nocase ascii wide
$string129 = " SweetPotato by @_EthicalChaos" nocase ascii wide
$string130 = " SysWhispers" nocase ascii wide
$string131 = " TikiLoader" nocase ascii wide
$string132 = /\sTokenStrip\.c\s/ nocase ascii wide
$string133 = /\sTokenStripBOF\.o\s/ nocase ascii wide
$string134 = " TSCHRPCAttack" nocase ascii wide
$string135 = /\s\-urlcache\s.{0,1000}\/debase64\// nocase ascii wide
$string136 = /\s\-wordlist\s.{0,1000}\s\-spawnto\s/ nocase ascii wide
$string137 = " WriteToLsass" nocase ascii wide
$string138 = " xpipe" nocase ascii wide
$string139 = /\$C2_SERVER/ nocase ascii wide
$string140 = /\.\/c2lint\s/
$string141 = /\.\/Dent\s\-/
$string142 = /\.\/manjusaka/
$string143 = /\.\/ScareCrow\s/
$string144 = /\.\/SourcePoint\s/
$string145 = /\.admin\.123456\./ nocase ascii wide
$string146 = /\.api\.123456\./ nocase ascii wide
$string147 = /\.apps\.123456\./ nocase ascii wide
$string148 = /\.beta\.123456\./ nocase ascii wide
$string149 = /\.blog\.123456\./ nocase ascii wide
$string150 = /\.cobaltstrike/ nocase ascii wide
$string151 = /\.cobaltstrike\.beacon_keys/ nocase ascii wide
$string152 = /\.cobaltstrike\.beacon_keys/ nocase ascii wide
$string153 = /\.com\/dcsync\// nocase ascii wide
$string154 = /\.dev\.123456\./ nocase ascii wide
$string155 = /\.events\.123456\./ nocase ascii wide
$string156 = /\.exe\s.{0,1000}\s\-eventlog\s.{0,1000}Key\sManagement\sService/ nocase ascii wide
$string157 = /\.exe\s.{0,1000}\s\-\-source\sPersistence/ nocase ascii wide
$string158 = /\.feeds\.123456\./ nocase ascii wide
$string159 = /\.files\.123456\./ nocase ascii wide
$string160 = /\.forums\.123456\./ nocase ascii wide
$string161 = /\.ftp\.123456\./ nocase ascii wide
$string162 = /\.go\.123456\./ nocase ascii wide
$string163 = /\.groups\.123456\./ nocase ascii wide
$string164 = /\.help\.123456\./ nocase ascii wide
$string165 = /\.imap\.123456\./ nocase ascii wide
$string166 = /\.img\.123456\./ nocase ascii wide
$string167 = /\.kb\.123456\./ nocase ascii wide
$string168 = /\.lists\.123456\./ nocase ascii wide
$string169 = /\.live\.123456\./ nocase ascii wide
$string170 = /\.m\.123456\./ nocase ascii wide
$string171 = /\.mail\.123456\./ nocase ascii wide
$string172 = /\.media\.123456\./ nocase ascii wide
$string173 = /\.mobile\.123456\./ nocase ascii wide
$string174 = /\.mysql\.123456\./ nocase ascii wide
$string175 = /\.news\.123456\./ nocase ascii wide
$string176 = /\.photos\.123456\./ nocase ascii wide
$string177 = /\.pic\.123456\./ nocase ascii wide
$string178 = /\.pipename_stager/ nocase ascii wide
$string179 = /\.pop\.123456\./ nocase ascii wide
$string180 = /\.py\s.{0,1000}\s\-\-teamserver\s/ nocase ascii wide
$string181 = /\.py\s127\.0\.0\.1\s50050\slogtracker\spassword/ nocase ascii wide
$string182 = /\.py.{0,1000}\s\-\-payload\s.{0,1000}\.ps1/ nocase ascii wide
$string183 = /\.py.{0,1000}\s\-service\-name\s.{0,1000}\s\-hashes\s/ nocase ascii wide
$string184 = /\.resources\.123456\./ nocase ascii wide
$string185 = /\.search\.123456\./ nocase ascii wide
$string186 = /\.secure\.123456\./ nocase ascii wide
$string187 = /\.sharpgen\s/ nocase ascii wide
$string188 = /\.sites\.123456\./ nocase ascii wide
$string189 = /\.smtp\.123456\./ nocase ascii wide
$string190 = /\.ssl\.123456\./ nocase ascii wide
$string191 = /\.stage\.123456\./ nocase ascii wide
$string192 = /\.stage\.123456\./ nocase ascii wide
$string193 = /\.static\.123456\./ nocase ascii wide
$string194 = /\.status\.123456\./ nocase ascii wide
$string195 = /\.store\.123456\./ nocase ascii wide
$string196 = /\.support\.123456\./ nocase ascii wide
$string197 = /\.videos\.123456\./ nocase ascii wide
$string198 = /\.vpn\.123456\./ nocase ascii wide
$string199 = /\.webmail\.123456\./ nocase ascii wide
$string200 = /\.wiki\.123456\./ nocase ascii wide
$string201 = /\/\.aggressor\.prop/ nocase ascii wide
$string202 = /\/\.ssh\/RAI\.pub/ nocase ascii wide
$string203 = "//StaticSyscallsDump/" nocase ascii wide
$string204 = "/78dc91f1A716DBBAA9E4E12C884C1CB1C27FFF2BEEED7DF1" nocase ascii wide
$string205 = "/78dc91f1A716DBBAA9E4E12C884C1CB1C27FFF2BEEED7DF1" nocase ascii wide
$string206 = /\/AceLdr\.cna/ nocase ascii wide
$string207 = "/adcs_enum/" nocase ascii wide
$string208 = /\/adcs_request\/adcs_request\./ nocase ascii wide
$string209 = /\/adcs_request\/CertCli\./ nocase ascii wide
$string210 = /\/adcs_request\/certenroll\./ nocase ascii wide
$string211 = /\/adcs_request\/CertPol\./ nocase ascii wide
$string212 = /\/AddUser\-Bof\./ nocase ascii wide
$string213 = "/AddUser-Bof/" nocase ascii wide
$string214 = /\/AggressiveClean\.cna/ nocase ascii wide
$string215 = /\/aggressor\/.{0,1000}\.java/ nocase ascii wide
$string216 = "/aggressor-powerview" nocase ascii wide
$string217 = "/AggressorScripts" nocase ascii wide
$string218 = "/AggressorScripts" nocase ascii wide
$string219 = "/AggressorScripts" nocase ascii wide
$string220 = "/agscript "
$string221 = "/agscript " nocase ascii wide
$string222 = /\/Alaris\.sln/ nocase ascii wide
$string223 = /\/ANGRYPUPPY\.cna/ nocase ascii wide
$string224 = "/anthemtotheego/CredBandit" nocase ascii wide
$string225 = /\/artifactor\.py/ nocase ascii wide
$string226 = "/ase_docker/" nocase ascii wide
$string227 = /\/asprox\.profile/ nocase ascii wide
$string228 = /\/asprox\.profile/ nocase ascii wide
$string229 = /\/ASRenum\.cpp/ nocase ascii wide
$string230 = /\/ASRenum\.cs/ nocase ascii wide
$string231 = "/ASRenum-BOF" nocase ascii wide
$string232 = /\/assets\/bin2uuids_file\.py/ nocase ascii wide
$string233 = "/AttackServers/" nocase ascii wide
$string234 = /\/auth\/cc2_auth\./ nocase ascii wide
$string235 = "/awesome-pentest" nocase ascii wide
$string236 = /\/backoff\.profile/ nocase ascii wide
$string237 = "/backstab_src/" nocase ascii wide
$string238 = "/BackupPrivSam/" nocase ascii wide
$string239 = /\/bazarloader\.profile/ nocase ascii wide
$string240 = "/beacon_compatibility" nocase ascii wide
$string241 = /\/beacon_compatibility\./ nocase ascii wide
$string242 = "/beacon_funcs/" nocase ascii wide
$string243 = "/beacon_health_check/" nocase ascii wide
$string244 = "/beacon_http/" nocase ascii wide
$string245 = /\/beacon_notify\.cna/ nocase ascii wide
$string246 = /\/beaconhealth\.cna/ nocase ascii wide
$string247 = "/beacon-injection/" nocase ascii wide
$string248 = "/beacon-object-file" nocase ascii wide
$string249 = /\/BeaconTool\.java/ nocase ascii wide
$string250 = "/bin/AceLdr"
$string251 = /\/bin\/Sleeper\.o/
$string252 = "/bluscreenofjeff/" nocase ascii wide
$string253 = /\/bof\.h/ nocase ascii wide
$string254 = /\/BOF\.NET\// nocase ascii wide
$string255 = /\/bof\.nim/ nocase ascii wide
$string256 = /\/bof\.x64\.o/ nocase ascii wide
$string257 = /\/bof\.x64\.o/ nocase ascii wide
$string258 = /\/bof\.x86\.o/ nocase ascii wide
$string259 = /\/bof\.x86\.o/ nocase ascii wide
$string260 = /\/bof\/bof\.c/ nocase ascii wide
$string261 = /\/bof\/bof\.vcxproj/ nocase ascii wide
$string262 = "/bof/IABOF" nocase ascii wide
$string263 = /\/bof\/IAStart\.asm/ nocase ascii wide
$string264 = "/BOF-Builder" nocase ascii wide
$string265 = "/bof-collection/" nocase ascii wide
$string266 = "/BOFNETExamples/" nocase ascii wide
$string267 = "/BOF-RegSave" nocase ascii wide
$string268 = /\/BofRunner\.cs/ nocase ascii wide
$string269 = /\/BOFs\.git/ nocase ascii wide
$string270 = "/bof-vs-template/" nocase ascii wide
$string271 = "/bof-vs-template/" nocase ascii wide
$string272 = "/boku7/spawn" nocase ascii wide
$string273 = "/boku7/whereami/" nocase ascii wide
$string274 = /\/BokuLoader\.c/ nocase ascii wide
$string275 = /\/BokuLoader\.h/ nocase ascii wide
$string276 = "/BokuLoader/" nocase ascii wide
$string277 = /\/BooExecutor\.cs/ nocase ascii wide
$string278 = "/bq1iFEP2/assert/dll/" nocase ascii wide
$string279 = "/bq1iFEP2/assert/exe/" nocase ascii wide
$string280 = /\/breg\.x64\.o/ nocase ascii wide
$string281 = /\/breg\.x86\.o/ nocase ascii wide
$string282 = "/build/encrypted_shellcode" nocase ascii wide
$string283 = "/build/formatted_shellcode" nocase ascii wide
$string284 = "/build/shellcode" nocase ascii wide
$string285 = "/BuildBOFs/" nocase ascii wide
$string286 = /\/burpee\.py/ nocase ascii wide
$string287 = "/BUYTHEAPTDETECTORNOW" nocase ascii wide
$string288 = "/BypassAV/" nocase ascii wide
$string289 = "/bypassAV-1/" nocase ascii wide
$string290 = "/C2concealer" nocase ascii wide
$string291 = /\/c2profile\./ nocase ascii wide
$string292 = /\/c2profile\.go/ nocase ascii wide
$string293 = "/C2script/" nocase ascii wide
$string294 = /\/cc2_frp\./ nocase ascii wide
$string295 = /\/client\/bof\/.{0,1000}\.asm/ nocase ascii wide
$string296 = /\/clipboardinject\./ nocase ascii wide
$string297 = "/clipboardinject/" nocase ascii wide
$string298 = /\/clipmon\/clipmon\.sln/ nocase ascii wide
$string299 = "/clipmon/dll/" nocase ascii wide
$string300 = /\/cna\/pipetest\.cna/ nocase ascii wide
$string301 = /\/cobaltclip\.c/ nocase ascii wide
$string302 = /\/cobaltclip\.o/ nocase ascii wide
$string303 = "/Cobalt-Clip/" nocase ascii wide
$string304 = "/cobaltstrike" nocase ascii wide
$string305 = "/cobalt-strike" nocase ascii wide
$string306 = /\/CobaltStrike_OpenBeacon\.git/ nocase ascii wide
$string307 = /\/CoffeeLdr\.c/ nocase ascii wide
$string308 = "/CoffeeLdr/" nocase ascii wide
$string309 = "/COFFLoader" nocase ascii wide
$string310 = "/COFFLoader2/" nocase ascii wide
$string311 = "/com/blackh4t/" nocase ascii wide
$string312 = /\/comfoo\.profile/ nocase ascii wide
$string313 = /\/CookieProcessor\.cs/ nocase ascii wide
$string314 = /\/core\/browser_darwin\.go/
$string315 = /\/core\/browser_linux\.go/
$string316 = /\/core\/browser_windows\.go/ nocase ascii wide
$string317 = "/Cracked5pider/" nocase ascii wide
$string318 = "/credBandit/" nocase ascii wide
$string319 = /\/CredEnum\.c/ nocase ascii wide
$string320 = /\/CredEnum\.cna/ nocase ascii wide
$string321 = /\/CredEnum\.h/ nocase ascii wide
$string322 = /\/CredPrompt\.exe/ nocase ascii wide
$string323 = /\/CredPrompt\/credprompt\.c/ nocase ascii wide
$string324 = /\/CrossC2\./ nocase ascii wide
$string325 = "/CrossC2/" nocase ascii wide
$string326 = "/CrossC2Kit" nocase ascii wide
$string327 = "/CrossC2Kit/" nocase ascii wide
$string328 = "/CrossNet-Beta/" nocase ascii wide
$string329 = "/crypt0p3g/" nocase ascii wide
$string330 = "/cs2modrewrite/" nocase ascii wide
$string331 = "/CS-BOFs/" nocase ascii wide
$string332 = "/CSharpWinRM" nocase ascii wide
$string333 = "/C--Shellcode" nocase ascii wide
$string334 = /\/CS\-Loader\.go/ nocase ascii wide
$string335 = "/CS-Loader/" nocase ascii wide
$string336 = "/csOnvps/" nocase ascii wide
$string337 = "/csOnvps/" nocase ascii wide
$string338 = "/cs-rdll-ipc-example/" nocase ascii wide
$string339 = "/CS-Remote-OPs-BOF" nocase ascii wide
$string340 = "/cs-token-vault/" nocase ascii wide
$string341 = /\/curl\.cna/ nocase ascii wide
$string342 = /\/curl\.x64\.o/ nocase ascii wide
$string343 = /\/curl\.x86\.o/ nocase ascii wide
$string344 = "/custom_payload_generator/" nocase ascii wide
$string345 = "/CWoNaJLBo/VTNeWw11212/" nocase ascii wide
$string346 = "/CWoNaJLBo/VTNeWw11213/" nocase ascii wide
$string347 = "/DCOM Lateral Movement/" nocase ascii wide
$string348 = /\/defender\-exclusions\/.{0,1000}defender/ nocase ascii wide
$string349 = /\/defender\-exclusions\/.{0,1000}exclusion/ nocase ascii wide
$string350 = "/DelegationBOF/" nocase ascii wide
$string351 = /\/demo_bof\.c/ nocase ascii wide
$string352 = /\/Dent\/.{0,1000}\/Loader\/Loader\.go/ nocase ascii wide
$string353 = /\/Dent\/Dent\.go/ nocase ascii wide
$string354 = "/Dent/Loader" nocase ascii wide
$string355 = /\/DesertFox\/archive\/.{0,1000}\.zip/ nocase ascii wide
$string356 = /\/detect\-hooks\.c/ nocase ascii wide
$string357 = /\/detect\-hooks\.cna/ nocase ascii wide
$string358 = /\/detect\-hooks\.h/ nocase ascii wide
$string359 = "/Detect-Hooks/" nocase ascii wide
$string360 = /\/dist\/fw_walk\./ nocase ascii wide
$string361 = "/DLL-Hijack" nocase ascii wide
$string362 = "/Doge-Loader/" nocase ascii wide
$string363 = "/DotNet/SigFlip" nocase ascii wide
$string364 = /\/dukes_apt29\.profile/ nocase ascii wide
$string365 = /\/dump_lsass\./ nocase ascii wide
$string366 = /\/dumpert\.c/ nocase ascii wide
$string367 = "/Dumpert/" nocase ascii wide
$string368 = /\/dumpXor\.exe/ nocase ascii wide
$string369 = "/dumpXor/dumpXor" nocase ascii wide
$string370 = /\/ElevateKit\/elevate\./ nocase ascii wide
$string371 = "/ELFLoader/" nocase ascii wide
$string372 = /\/emotet\.profile/ nocase ascii wide
$string373 = /\/enableuser\/enableuser\.x64\./ nocase ascii wide
$string374 = /\/enableuser\/enableuser\.x86\./ nocase ascii wide
$string375 = /\/EnumCLR\.c/ nocase ascii wide
$string376 = /\/enumerate\.cna/ nocase ascii wide
$string377 = /\/Erebus\/.{0,1000}\.dll/ nocase ascii wide
$string378 = /\/Erebus\/.{0,1000}\.exe/ nocase ascii wide
$string379 = /\/Erebus\-email\./ nocase ascii wide
$string380 = /\/etumbot\.profile/ nocase ascii wide
$string381 = /\/etw\.cna/ nocase ascii wide
$string382 = /\/etw\.x64\./ nocase ascii wide
$string383 = /\/etw\.x86\./ nocase ascii wide
$string384 = "/EventViewerUAC/" nocase ascii wide
$string385 = "/EventViewerUAC/" nocase ascii wide
$string386 = /\/evil\.cpp/ nocase ascii wide
$string387 = /\/exports_function_hid\.txt/ nocase ascii wide
$string388 = /\/fiesta\.profile/ nocase ascii wide
$string389 = /\/fiesta2\.profile/ nocase ascii wide
$string390 = /\/final_shellcode_size\.txt/ nocase ascii wide
$string391 = /\/FindModule\.c/ nocase ascii wide
$string392 = /\/FindObjects\.cna/ nocase ascii wide
$string393 = "/Fodetect-hooksx64" nocase ascii wide
$string394 = "/FuckThatPacker" nocase ascii wide
$string395 = "/G0ldenGunSec/" nocase ascii wide
$string396 = /\/gandcrab\.profile/ nocase ascii wide
$string397 = /\/geacon\.git/ nocase ascii wide
$string398 = /\/geacon\/.{0,1000}beacon/ nocase ascii wide
$string399 = "/geacon_pro" nocase ascii wide
$string400 = /\/get\-loggedon\/.{0,1000}\.c/ nocase ascii wide
$string401 = /\/get\-system\/getsystem\.c/ nocase ascii wide
$string402 = "/GetWebDAVStatus_BOF/" nocase ascii wide
$string403 = /\/globeimposter\.profile/ nocase ascii wide
$string404 = "/guervild/BOFs" nocase ascii wide
$string405 = /\/hancitor\.profile/ nocase ascii wide
$string406 = "/HandleKatz_BOF" nocase ascii wide
$string407 = /\/HaryyUser\.exe/ nocase ascii wide
$string408 = /\/havex\.profile/ nocase ascii wide
$string409 = /\/HiddenDesktop\.git/ nocase ascii wide
$string410 = /\/hollow\.x64\./ nocase ascii wide
$string411 = /\/hooks\/spoof\.c/ nocase ascii wide
$string412 = /\/hostenum\.py/ nocase ascii wide
$string413 = /\/HouQing\/.{0,1000}\/Loader\.go/ nocase ascii wide
$string414 = "/injectAmsiBypass/" nocase ascii wide
$string415 = "/inject-assembly/" nocase ascii wide
$string416 = /\/injectEtw\./ nocase ascii wide
$string417 = "/Injection/clipboard/" nocase ascii wide
$string418 = "/Injection/conhost/" nocase ascii wide
$string419 = "/Injection/createremotethread/" nocase ascii wide
$string420 = "/Injection/ctray/" nocase ascii wide
$string421 = "/Injection/dde/" nocase ascii wide
$string422 = /\/Injection\/Injection\.cna/ nocase ascii wide
$string423 = "/Injection/kernelcallbacktable" nocase ascii wide
$string424 = "/Injection/ntcreatethread" nocase ascii wide
$string425 = "/Injection/ntcreatethread/" nocase ascii wide
$string426 = "/Injection/ntqueueapcthread" nocase ascii wide
$string427 = "/Injection/setthreadcontext" nocase ascii wide
$string428 = "/Injection/svcctrl/" nocase ascii wide
$string429 = "/Injection/tooltip/" nocase ascii wide
$string430 = "/Injection/uxsubclassinfo" nocase ascii wide
$string431 = "/InlineWhispers" nocase ascii wide
$string432 = /\/Internals\/Coff\.cs/ nocase ascii wide
$string433 = /\/Inveigh\.txt/ nocase ascii wide
$string434 = "/Invoke-Bof/" nocase ascii wide
$string435 = /\/Invoke\-HostEnum\.ps1/ nocase ascii wide
$string436 = /\/jaff\.profile/ nocase ascii wide
$string437 = /\/jasperloader\.profile/ nocase ascii wide
$string438 = /\/K8_CS_.{0,1000}_.{0,1000}\.rar/ nocase ascii wide
$string439 = "/k8gege/" nocase ascii wide
$string440 = "/k8gege/scrun/" nocase ascii wide
$string441 = "/k8gege520" nocase ascii wide
$string442 = /\/kdstab\./ nocase ascii wide
$string443 = /\/KDStab\./ nocase ascii wide
$string444 = "/KDStab/" nocase ascii wide
$string445 = /\/Kerbeus\-BOF\.git/ nocase ascii wide
$string446 = "/Kerbeus-BOF/"
$string447 = /\/KernelMii\.c/ nocase ascii wide
$string448 = /\/kronos\.profile/ nocase ascii wide
$string449 = /\/Ladon\.go/ nocase ascii wide
$string450 = /\/Ladon\.ps1/ nocase ascii wide
$string451 = /\/Ladon\.py/ nocase ascii wide
$string452 = /\/Ladon\/Ladon\./ nocase ascii wide
$string453 = "/Ladon/obj/x86" nocase ascii wide
$string454 = "/LadonGo/" nocase ascii wide
$string455 = "/LetMeOutSharp/" nocase ascii wide
$string456 = /\/lib\/ipLookupHelper\.py/ nocase ascii wide
$string457 = /\/loader\/x64\/Release\/loader\.exe/ nocase ascii wide
$string458 = /\/loadercrypt_.{0,1000}\.php/ nocase ascii wide
$string459 = /\/logs\/.{0,1000}\/becon_.{0,1000}\.log/
$string460 = "/logs/beacon_log" nocase ascii wide
$string461 = "/lpBunny/bof-registry" nocase ascii wide
$string462 = /\/lsass\/beacon\.h/ nocase ascii wide
$string463 = /\/magnitude\.profile/ nocase ascii wide
$string464 = "/malleable-c2" nocase ascii wide
$string465 = "/manjusaka/plugins" nocase ascii wide
$string466 = "/MemReader_BoF/" nocase ascii wide
$string467 = /\/mimipenguin\.c/ nocase ascii wide
$string468 = "/mimipenguin/" nocase ascii wide
$string469 = /\/minimal_elf\.h/ nocase ascii wide
$string470 = /\/Misc\/donut\.exe/ nocase ascii wide
$string471 = /\/Mockingjay_BOF\.git/ nocase ascii wide
$string472 = /\/Modules\/Exitservice\/uinit\.exe/ nocase ascii wide
$string473 = "/Mr-Un1k0d3r/" nocase ascii wide
$string474 = "/Native/SigFlip/" nocase ascii wide
$string475 = "/nccgroup/nccfsas/" nocase ascii wide
$string476 = "/Needle_Sift_BOF/" nocase ascii wide
$string477 = "/nettitude/RunOF/" nocase ascii wide
$string478 = /\/NetUser\.cpp/ nocase ascii wide
$string479 = /\/NetUser\.exe/ nocase ascii wide
$string480 = "/netuserenum/" nocase ascii wide
$string481 = "/Network/PortScan/" nocase ascii wide
$string482 = /\/No\-Consolation\.git/ nocase ascii wide
$string483 = "/ntlmrelayx/" nocase ascii wide
$string484 = /\/oab\-parse\/mspack\..{0,1000}\.dll/ nocase ascii wide
$string485 = "/OG-Sadpanda/" nocase ascii wide
$string486 = "/On_Demand_C2/" nocase ascii wide
$string487 = "/opt/implant/" nocase ascii wide
$string488 = "/opt/rai/" nocase ascii wide
$string489 = "/optiv/Dent/" nocase ascii wide
$string490 = /\/oscp\.profile/ nocase ascii wide
$string491 = "/outflanknl/" nocase ascii wide
$string492 = "/output/payloads/" nocase ascii wide
$string493 = "/p292/Phant0m" nocase ascii wide
$string494 = /\/package\/portscan\/.{0,1000}\.go/ nocase ascii wide
$string495 = "/password/mimipenguin/" nocase ascii wide
$string496 = "/payload_scripts" nocase ascii wide
$string497 = "/payload_scripts/artifact" nocase ascii wide
$string498 = "/PersistBOF/" nocase ascii wide
$string499 = "/PhishingServer/" nocase ascii wide
$string500 = /\/pitty_tiger\.profile/ nocase ascii wide
$string501 = /\/PoolPartyBof\.c/ nocase ascii wide
$string502 = /\/PoolPartyBof\.git/ nocase ascii wide
$string503 = /\/PoolPartyBof\.x64\.o/ nocase ascii wide
$string504 = /\/popCalc\.bin/ nocase ascii wide
$string505 = "/PortBender/" nocase ascii wide
$string506 = /\/portscan\.cna/ nocase ascii wide
$string507 = /\/POSeidon\.profile/ nocase ascii wide
$string508 = /\/PowerView\.cna/ nocase ascii wide
$string509 = /\/PowerView3\.cna/ nocase ascii wide
$string510 = "/PPEnum/" nocase ascii wide
$string511 = /\/ppldump\./ nocase ascii wide
$string512 = "/PPLDump_BOF/" nocase ascii wide
$string513 = /\/PrintMonitorDll\./ nocase ascii wide
$string514 = "/PrintMonitorDll/" nocase ascii wide
$string515 = "/PrintSpoofer/" nocase ascii wide
$string516 = "/PrivilegeEscalation/" nocase ascii wide
$string517 = /\/proberbyte\.go/ nocase ascii wide
$string518 = /\/Proxy_Def_File_Generator\.cna/ nocase ascii wide
$string519 = /\/putter\.profile/ nocase ascii wide
$string520 = "/pyasn1/" nocase ascii wide
$string521 = "/pycobalt-" nocase ascii wide
$string522 = "/pycobalt/" nocase ascii wide
$string523 = /\/pystinger\.zip/ nocase ascii wide
$string524 = /\/qakbot\.profile/ nocase ascii wide
$string525 = /\/quantloader\.profile/ nocase ascii wide
$string526 = /\/RAI\.git/ nocase ascii wide
$string527 = /\/ramnit\.profile/ nocase ascii wide
$string528 = /\/ratankba\.profile/ nocase ascii wide
$string529 = /\/raw_shellcode_size\.txt/ nocase ascii wide
$string530 = /\/RC4Payload32\.txt/ nocase ascii wide
$string531 = "/RCStep/CSSG/" nocase ascii wide
$string532 = /\/readfile_bof\./ nocase ascii wide
$string533 = "/Readfile_BoF/" nocase ascii wide
$string534 = "/red-team-scripts" nocase ascii wide
$string535 = /\/RedWarden\.git/ nocase ascii wide
$string536 = /\/RegistryPersistence\.c/ nocase ascii wide
$string537 = "/Registry-Recon/" nocase ascii wide
$string538 = "/Remote/adcs_request/" nocase ascii wide
$string539 = "/Remote/office_tokens/" nocase ascii wide
$string540 = "/Remote/procdump/" nocase ascii wide
$string541 = "/Remote/ProcessDestroy/" nocase ascii wide
$string542 = "/Remote/ProcessListHandles/" nocase ascii wide
$string543 = "/Remote/schtaskscreate/" nocase ascii wide
$string544 = "/Remote/schtasksrun/" nocase ascii wide
$string545 = "/Remote/setuserpass/" nocase ascii wide
$string546 = "/Remote/setuserpass/" nocase ascii wide
$string547 = "/Remote/unexpireuser/" nocase ascii wide
$string548 = /\/remotereg\.c/ nocase ascii wide
$string549 = /\/remotereg\.o/ nocase ascii wide
$string550 = "/RunOF/RunOF/" nocase ascii wide
$string551 = /\/runshellcode\./ nocase ascii wide
$string552 = "/S3cur3Th1sSh1t/" nocase ascii wide
$string553 = /\/saefko\.profile/ nocase ascii wide
$string554 = "/ScareCrow -I "
$string555 = /\/ScRunHex\.py/ nocase ascii wide
$string556 = "/searchsploit" nocase ascii wide
$string557 = /\/Seatbelt\.txt/ nocase ascii wide
$string558 = /\/secinject\.c/ nocase ascii wide
$string559 = /\/self_delete\.cna/ nocase ascii wide
$string560 = /\/SeriousSam\.sln/ nocase ascii wide
$string561 = "/serverscan/CobaltStrike" nocase ascii wide
$string562 = "/serverscan_Air" nocase ascii wide
$string563 = "/serverscan_pro" nocase ascii wide
$string564 = "/ServerScanForLinux/"
$string565 = "/ServerScanForWindows/" nocase ascii wide
$string566 = "/ServerScanForWindows/PE" nocase ascii wide
$string567 = "/ServiceMove-BOF/" nocase ascii wide
$string568 = /\/Services\/TransitEXE\.exe/ nocase ascii wide
$string569 = /\/setuserpass\.x64\./ nocase ascii wide
$string570 = /\/setuserpass\.x86\./ nocase ascii wide
$string571 = /\/SharpCalendar\/.{0,1000}\./ nocase ascii wide
$string572 = "/SharpCat/" nocase ascii wide
$string573 = "/SharpCompile/" nocase ascii wide
$string574 = /\/sharpcompile_.{0,1000}\./ nocase ascii wide
$string575 = "/SharpCradle/" nocase ascii wide
$string576 = "/SharpSword/SharpSword" nocase ascii wide
$string577 = "/ShellCode_Loader" nocase ascii wide
$string578 = "/shspawnas/" nocase ascii wide
$string579 = /\/sigflip\.x64\./ nocase ascii wide
$string580 = /\/sigflip\.x86\./ nocase ascii wide
$string581 = /\/SigLoader\.go/ nocase ascii wide
$string582 = "/SigLoader/" nocase ascii wide
$string583 = /\/SilentClean\.exe/ nocase ascii wide
$string584 = /\/SilentClean\/SilentClean\/.{0,1000}\.cs/ nocase ascii wide
$string585 = /\/silentdump\.c/ nocase ascii wide
$string586 = /\/silentdump\.h/ nocase ascii wide
$string587 = "/sleep_python_bridge/" nocase ascii wide
$string588 = /\/Sleeper\/Sleeper\.cna/ nocase ascii wide
$string589 = /\/sleepmask\.cna/ nocase ascii wide
$string590 = /\/spawn\.git/ nocase ascii wide
$string591 = "/spoolsystem/SpoolTrigger/" nocase ascii wide
$string592 = /\/Spray\-AD\./ nocase ascii wide
$string593 = "/Spray-AD/" nocase ascii wide
$string594 = /\/src\/Sleeper\.cpp/ nocase ascii wide
$string595 = "/StaticSyscallsAPCSpawn/" nocase ascii wide
$string596 = "/StaticSyscallsInject/" nocase ascii wide
$string597 = /\/StayKit\.cna/ nocase ascii wide
$string598 = /\/Staykit\/StayKit\./ nocase ascii wide
$string599 = /\/striker\.py/ nocase ascii wide
$string600 = /\/string_of_paerls\.profile/ nocase ascii wide
$string601 = /\/suspendresume\.x64/ nocase ascii wide
$string602 = /\/suspendresume\.x86/ nocase ascii wide
$string603 = "/SweetPotato_CS" nocase ascii wide
$string604 = "/SyscallsInject/" nocase ascii wide
$string605 = /\/taidoor\.profile/ nocase ascii wide
$string606 = /\/tcpshell\.py/ nocase ascii wide
$string607 = /\/teamserver\.service/
$string608 = /\/test32\.dll/ nocase ascii wide
$string609 = /\/test64\.dll/ nocase ascii wide
$string610 = /\/tests\/test\-bof\.ps1/ nocase ascii wide
$string611 = "/tevora-threat/PowerView" nocase ascii wide
$string612 = /\/tgtParse\.py/ nocase ascii wide
$string613 = /\/tgtParse\/tgtParse\./ nocase ascii wide
$string614 = /\/ticketConverter\.exe/ nocase ascii wide
$string615 = "/TikiLoader/" nocase ascii wide
$string616 = /\/TikiSpawn\./ nocase ascii wide
$string617 = "/TikiSpawn/" nocase ascii wide
$string618 = "/TokenStripBOF" nocase ascii wide
$string619 = "/tools/BeaconTool/" nocase ascii wide
$string620 = "/Tools/spoolsystem/" nocase ascii wide
$string621 = "/Tools/Squeak/Squeak" nocase ascii wide
$string622 = /\/trick_ryuk\.profile/ nocase ascii wide
$string623 = /\/trickbot\.profile/ nocase ascii wide
$string624 = /\/UAC\-BOF\-Bonanza\.git/ nocase ascii wide
$string625 = "/UAC-SilentClean/" nocase ascii wide
$string626 = "/unhook-bof" nocase ascii wide
$string627 = "/unhook-bof" nocase ascii wide
$string628 = "/UTWOqVQ132/" nocase ascii wide
$string629 = "/vssenum/" nocase ascii wide
$string630 = /\/WdToggle\.c/ nocase ascii wide
$string631 = /\/WdToggle\.h/ nocase ascii wide
$string632 = /\/webshell\/.{0,1000}\.aspx/ nocase ascii wide
$string633 = /\/webshell\/.{0,1000}\.jsp/ nocase ascii wide
$string634 = /\/webshell\/.{0,1000}\.php/ nocase ascii wide
$string635 = /\/wifidump\.c/ nocase ascii wide
$string636 = /\/WindowsVault\.cna/ nocase ascii wide
$string637 = /\/WindowsVault\.h/ nocase ascii wide
$string638 = /\/winrm\.cpp/ nocase ascii wide
$string639 = "/winrmdll" nocase ascii wide
$string640 = "/winrm-reflective-dll/" nocase ascii wide
$string641 = /\/Winsocky\.git/ nocase ascii wide
$string642 = "/WMI Lateral Movement/" nocase ascii wide
$string643 = "/wwlib/lolbins/" nocase ascii wide
$string644 = /\/xen\-mimi\.ps1/ nocase ascii wide
$string645 = /\/xor\/stager\.txt/ nocase ascii wide
$string646 = /\/xor\/xor\.go/ nocase ascii wide
$string647 = "/xPipe/" nocase ascii wide
$string648 = "/yanghaoi/_CNA" nocase ascii wide
$string649 = /\/zerologon\.cna/ nocase ascii wide
$string650 = /\[\+\]\sPrivileged\sfile\scopy\ssuccess\!\s/ nocase ascii wide
$string651 = /\[\'spawnto\'\]/ nocase ascii wide
$string652 = /\\\\\.\\pipe\\bypassuac/ nocase ascii wide
$string653 = /\\\\\.\\pipe\\hashdump/ nocase ascii wide
$string654 = /\\\\\.\\pipe\\imposecost/ nocase ascii wide
$string655 = /\\\\\.\\pipe\\keylogger/ nocase ascii wide
$string656 = /\\\\\.\\pipe\\mimikatz/ nocase ascii wide
$string657 = /\\\\\.\\pipe\\netview/ nocase ascii wide
$string658 = /\\\\\.\\pipe\\PIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/ nocase ascii wide
$string659 = /\\\\\.\\pipe\\portscan/ nocase ascii wide
$string660 = /\\\\\.\\pipe\\screenshot/ nocase ascii wide
$string661 = /\\\\\.\\pipe\\sshagent/ nocase ascii wide
$string662 = /\\\\\.pipe\\imposingcost/ nocase ascii wide
$string663 = /\\\\\\\\\.\\\\pipe\\\\bypassuac/ nocase ascii wide
$string664 = /\\\\\\\\\.\\\\pipe\\\\hashdump/ nocase ascii wide
$string665 = /\\\\\\\\\.\\\\pipe\\\\keylogger/ nocase ascii wide
$string666 = /\\\\\\\\\.\\\\pipe\\\\mimikatz/ nocase ascii wide
$string667 = /\\\\\\\\\.\\\\pipe\\\\netview/ nocase ascii wide
$string668 = /\\\\\\\\\.\\\\pipe\\\\PIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/ nocase ascii wide
$string669 = /\\\\\\\\\.\\\\pipe\\\\portscan/ nocase ascii wide
$string670 = /\\\\\\\\\.\\\\pipe\\\\screenshot/ nocase ascii wide
$string671 = /\\\\\\\\\.\\\\pipe\\\\sshagent/ nocase ascii wide
$string672 = /\\\\GetWebDAVStatus\.exe/ nocase ascii wide
$string673 = /\\\\pipe\\\\DAV\sRPC\sSERVICE/ nocase ascii wide
$string674 = /\\8e8988b257e9dd2ea44ff03d44d26467b7c9ec16/ nocase ascii wide
$string675 = /\\asreproasting\.c/ nocase ascii wide
$string676 = /\\beacon\.exe/ nocase ascii wide
$string677 = /\\bypassuac\.txt/ nocase ascii wide
$string678 = /\\CrossC2\./ nocase ascii wide
$string679 = /\\CROSSNET\\CROSSNET\\/ nocase ascii wide
$string680 = /\\dumpert\./ nocase ascii wide
$string681 = /\\Dumpert\\/ nocase ascii wide
$string682 = /\\DumpShellcode/ nocase ascii wide
$string683 = /\\dumpXor\.exe/ nocase ascii wide
$string684 = /\\dumpXor\\x64\\/ nocase ascii wide
$string685 = /\\ELF\\portscan/ nocase ascii wide
$string686 = /\\ELF\\serverscan/ nocase ascii wide
$string687 = /\\evil\.dll/ nocase ascii wide
$string688 = /\\geacon\\tools\\BeaconTool\\/ nocase ascii wide
$string689 = /\\GetWebDAVStatus\\/ nocase ascii wide
$string690 = /\\GetWebDAVStatus_x64/ nocase ascii wide
$string691 = /\\HackBrowserData/ nocase ascii wide
$string692 = /\\HiddenDesktop\\/ nocase ascii wide
$string693 = /\\HostEnum\.ps1/ nocase ascii wide
$string694 = /\\kdstab\.exe/ nocase ascii wide
$string695 = /\\kerberoasting\.c/ nocase ascii wide
$string696 = /\\Kerbeus\-BOF\\/ nocase ascii wide
$string697 = /\\Koh\.exe/ nocase ascii wide
$string698 = /\\Koh\.pdb/ nocase ascii wide
$string699 = /\\Koh\\Koh\./ nocase ascii wide
$string700 = /\\Ladon\.exe/ nocase ascii wide
$string701 = /\\Ladon\.ps1/ nocase ascii wide
$string702 = /\\LogonScreen\.exe/ nocase ascii wide
$string703 = /\\lsass\.dmp/ nocase ascii wide
$string704 = /\\Mockingjay_BOF\./ nocase ascii wide
$string705 = /\\No\-Consolation\\source\\/ nocase ascii wide
$string706 = /\\portbender\./ nocase ascii wide
$string707 = /\\PowerView\.cna/ nocase ascii wide
$string708 = /\\PowerView\.exe/ nocase ascii wide
$string709 = /\\PowerView\.ps1/ nocase ascii wide
$string710 = /\\PowerView3\./ nocase ascii wide
$string711 = /\\RunBOF\.exe/ nocase ascii wide
$string712 = /\\RunOF\.exe/ nocase ascii wide
$string713 = /\\RunOF\\bin\\/ nocase ascii wide
$string714 = /\\samantha\.txt/ nocase ascii wide
$string715 = /\\SharpMove\.exe/ nocase ascii wide
$string716 = /\\SigFlip\.exe/ nocase ascii wide
$string717 = /\\SilentClean\.exe/ nocase ascii wide
$string718 = /\\StayKit\.cna/ nocase ascii wide
$string719 = /\\systemic\.txt/ nocase ascii wide
$string720 = /\\TASKSHELL\.EXE/ nocase ascii wide
$string721 = /\\TikiCompiler\.txt/ nocase ascii wide
$string722 = /\\TikiService\.exe/ nocase ascii wide
$string723 = /\\TikiSpawn\./ nocase ascii wide
$string724 = /\\tikispawn\.xml/ nocase ascii wide
$string725 = /\\TikiTorch\\Aggressor/ nocase ascii wide
$string726 = /\\xpipe\.c/ nocase ascii wide
$string727 = /\\xpipe\.o/ nocase ascii wide
$string728 = /\]\scompile\sgeacon\swith\sthe\spublic\skey\sfrom\s\.beacon_keys/ nocase ascii wide
$string729 = /\]\suse\sthe\saes\skey\sfrom\sthe\sbeacon\'s\sonline\sinfo\sto\sencrypt\stransfer\sdata\s\(base64\sformat/ nocase ascii wide
$string730 = /\]\suse\sthe\spublic\skey\sfrom\s\.beacon_keys\sto\sdecrypt\sthe\sbeacon\'s\sonline\sinfo/ nocase ascii wide
$string731 = /\]\sUsing\sKohPipe\s\s\s\s/ nocase ascii wide
$string732 = /\]\sWrote\shijack\sDLL\sto\s/ nocase ascii wide
$string733 = "_cobaltstrike" nocase ascii wide
$string734 = "_find_sharpgen_dll" nocase ascii wide
$string735 = "_pycobalt_" nocase ascii wide
$string736 = /_tcp_cc2\(/ nocase ascii wide
$string737 = /_udp_cc2\(/ nocase ascii wide
$string738 = /\<CoffeLdr\.h\>/ nocase ascii wide
$string739 = "08114a94779a336824a0c62c3d19622fb39aae355962d36a97ba1423a4d6bfcf" nocase ascii wide
$string740 = "0xEr3bus/PoolPartyBof" nocase ascii wide
$string741 = "0xthirteen/MoveKit" nocase ascii wide
$string742 = "0xthirteen/StayKit" nocase ascii wide
$string743 = "4d5350c8-7f8c-47cf-8cde-c752018af17e" nocase ascii wide
$string744 = "5072c4beef28abdb0c53a1f33836facec9e651f6384dedb62611dc3a4d2403d5" nocase ascii wide
$string745 = "516280565958" nocase ascii wide
$string746 = "516280565959" nocase ascii wide
$string747 = "518d6457e2d3e20e470f20b6399ce0f0ff5091dc6d2a0826d658247832ff4a8c" nocase ascii wide
$string748 = "5a40f11a99d0db4a0b06ab5b95c7da4b1c05b55a99c7c443021bff02c2cf93145c53ff5b" nocase ascii wide
$string749 = "5e98194a01c6b48fa582a6a9fcbb92d6" nocase ascii wide
$string750 = "5f9bb909c87cb452a6edbd9da0b5cfdd3f729d7393cf9f7f94e3b731503d072d" nocase ascii wide
$string751 = "6191bb09381c0a8a09db8e7753b7ef89084aaf7557e1605cfeb3abdca258f3ad" nocase ascii wide
$string752 = "6290c67de059c8c86e7051348a1fd0934c8bdf6b9badb539a878a1801b0431d6" nocase ascii wide
$string753 = "6e7645c4-32c5-4fe3-aabf-e94c2f4370e7" nocase ascii wide
$string754 = "713724C3-2367-49FA-B03F-AB4B336FB405" nocase ascii wide
$string755 = "732211ae-4891-40d3-b2b6-85ebd6f5ffff" nocase ascii wide
$string756 = "76318bcd19b5f3efe0e51c77593bccd6804c6a30b95c4c51ec528c30c7faca83" nocase ascii wide
$string757 = /7CFC52\.dll/ nocase ascii wide
$string758 = /7CFC52CD3F\.dll/ nocase ascii wide
$string759 = "913d774e5cf0bfad4adfa900997f7a1a" nocase ascii wide
$string760 = "95502b5e-5763-4ec5-a64c-1e9e33409e2f" nocase ascii wide
$string761 = "9a7dc8a314e69eca7cfcd77046061485331e43c3c153ab9953e9c75f9e3db7d3" nocase ascii wide
$string762 = /AceLdr\..{0,1000}\.bin/ nocase ascii wide
$string763 = /AceLdr\.zip/ nocase ascii wide
$string764 = /adcs_enum\./ nocase ascii wide
$string765 = /adcs_enum_com\./ nocase ascii wide
$string766 = /adcs_enum_com2\./ nocase ascii wide
$string767 = /AddUser\-Bof\.c/ nocase ascii wide
$string768 = /AddUser\-Bof\.git/ nocase ascii wide
$string769 = /AddUser\-Bof\.o/ nocase ascii wide
$string770 = /AddUser\-Bof\.x64/ nocase ascii wide
$string771 = /AddUser\-Bof\.x86/ nocase ascii wide
$string772 = /AddUserToDomainGroup\s.{0,1000}Domain\sAdmins/ nocase ascii wide
$string773 = /AddUserToDomainGroup\./ nocase ascii wide
$string774 = /AddUserToDomainGroup\.cna/ nocase ascii wide
$string775 = "Adminisme/ServerScan/" nocase ascii wide
$string776 = "ag_load_script" nocase ascii wide
$string777 = /AggressiveProxy\.cna/ nocase ascii wide
$string778 = /aggressor\.beacons/ nocase ascii wide
$string779 = /aggressor\.bshell/ nocase ascii wide
$string780 = /aggressor\.cna/ nocase ascii wide
$string781 = /aggressor\.dialog/ nocase ascii wide
$string782 = /aggressor\.println/ nocase ascii wide
$string783 = /aggressor\.py/ nocase ascii wide
$string784 = "Aggressor/TikiTorch" nocase ascii wide
$string785 = "aggressor-scripts" nocase ascii wide
$string786 = "ajpc500/BOFs" nocase ascii wide
$string787 = "Allocated shellcode memory in the target process: " nocase ascii wide
$string788 = "Alphabug_CS" nocase ascii wide
$string789 = "Alphabug_CS" nocase ascii wide
$string790 = "AlphabugX/csOnvps" nocase ascii wide
$string791 = "AlphabugX/csOnvps" nocase ascii wide
$string792 = /Already\sSYSTEM.{0,1000}not\selevating/ nocase ascii wide
$string793 = /ANGRYPUPPY2\.cna/ nocase ascii wide
$string794 = "anthemtotheego/Detect-Hooks" nocase ascii wide
$string795 = "apokryptein/secinject" nocase ascii wide
$string796 = "applocker_enum" nocase ascii wide
$string797 = "applocker-enumerator" nocase ascii wide
$string798 = /apt1_virtuallythere\.profile/ nocase ascii wide
$string799 = /arsenal_kit\.cna/ nocase ascii wide
$string800 = /artifact\.cna/ nocase ascii wide
$string801 = /artifact\.cna/ nocase ascii wide
$string802 = /artifact\.exe/ nocase ascii wide
$string803 = /artifact\.x64\.exe/ nocase ascii wide
$string804 = /artifact\.x86\.dll/ nocase ascii wide
$string805 = /artifact\.x86\.exe/ nocase ascii wide
$string806 = "artifact_payload" nocase ascii wide
$string807 = "artifact_stageless" nocase ascii wide
$string808 = "artifact_stager" nocase ascii wide
$string809 = /artifact32.{0,1000}\.exe/ nocase ascii wide
$string810 = /artifact32\.dll/ nocase ascii wide
$string811 = /artifact32\.exe/ nocase ascii wide
$string812 = /artifact32big\.dll/ nocase ascii wide
$string813 = /artifact32big\.exe/ nocase ascii wide
$string814 = /artifact32svc\.exe/ nocase ascii wide
$string815 = /artifact32svcbig\.exe/ nocase ascii wide
$string816 = /artifact64.{0,1000}\.exe/ nocase ascii wide
$string817 = /artifact64\.dll/ nocase ascii wide
$string818 = /artifact64\.exe/ nocase ascii wide
$string819 = /artifact64\.x64\.dll/ nocase ascii wide
$string820 = /artifact64big\.exe/ nocase ascii wide
$string821 = /artifact64big\.x64\.dll/ nocase ascii wide
$string822 = /artifact64svc\.exe/ nocase ascii wide
$string823 = /artifact64svcbig\.exe/ nocase ascii wide
$string824 = /artifactbig64\.exe/ nocase ascii wide
$string825 = /artifactuac.{0,1000}\.dll/ nocase ascii wide
$string826 = /asktgs\.x64\.o/ nocase ascii wide
$string827 = /ASRenum\-BOF\./ nocase ascii wide
$string828 = /asreproasting\.x64/ nocase ascii wide
$string829 = /Assemblies\/SharpMove\.exe/ nocase ascii wide
$string830 = /AttackTeamFamily.{0,1000}\-bof\-toolset/ nocase ascii wide
$string831 = "ausecwa/bof-registry" nocase ascii wide
$string832 = /auth\/cc2_ssh\./ nocase ascii wide
$string833 = "Backdoor LNK" nocase ascii wide
$string834 = "--backdoor-all" nocase ascii wide
$string835 = "backdoorlnkdialog" nocase ascii wide
$string836 = /backstab\.x64\./ nocase ascii wide
$string837 = /backstab\.x86\./ nocase ascii wide
$string838 = /BackupPrivSAM\s\\\\/ nocase ascii wide
$string839 = /backupprivsam\./ nocase ascii wide
$string840 = /BadPotato\.exe/ nocase ascii wide
$string841 = "bawait_upload" nocase ascii wide
$string842 = "bawait_upload_raw" nocase ascii wide
$string843 = "bblockdlls" nocase ascii wide
$string844 = "bbrowserpivot" nocase ascii wide
$string845 = "bbrowserpivot" nocase ascii wide
$string846 = "bbypassuac" nocase ascii wide
$string847 = "bcc2_setenv" nocase ascii wide
$string848 = "bcc2_spawn" nocase ascii wide
$string849 = "bcrossc2_load_dyn" nocase ascii wide
$string850 = /BC\-SECURITY.{0,1000}Malleable/ nocase ascii wide
$string851 = "bdcsync" nocase ascii wide
$string852 = "bdllinject" nocase ascii wide
$string853 = "bdllinject" nocase ascii wide
$string854 = "bdllload" nocase ascii wide
$string855 = "bdllload" nocase ascii wide
$string856 = "bdllspawn" nocase ascii wide
$string857 = "bdllspawn" nocase ascii wide
$string858 = "be041565c155ce5a9129e2d79a2c8d18acf4143a7f3aa2237c15a15a89b6625e" nocase ascii wide
$string859 = "Beacon Payload Generator" nocase ascii wide
$string860 = /beacon\..{0,1000}winsrv\.dll/ nocase ascii wide
$string861 = /beacon\.CommandBuilder/ nocase ascii wide
$string862 = /beacon\.dll/ nocase ascii wide
$string863 = /beacon\.exe/ nocase ascii wide
$string864 = /beacon\.exe/ nocase ascii wide
$string865 = /beacon\.nim/ nocase ascii wide
$string866 = /Beacon\.Object\.File\.zip/ nocase ascii wide
$string867 = /beacon\.x64.{0,1000}\.dll/ nocase ascii wide
$string868 = /beacon\.x64.{0,1000}\.exe/ nocase ascii wide
$string869 = /beacon\.x64\.dll/ nocase ascii wide
$string870 = /beacon\.x86.{0,1000}\.dll/ nocase ascii wide
$string871 = /beacon\.x86.{0,1000}\.exe/ nocase ascii wide
$string872 = /beacon_api\.h/ nocase ascii wide
$string873 = "beacon_bottom " nocase ascii wide
$string874 = "Beacon_Com_Struct" nocase ascii wide
$string875 = "beacon_command_describe" nocase ascii wide
$string876 = "beacon_command_detail" nocase ascii wide
$string877 = "beacon_command_register" nocase ascii wide
$string878 = "beacon_commands" nocase ascii wide
$string879 = /beacon_compatibility\.c/ nocase ascii wide
$string880 = /beacon_compatibility\.h/ nocase ascii wide
$string881 = "beacon_elevator_describe" nocase ascii wide
$string882 = "beacon_elevator_register" nocase ascii wide
$string883 = "beacon_elevators" nocase ascii wide
$string884 = "beacon_elevators" nocase ascii wide
$string885 = "beacon_execute_job" nocase ascii wide
$string886 = "beacon_exploit_describe" nocase ascii wide
$string887 = "beacon_exploit_register" nocase ascii wide
$string888 = /beacon_funcs\.c/ nocase ascii wide
$string889 = /beacon_funcs\.h/ nocase ascii wide
$string890 = /beacon_funcs\.x64\./ nocase ascii wide
$string891 = /beacon_funcs\.x86\./ nocase ascii wide
$string892 = /beacon_generate\.py/ nocase ascii wide
$string893 = "Beacon_GETPOST" nocase ascii wide
$string894 = "beacon_host_script" nocase ascii wide
$string895 = "beacon_host_script" nocase ascii wide
$string896 = "beacon_inline_execute" nocase ascii wide
$string897 = "beacon_keys -compile geacon_sourcecode_folder" nocase ascii wide
$string898 = "beacon_log_clean" nocase ascii wide
$string899 = /beacon_output_ps\.cna/ nocase ascii wide
$string900 = "beacon_print" nocase ascii wide
$string901 = "BEACON_RDLL_" nocase ascii wide
$string902 = "beacon_remote_exec_" nocase ascii wide
$string903 = "beacon_remote_exec_method_describe" nocase ascii wide
$string904 = "beacon_remote_exec_method_register" nocase ascii wide
$string905 = "beacon_remote_exec_methods" nocase ascii wide
$string906 = "beacon_remote_exploit" nocase ascii wide
$string907 = "beacon_remote_exploit_arch" nocase ascii wide
$string908 = "beacon_remote_exploit_describe" nocase ascii wide
$string909 = "beacon_remote_exploit_register" nocase ascii wide
$string910 = "beacon_remote_exploits" nocase ascii wide
$string911 = /beacon_smb\.exe/ nocase ascii wide
$string912 = "Beacon_Stage_p2_Stuct" nocase ascii wide
$string913 = "beacon_stage_pipe" nocase ascii wide
$string914 = "Beacon_Stage_Struct_p1" nocase ascii wide
$string915 = "Beacon_Stage_Struct_p3" nocase ascii wide
$string916 = "beacon_stage_tcp" nocase ascii wide
$string917 = "beacon_stage_tcp" nocase ascii wide
$string918 = /beacon_test\.exe/ nocase ascii wide
$string919 = "beacon_top " nocase ascii wide
$string920 = "beacon_top_callback" nocase ascii wide
$string921 = /BeaconApi\.cs/ nocase ascii wide
$string922 = "beacon-c2-go" nocase ascii wide
$string923 = "BeaconCleanupProcess" nocase ascii wide
$string924 = /BeaconConsoleWriter\.cs/ nocase ascii wide
$string925 = "BeaconGetSpawnTo" nocase ascii wide
$string926 = "BeaconGetSpawnTo" nocase ascii wide
$string927 = "BeaconGetSpawnTo" nocase ascii wide
$string928 = /beacongrapher\.py/ nocase ascii wide
$string929 = "BeaconInjectProcess" nocase ascii wide
$string930 = "BeaconInjectProcess" nocase ascii wide
$string931 = "BeaconInjectTemporaryProcess" nocase ascii wide
$string932 = "BeaconInjectTemporaryProcess" nocase ascii wide
$string933 = /BeaconJob\.cs/ nocase ascii wide
$string934 = /BeaconJobWriter\.cs/ nocase ascii wide
$string935 = /beaconlogs\.json/ nocase ascii wide
$string936 = /beaconlogtracker\.py/ nocase ascii wide
$string937 = /BeaconNote\.cna/ nocase ascii wide
$string938 = /BeaconNotify\.cna/ nocase ascii wide
$string939 = /BeaconObject\.cs/ nocase ascii wide
$string940 = "BeaconOutputStreamW" nocase ascii wide
$string941 = /BeaconOutputWriter\.cs/ nocase ascii wide
$string942 = /BeaconPrintf\(/ nocase ascii wide
$string943 = "BeaconPrintf" nocase ascii wide
$string944 = "BeaconPrintToStreamW" nocase ascii wide
$string945 = "BeaconSpawnTemporaryProcess" nocase ascii wide
$string946 = "BeaconSpawnTemporaryProcess" nocase ascii wide
$string947 = "BeaconTool -" nocase ascii wide
$string948 = /BeaconTool\s\-i\sonline_info\.txt\s\-aes\sdecrypt/ nocase ascii wide
$string949 = /BeaconTool\/lib\/sleep\.jar/ nocase ascii wide
$string950 = "BeaconUseToken" nocase ascii wide
$string951 = "bgetprivs" nocase ascii wide
$string952 = "bhashdump" nocase ascii wide
$string953 = /bin\/bof_c\.o/ nocase ascii wide
$string954 = /bin\/bof_nim\.o/ nocase ascii wide
$string955 = "bkerberos_ccache_use" nocase ascii wide
$string956 = "bkerberos_ticket_purge" nocase ascii wide
$string957 = "bkerberos_ticket_use" nocase ascii wide
$string958 = "bkeylogger" nocase ascii wide
$string959 = "blockdlls start" nocase ascii wide
$string960 = "blockdlls stop" nocase ascii wide
$string961 = "bloginuser" nocase ascii wide
$string962 = "blogonpasswords" nocase ascii wide
$string963 = "BOF prototype works!" nocase ascii wide
$string964 = /bof.{0,1000}\/CredEnum\// nocase ascii wide
$string965 = /BOF\/.{0,1000}procdump\// nocase ascii wide
$string966 = "bof_allocator" nocase ascii wide
$string967 = /bof_helper\.py/ nocase ascii wide
$string968 = /bof_net_user\.c/ nocase ascii wide
$string969 = /bof_net_user\.o/ nocase ascii wide
$string970 = "bof_reuse_memory" nocase ascii wide
$string971 = "BOF2shellcode" nocase ascii wide
$string972 = /bof2shellcode\.py/ nocase ascii wide
$string973 = "BOF-DLL-Inject" nocase ascii wide
$string974 = "bofentry::bof_entry" nocase ascii wide
$string975 = "BOF-ForeignLsass" nocase ascii wide
$string976 = /BOF\-IShellWindows\-DCOM\./ nocase ascii wide
$string977 = "BofLdapSignCheck" nocase ascii wide
$string978 = /bofloader\.bin/ nocase ascii wide
$string979 = /bofnet.{0,1000}SeriousSam\./ nocase ascii wide
$string980 = /BOFNET\.Bofs/ nocase ascii wide
$string981 = /bofnet\.cna/ nocase ascii wide
$string982 = /BOFNET\.csproj/ nocase ascii wide
$string983 = /BOFNET\.sln/ nocase ascii wide
$string984 = /bofnet_boo\s.{0,1000}\.boo/ nocase ascii wide
$string985 = "bofnet_execute " nocase ascii wide
$string986 = /bofnet_execute\./ nocase ascii wide
$string987 = "bofnet_init" nocase ascii wide
$string988 = "bofnet_job " nocase ascii wide
$string989 = "bofnet_jobkill" nocase ascii wide
$string990 = "bofnet_jobs" nocase ascii wide
$string991 = "bofnet_jobstatus " nocase ascii wide
$string992 = "bofnet_list" nocase ascii wide
$string993 = "bofnet_listassembiles" nocase ascii wide
$string994 = /bofnet_load\s.{0,1000}\./ nocase ascii wide
$string995 = "bofnet_shutdown" nocase ascii wide
$string996 = "BOFNET_Tests" nocase ascii wide
$string997 = "bofportscan " nocase ascii wide
$string998 = /bof\-quser\s.{0,1000}\./ nocase ascii wide
$string999 = /bof\-quser\.cna/ nocase ascii wide
$string1000 = "bof-rdphijack" nocase ascii wide
$string1001 = "bof-regsave " nocase ascii wide
$string1002 = "BofRunnerOutput" nocase ascii wide
$string1003 = /BOFs.{0,1000}\/SyscallsSpawn\// nocase ascii wide
$string1004 = "Bofs/AssemblyLoader" nocase ascii wide
$string1005 = "bof-servicemove " nocase ascii wide
$string1006 = "bof-trustedpath-uacbypass" nocase ascii wide
$string1007 = "boku_pe_customMZ" nocase ascii wide
$string1008 = "boku_pe_customPE" nocase ascii wide
$string1009 = "boku_pe_dll" nocase ascii wide
$string1010 = "boku_pe_mask_" nocase ascii wide
$string1011 = "boku_pe_MZ_from_C2Profile" nocase ascii wide
$string1012 = "boku_strrep" nocase ascii wide
$string1013 = "boku7/BokuLoader" nocase ascii wide
$string1014 = "boku7/HOLLOW" nocase ascii wide
$string1015 = /BokuLoader\.cna/ nocase ascii wide
$string1016 = /BokuLoader\.exe/ nocase ascii wide
$string1017 = /BokuLoader\.x64/ nocase ascii wide
$string1018 = /BooExecutorImpl\.cs/ nocase ascii wide
$string1019 = "bpassthehash" nocase ascii wide
$string1020 = "bpowerpick" nocase ascii wide
$string1021 = "bpsexec_command" nocase ascii wide
$string1022 = "bpsexec_command" nocase ascii wide
$string1023 = "bpsexec_psh" nocase ascii wide
$string1024 = "bpsinject" nocase ascii wide
$string1025 = /breg\sadd\s.{0,1000}HK/ nocase ascii wide
$string1026 = /breg\sdelete\s.{0,1000}HK/ nocase ascii wide
$string1027 = /breg\squery\s.{0,1000}HK/ nocase ascii wide
$string1028 = "breg_add_string_value" nocase ascii wide
$string1029 = "bremote_exec" nocase ascii wide
$string1030 = "browser_##" nocase ascii wide
$string1031 = "browserpivot " nocase ascii wide
$string1032 = "brun_script_in_mem" nocase ascii wide
$string1033 = "brunasadmin" nocase ascii wide
$string1034 = "bshinject" nocase ascii wide
$string1035 = "bshinject" nocase ascii wide
$string1036 = "bshspawn" nocase ascii wide
$string1037 = "bsteal_token" nocase ascii wide
$string1038 = "bsteal_token" nocase ascii wide
$string1039 = /build\sSourcePoint\.go/ nocase ascii wide
$string1040 = /build\/breg\.cna/ nocase ascii wide
$string1041 = "build_c_shellcode" nocase ascii wide
$string1042 = /BuildBOFs\.exe/ nocase ascii wide
$string1043 = /BuildBOFs\.sln/ nocase ascii wide
$string1044 = "Building Koh BOFs" nocase ascii wide
$string1045 = /bupload_raw.{0,1000}\.dll/ nocase ascii wide
$string1046 = /burp2malleable\./ nocase ascii wide
$string1047 = "Bypass Success! Now impersonating the forged token" nocase ascii wide
$string1048 = /BypassAV\.exe/ nocase ascii wide
$string1049 = /bypass\-pipe\.c/ nocase ascii wide
$string1050 = "byt3bl33d3r/BOF-Nim" nocase ascii wide
$string1051 = /\-c\sBOF\.cpp\s\-o\sBOF\.o/ nocase ascii wide
$string1052 = /\-c\sBOF\.cpp\s\-o\sBOF\.x64\.o/ nocase ascii wide
$string1053 = /C\:\\Temp\\poc\.txt/ nocase ascii wide
$string1054 = /C\:\\Windows\\Temp\\move\.exe/ nocase ascii wide
$string1055 = /C\:\\Windows\\Temp\\moveme\.exe/ nocase ascii wide
$string1056 = /C\?\?\/generator\.cpp/ nocase ascii wide
$string1057 = "c2lint " nocase ascii wide
$string1058 = "C2ListenerPort" nocase ascii wide
$string1059 = /\-c2\-randomizer\.py/ nocase ascii wide
$string1060 = "C2ReverseClint" nocase ascii wide
$string1061 = "C2ReverseProxy" nocase ascii wide
$string1062 = "C2ReverseServer" nocase ascii wide
$string1063 = /C2script\/proxy\./ nocase ascii wide
$string1064 = "'c2server'" nocase ascii wide
$string1065 = "c5c2ca31085c518b48980da28238d622ba5bb77d0caf36bae116ad90c2a7920f" nocase ascii wide
$string1066 = /CACTUSTORCH\.cna/ nocase ascii wide
$string1067 = /CACTUSTORCH\.cs/ nocase ascii wide
$string1068 = /CACTUSTORCH\.hta/ nocase ascii wide
$string1069 = /CACTUSTORCH\.js/ nocase ascii wide
$string1070 = /CACTUSTORCH\.vba/ nocase ascii wide
$string1071 = /CACTUSTORCH\.vbe/ nocase ascii wide
$string1072 = /CACTUSTORCH\.vbs/ nocase ascii wide
$string1073 = "CALLBACK_HASHDUMP" nocase ascii wide
$string1074 = "CALLBACK_KEYSTROKES" nocase ascii wide
$string1075 = "CALLBACK_NETVIEW" nocase ascii wide
$string1076 = "CALLBACK_PORTSCAN" nocase ascii wide
$string1077 = "CALLBACK_TOKEN_STOLEN" nocase ascii wide
$string1078 = /CallBackDump.{0,1000}dumpXor/ nocase ascii wide
$string1079 = /CallbackDump\.exe/ nocase ascii wide
$string1080 = /careCrow.{0,1000}_linux_amd64/
$string1081 = /cat\s.{0,1000}\.bin\s\|\sbase64\s\-w\s0\s\>\s.{0,1000}\.txt/ nocase ascii wide
$string1082 = "cc2_keystrokes_" nocase ascii wide
$string1083 = /cc2_mimipenguin\./ nocase ascii wide
$string1084 = "cc2_portscan_" nocase ascii wide
$string1085 = /cc2_rebind_.{0,1000}_get_recv/ nocase ascii wide
$string1086 = /cc2_rebind_.{0,1000}_get_send/ nocase ascii wide
$string1087 = /cc2_rebind_.{0,1000}_post_recv/ nocase ascii wide
$string1088 = /cc2_rebind_.{0,1000}_post_send/ nocase ascii wide
$string1089 = "cc2_udp_server" nocase ascii wide
$string1090 = /cc2FilesColor\./ nocase ascii wide
$string1091 = /cc2ProcessColor\./ nocase ascii wide
$string1092 = /CCob\/BOF\.NET/ nocase ascii wide
$string1093 = /cd\s\.\/whereami\//
$string1094 = /ChatLadon\.exe/ nocase ascii wide
$string1095 = /ChatLadon\.rar/ nocase ascii wide
$string1096 = "check_and_write_IAT_Hook" nocase ascii wide
$string1097 = /check_function\sntdll\.dll\sEtwEventWrite/ nocase ascii wide
$string1098 = "checkIfHiddenAPICall" nocase ascii wide
$string1099 = /chromeKey\.x64/ nocase ascii wide
$string1100 = /chromeKey\.x86/ nocase ascii wide
$string1101 = "chromiumkeydump" nocase ascii wide
$string1102 = "cHux014r17SG3v4gPUrZ0BZjDabMTY2eWDj1tuYdREBg" nocase ascii wide
$string1103 = /clipboardinject\./ nocase ascii wide
$string1104 = /clipboardinject\.x64/ nocase ascii wide
$string1105 = /clipboardinject\.x86/ nocase ascii wide
$string1106 = "ClipboardWindow-Inject" nocase ascii wide
$string1107 = /clipmon\.sln/ nocase ascii wide
$string1108 = "CmstpElevatedCOM" nocase ascii wide
$string1109 = "Cobalt Strike" nocase ascii wide
$string1110 = /cobaltclip\.cna/ nocase ascii wide
$string1111 = /cobaltclip\.exe/ nocase ascii wide
$string1112 = "cobaltstrike" nocase ascii wide
$string1113 = "cobalt-strike" nocase ascii wide
$string1114 = /cobaltstrike\.store/ nocase ascii wide
$string1115 = "Cobalt-Strike/bof_template" nocase ascii wide
$string1116 = /CodeLoad\(shellcode\)/ nocase ascii wide
$string1117 = /coff_definitions\.h/ nocase ascii wide
$string1118 = /COFF_Loader\./ nocase ascii wide
$string1119 = "COFF_PREP_BEACON" nocase ascii wide
$string1120 = /CoffeeLdr.{0,1000}\sgo\s/ nocase ascii wide
$string1121 = /CoffeeLdr\.x64\.exe/ nocase ascii wide
$string1122 = /CoffeeLdr\.x86\.exe/ nocase ascii wide
$string1123 = "COFFELDR_COFFELDR_H" nocase ascii wide
$string1124 = /COFFLoader\./ nocase ascii wide
$string1125 = /COFFLoader64\.exe/ nocase ascii wide
$string1126 = "ColorDataProxyUACBypass" nocase ascii wide
$string1127 = /com_exec_go\(/ nocase ascii wide
$string1128 = /com\-exec\.cna/ nocase ascii wide
$string1129 = /common\.ReflectiveDLL/ nocase ascii wide
$string1130 = "comnap_##" nocase ascii wide
$string1131 = "comnode_##" nocase ascii wide
$string1132 = "connormcgarr/tgtdelegation" nocase ascii wide
$string1133 = /cookie_graber_x64\.o/ nocase ascii wide
$string1134 = /cookie\-graber\.c/ nocase ascii wide
$string1135 = /cookie\-graber_x64\.exe/ nocase ascii wide
$string1136 = "Cookie-Graber-BOF" nocase ascii wide
$string1137 = /CookieProcessor\.exe/ nocase ascii wide
$string1138 = /covid19_koadic\.profile/ nocase ascii wide
$string1139 = "crawlLdrDllList" nocase ascii wide
$string1140 = /credBandit\s.{0,1000}\soutput/ nocase ascii wide
$string1141 = /credBandit\./ nocase ascii wide
$string1142 = "credBanditx64" nocase ascii wide
$string1143 = /CredPrompt\/CredPrompt\.cna/ nocase ascii wide
$string1144 = "cribdragg3r/Alaris" nocase ascii wide
$string1145 = /crimeware.{0,1000}\/zeus\.profile/ nocase ascii wide
$string1146 = "crisprss/PrintSpoofer" nocase ascii wide
$string1147 = /cross_s4u\.c/ nocase ascii wide
$string1148 = /cross_s4u\.x64\.o/ nocase ascii wide
$string1149 = "CrossC2 beacon" nocase ascii wide
$string1150 = /CrossC2\.cna/ nocase ascii wide
$string1151 = "crossc2_entry" nocase ascii wide
$string1152 = /crossc2_portscan\./ nocase ascii wide
$string1153 = /crossc2_serverscan\./ nocase ascii wide
$string1154 = "CrossC2Beacon" nocase ascii wide
$string1155 = /CrossC2Kit\./ nocase ascii wide
$string1156 = /CrossC2Kit\./ nocase ascii wide
$string1157 = /CrossC2Kit\.git/ nocase ascii wide
$string1158 = "CrossC2Kit_demo" nocase ascii wide
$string1159 = "crossc2kit_latest" nocase ascii wide
$string1160 = "CrossC2Kit_Loader" nocase ascii wide
$string1161 = "CrossC2Listener" nocase ascii wide
$string1162 = "CrossC2MemScriptEng" nocase ascii wide
$string1163 = "CrossC2Script" nocase ascii wide
$string1164 = /CrossNet\.exe/ nocase ascii wide
$string1165 = "CRTInjectAsSystem" nocase ascii wide
$string1166 = "CRTInjectElevated" nocase ascii wide
$string1167 = "CRTInjectWithoutPid" nocase ascii wide
$string1168 = /cs2modrewrite\.py/ nocase ascii wide
$string1169 = /cs2nginx\.py/ nocase ascii wide
$string1170 = "CS-Avoid-killing" nocase ascii wide
$string1171 = "CS-BOFs/lsass" nocase ascii wide
$string1172 = "CSharpNamedPipeLoader" nocase ascii wide
$string1173 = /csload\.net\/.{0,1000}\/muma\./ nocase ascii wide
$string1174 = /csOnvps.{0,1000}teamserver/ nocase ascii wide
$string1175 = "CS-Remote-OPs-BOF" nocase ascii wide
$string1176 = /CSSG_load\.cna/ nocase ascii wide
$string1177 = /cs\-token\-vault\.git/ nocase ascii wide
$string1178 = "cube0x0/LdapSignCheck" nocase ascii wide
$string1179 = /custom_payload_generator\./ nocase ascii wide
$string1180 = "CustomKeyboardLayoutPersistence" nocase ascii wide
$string1181 = /CVE_20.{0,1000}\.dll/ nocase ascii wide
$string1182 = /cve\-20\.x64\.dll/ nocase ascii wide
$string1183 = /cve\-20\.x86\.dll/ nocase ascii wide
$string1184 = "DallasFR/Cobalt-Clip" nocase ascii wide
$string1185 = "darkr4y/geacon" nocase ascii wide
$string1186 = /dcsync\@protonmail\.com/ nocase ascii wide
$string1187 = /dcsyncattack\(/ nocase ascii wide
$string1188 = /dcsyncattack\.py/ nocase ascii wide
$string1189 = /dcsyncclient\./ nocase ascii wide
$string1190 = /dcsyncclient\.py/ nocase ascii wide
$string1191 = "DeEpinGh0st/Erebus" nocase ascii wide
$string1192 = "DefaultBeaconApi" nocase ascii wide
$string1193 = /demo\-bof\.cna/ nocase ascii wide
$string1194 = /detect\-hooksx64\./ nocase ascii wide
$string1195 = "DisableAllWindowsSoftwareFirewalls" nocase ascii wide
$string1196 = /disableeventvwr\/.{0,1000}\.ps1/ nocase ascii wide
$string1197 = /dll\\reflective_dll\./ nocase ascii wide
$string1198 = "dll_hijack_hunter" nocase ascii wide
$string1199 = "DLL_Imports_BOF" nocase ascii wide
$string1200 = "DLL_TO_HIJACK_WIN10" nocase ascii wide
$string1201 = "DLL-Hijack-Search-Order-BOF" nocase ascii wide
$string1202 = "dllinject " nocase ascii wide
$string1203 = "dns_beacon_beacon" nocase ascii wide
$string1204 = "dns_beacon_dns_idle" nocase ascii wide
$string1205 = "dns_beacon_dns_sleep" nocase ascii wide
$string1206 = "dns_beacon_dns_stager_prepend" nocase ascii wide
$string1207 = "dns_beacon_dns_stager_subhost" nocase ascii wide
$string1208 = "dns_beacon_dns_ttl" nocase ascii wide
$string1209 = "dns_beacon_get_A" nocase ascii wide
$string1210 = "dns_beacon_get_TXT" nocase ascii wide
$string1211 = "dns_beacon_maxdns" nocase ascii wide
$string1212 = "dns_beacon_ns_response" nocase ascii wide
$string1213 = "dns_beacon_put_metadata" nocase ascii wide
$string1214 = "dns_beacon_put_output" nocase ascii wide
$string1215 = /dns_redir\.sh\s/
$string1216 = "dns_stager_prepend" nocase ascii wide
$string1217 = "'dns_stager_prepend'" nocase ascii wide
$string1218 = "'dns_stager_subhost'" nocase ascii wide
$string1219 = "dns-beacon " nocase ascii wide
$string1220 = /dnspayload\.bin/ nocase ascii wide
$string1221 = /do_attack\(/ nocase ascii wide
$string1222 = /Doge\-Loader.{0,1000}xor\.go/ nocase ascii wide
$string1223 = /douknowwhoami\?d/ nocase ascii wide
$string1224 = "dr0op/CrossNet" nocase ascii wide
$string1225 = /DReverseProxy\.git/ nocase ascii wide
$string1226 = /DReverseServer\.go/ nocase ascii wide
$string1227 = "drop_malleable_unknown_" nocase ascii wide
$string1228 = "drop_malleable_with_invalid_" nocase ascii wide
$string1229 = "drop_malleable_without_" nocase ascii wide
$string1230 = /dropper32\.exe/ nocase ascii wide
$string1231 = /dropper64\.exe/ nocase ascii wide
$string1232 = "dtmsecurity/bof_helper" nocase ascii wide
$string1233 = /Dumpert\.bin/ nocase ascii wide
$string1234 = /Dumpert\.exe/ nocase ascii wide
$string1235 = "Dumpert-Aggressor" nocase ascii wide
$string1236 = /DumpShellcode\.exe/ nocase ascii wide
$string1237 = /dumpXor\.exe\s/ nocase ascii wide
$string1238 = "e42e1a7fcd23299df2ad4a3fe66e0f1df5a367ffe96015fd3a3b9c0a6dfcefdb" nocase ascii wide
$string1239 = /EasyPersistent\.cna/ nocase ascii wide
$string1240 = "ebdf64076861a73d92416c6203d50dd25f4c991372f7d47e7146e29ab41a6892" nocase ascii wide
$string1241 = "elevate juicypotato " nocase ascii wide
$string1242 = "elevate Printspoofer" nocase ascii wide
$string1243 = "elevate svc-exe " nocase ascii wide
$string1244 = /ELFLoader\.c/ nocase ascii wide
$string1245 = /ELFLoader\.h/ nocase ascii wide
$string1246 = /ELFLoader\.out/ nocase ascii wide
$string1247 = "ElJaviLuki/CobaltStrike_OpenBeacon" nocase ascii wide
$string1248 = "empire AttackServers" nocase ascii wide
$string1249 = "EncodeGroup/AggressiveProxy" nocase ascii wide
$string1250 = "EncodeGroup/UAC-SilentClean" nocase ascii wide
$string1251 = /encrypt\/encryptFile\.go/ nocase ascii wide
$string1252 = /encrypt\/encryptUrl\.go/ nocase ascii wide
$string1253 = /EncryptShellcode\(/ nocase ascii wide
$string1254 = "engjibo/NetUser" nocase ascii wide
$string1255 = /EnumCLR\.exe/ nocase ascii wide
$string1256 = /Erebus\/.{0,1000}spacerunner/ nocase ascii wide
$string1257 = "EspressoCake/PPLDump_BOF" nocase ascii wide
$string1258 = /EventAggregation\.dll\.bak/ nocase ascii wide
$string1259 = /eventspy\.cna/ nocase ascii wide
$string1260 = /EventSub\-Aggressor\./ nocase ascii wide
$string1261 = /EventViewerUAC\./ nocase ascii wide
$string1262 = /EventViewerUAC\./ nocase ascii wide
$string1263 = /EventViewerUAC\.x64/ nocase ascii wide
$string1264 = /EventViewerUAC\.x86/ nocase ascii wide
$string1265 = "EventViewerUAC_BOF" nocase ascii wide
$string1266 = "eventvwr_elevator" nocase ascii wide
$string1267 = /EVUAC\s.{0,1000}\.exe/ nocase ascii wide
$string1268 = "ewby/Mockingjay_BOF" nocase ascii wide
$string1269 = /example\-bof\.sln/ nocase ascii wide
$string1270 = /execmethod.{0,1000}PowerPick/ nocase ascii wide
$string1271 = /execmethod.{0,1000}PowerShell/ nocase ascii wide
$string1272 = "execute_bof " nocase ascii wide
$string1273 = /execute\-assembly\s.{0,1000}\.exe\s/ nocase ascii wide
$string1274 = "executepersistence" nocase ascii wide
$string1275 = "Export-PowerViewCSV" nocase ascii wide
$string1276 = "extract_reflective_loader" nocase ascii wide
$string1277 = "f65740929e9608e0590eee78f1ba20793d99163ac5f6dc1c8b8734b742c4da11" nocase ascii wide
$string1278 = "f8ce37975b71cc8f51fcb93e3e32ec81a9b5da5cead7dcb987d0a3127bde027c" nocase ascii wide
$string1279 = "ff732bedb8593016ffbe4925ce8fd87a74478b06391079413b70ee9e151826f2" nocase ascii wide
$string1280 = "Fiesta Exploit Kit" nocase ascii wide
$string1281 = /FileControler\/FileControler_x64\.dll/ nocase ascii wide
$string1282 = /FileControler\/FileControler_x86\.dll/ nocase ascii wide
$string1283 = /find_payload\(/ nocase ascii wide
$string1284 = "findgpocomputeradmin" nocase ascii wide
$string1285 = "Find-GPOComputerAdmin" nocase ascii wide
$string1286 = "Find-InterestingDomainAcl" nocase ascii wide
$string1287 = "findinterestingdomainsharefile" nocase ascii wide
$string1288 = "Find-InterestingDomainShareFile" nocase ascii wide
$string1289 = "findlocaladminaccess" nocase ascii wide
$string1290 = "findlocaladminaccess" nocase ascii wide
$string1291 = "Find-LocalAdminAccess" nocase ascii wide
$string1292 = "Find-LocalAdminAccess" nocase ascii wide
$string1293 = /FindModule\s.{0,1000}\.dll/ nocase ascii wide
$string1294 = "FindObjects-BOF" nocase ascii wide
$string1295 = "FindProcessTokenAndDuplicate" nocase ascii wide
$string1296 = /FindProcHandle\s.{0,1000}lsass/ nocase ascii wide
$string1297 = "Firewall_Walker_BOF" nocase ascii wide
$string1298 = "fishing_with_hollowing" nocase ascii wide
$string1299 = /foreign_access\.cna/ nocase ascii wide
$string1300 = /foreign_lsass\s.{0,1000}\s/ nocase ascii wide
$string1301 = /foreign_lsass\.c/ nocase ascii wide
$string1302 = /foreign_lsass\.x64/ nocase ascii wide
$string1303 = /foreign_lsass\.x86/ nocase ascii wide
$string1304 = /\-\-format\-string\sziiiiizzzb\s.{0,1000}\s/ nocase ascii wide
$string1305 = "--format-string ziiiiizzzib " nocase ascii wide
$string1306 = "fortra/No-Consolation" nocase ascii wide
$string1307 = "fucksetuptools" nocase ascii wide
$string1308 = /FuckThatPacker\./ nocase ascii wide
$string1309 = "FunnyWolf/pystinger" nocase ascii wide
$string1310 = "fw_walk disable" nocase ascii wide
$string1311 = "G0ldenGunSec/GetWebDAVStatus" nocase ascii wide
$string1312 = /GadgetToJScript\.exe\s\-a\s/ nocase ascii wide
$string1313 = "Gality369/CS-Loader" nocase ascii wide
$string1314 = "gather/keylogger" nocase ascii wide
$string1315 = /geacon.{0,1000}\/cmd\// nocase ascii wide
$string1316 = /genCrossC2\./ nocase ascii wide
$string1317 = "generate_beacon" nocase ascii wide
$string1318 = /generate\-rotating\-beacon\./ nocase ascii wide
$string1319 = "GeorgePatsias/ScareCrow" nocase ascii wide
$string1320 = "get_BeaconHealthCheck_settings" nocase ascii wide
$string1321 = "get_dns_dnsidle" nocase ascii wide
$string1322 = "get_dns_sleep" nocase ascii wide
$string1323 = /get_password_policy\.x64\./ nocase ascii wide
$string1324 = /get_password_policy\.x86\./ nocase ascii wide
$string1325 = "get_post_ex_pipename_list" nocase ascii wide
$string1326 = "get_post_ex_spawnto_x" nocase ascii wide
$string1327 = "get_process_inject_allocator" nocase ascii wide
$string1328 = "get_process_inject_bof_allocator" nocase ascii wide
$string1329 = "get_process_inject_execute" nocase ascii wide
$string1330 = "get_stage_allocator" nocase ascii wide
$string1331 = "get_stage_magic_mz_64" nocase ascii wide
$string1332 = "get_stage_magic_mz_86" nocase ascii wide
$string1333 = "get_stage_magic_pe" nocase ascii wide
$string1334 = "get_virtual_Hook_address" nocase ascii wide
$string1335 = "getAggressorClient" nocase ascii wide
$string1336 = "Get-BeaconAPI" nocase ascii wide
$string1337 = "Get-CachedRDPConnection" nocase ascii wide
$string1338 = "getCrossC2Beacon" nocase ascii wide
$string1339 = "getCrossC2Site" nocase ascii wide
$string1340 = "getdomainspnticket" nocase ascii wide
$string1341 = "Get-DomainSPNTicket" nocase ascii wide
$string1342 = "getexploitablesystem" nocase ascii wide
$string1343 = "Get-ExploitableSystem" nocase ascii wide
$string1344 = "GetHijackableDllName" nocase ascii wide
$string1345 = "GetNTLMChallengeBase64" nocase ascii wide
$string1346 = /GetShellcode\(/ nocase ascii wide
$string1347 = /GetWebDAVStatus\.csproj/ nocase ascii wide
$string1348 = /GetWebDAVStatus\.sln/ nocase ascii wide
$string1349 = "GetWebDAVStatus_DotNet" nocase ascii wide
$string1350 = /GetWebDAVStatus_x64\.o/ nocase ascii wide
$string1351 = "getwmiregcachedrdpconnection" nocase ascii wide
$string1352 = "Get-WMIRegCachedRDPConnection" nocase ascii wide
$string1353 = "getwmireglastloggedon" nocase ascii wide
$string1354 = "Get-WMIRegLastLoggedOn" nocase ascii wide
$string1355 = /gexplorer\.exe/ nocase ascii wide
$string1356 = "GhostPack/Koh" nocase ascii wide
$string1357 = /github.{0,1000}\/MoveKit\.git/ nocase ascii wide
$string1358 = /github\.com\/k8gege/ nocase ascii wide
$string1359 = /github\.com\/rasta\-mouse\// nocase ascii wide
$string1360 = /github\.com\/SpiderLabs\// nocase ascii wide
$string1361 = "gloxec/CrossC2" nocase ascii wide
$string1362 = /go_shellcode_encode\.py/ nocase ascii wide
$string1363 = /go\-shellcode\.py/ nocase ascii wide
$string1364 = "goShellCodeByPassVT" nocase ascii wide
$string1365 = /hackbrowersdata\.cna/ nocase ascii wide
$string1366 = "hack-browser-data/" nocase ascii wide
$string1367 = /handlekatz\.x64\./ nocase ascii wide
$string1368 = /handlekatz_bof\./ nocase ascii wide
$string1369 = "Hangingsword/HouQing" nocase ascii wide
$string1370 = /Havoc\-UACBypass\.py/ nocase ascii wide
$string1371 = "hd-launch-cmd " nocase ascii wide
$string1372 = /headers\/exploit\.h/ nocase ascii wide
$string1373 = /headers\/HandleKatz\.h/ nocase ascii wide
$string1374 = "Henkru/cs-token-vault" nocase ascii wide
$string1375 = /Hidden\.Desktop\.mp4/ nocase ascii wide
$string1376 = /HiddenDesktop\s.{0,1000}\s/ nocase ascii wide
$string1377 = /HiddenDesktop\./ nocase ascii wide
$string1378 = /HiddenDesktop\.x64\.bin/ nocase ascii wide
$string1379 = /HiddenDesktop\.x86\.bin/ nocase ascii wide
$string1380 = /HiddenDesktop\.zip/ nocase ascii wide
$string1381 = "hijack_hunter " nocase ascii wide
$string1382 = "hijack_remote_thread" nocase ascii wide
$string1383 = /HiveJack\-Console\.exe/ nocase ascii wide
$string1384 = /hollow\s.{0,1000}\.exe\s.{0,1000}\.bin/ nocase ascii wide
$string1385 = /hollower\.Hollow\(/ nocase ascii wide
$string1386 = /houqingv1\.0\.zip/ nocase ascii wide
$string1387 = /html\/js\/beacons\.js/ nocase ascii wide
$string1388 = /http.{0,1000}\/zha0gongz1/ nocase ascii wide
$string1389 = /http.{0,1000}\:3200\/manjusaka/ nocase ascii wide
$string1390 = /http.{0,1000}\:801\/bq1iFEP2/ nocase ascii wide
$string1391 = /http\:\/\/127\.0\.0\.1\:8000\/1\.jpg/ nocase ascii wide
$string1392 = "http_stager_client_header" nocase ascii wide
$string1393 = "http_stager_server_append" nocase ascii wide
$string1394 = "http_stager_server_header" nocase ascii wide
$string1395 = "http_stager_server_prepend" nocase ascii wide
$string1396 = "http_stager_uri_x64" nocase ascii wide
$string1397 = "http_stager_uri_x86" nocase ascii wide
$string1398 = /http1\.x64\.bin/ nocase ascii wide
$string1399 = /http1\.x64\.dll/ nocase ascii wide
$string1400 = /httpattack\.py/ nocase ascii wide
$string1401 = /httppayload\.bin/ nocase ascii wide
$string1402 = "http-redwarden" nocase ascii wide
$string1403 = /httprelayclient\.py/ nocase ascii wide
$string1404 = /httprelayserver\.py/ nocase ascii wide
$string1405 = "'http-stager'" nocase ascii wide
$string1406 = /HVNC\sServer\.exe/ nocase ascii wide
$string1407 = /HVNC\\\sServer/ nocase ascii wide
$string1408 = "IcebreakerSecurity/DelegationBOF" nocase ascii wide
$string1409 = "IcebreakerSecurity/PersistBOF" nocase ascii wide
$string1410 = "icyguider/UAC-BOF-Bonanza" nocase ascii wide
$string1411 = /imapattack\.py/ nocase ascii wide
$string1412 = /imaprelayclient\.py/ nocase ascii wide
$string1413 = /impacket\./ nocase ascii wide
$string1414 = "ImpersonateLocalService" nocase ascii wide
$string1415 = /import\spe\.OBJExecutable/ nocase ascii wide
$string1416 = /include\sbeacon\.h/ nocase ascii wide
$string1417 = /include\sinjection\.c/ nocase ascii wide
$string1418 = "inject-amsiBypass " nocase ascii wide
$string1419 = /inject\-amsiBypass\./ nocase ascii wide
$string1420 = "inject-assembly " nocase ascii wide
$string1421 = /inject\-assembly\.cna/ nocase ascii wide
$string1422 = /injectassembly\.x64\.bin/ nocase ascii wide
$string1423 = /injectassembly\.x64\.o/ nocase ascii wide
$string1424 = "injectEtwBypass" nocase ascii wide
$string1425 = "InjectShellcode" nocase ascii wide
$string1426 = "inline-execute " nocase ascii wide
$string1427 = /inline\-execute.{0,1000}whereami\.x64/ nocase ascii wide
$string1428 = "InlineExecute-Assembly" nocase ascii wide
$string1429 = /InlineWhispers\.py/ nocase ascii wide
$string1430 = "InlineWhispers2" nocase ascii wide
$string1431 = "install impacket" nocase ascii wide
$string1432 = "InvokeBloodHound" nocase ascii wide
$string1433 = "Invoke-Bof " nocase ascii wide
$string1434 = /Invoke\-Bof\.ps1/ nocase ascii wide
$string1435 = "invokechecklocaladminaccess" nocase ascii wide
$string1436 = "Invoke-CheckLocalAdminAccess" nocase ascii wide
$string1437 = "invokeenumeratelocaladmin" nocase ascii wide
$string1438 = "Invoke-EnumerateLocalAdmin" nocase ascii wide
$string1439 = /Invoke\-EnvBypass\./ nocase ascii wide
$string1440 = "Invoke-EventVwrBypass" nocase ascii wide
$string1441 = "invokefilefinder" nocase ascii wide
$string1442 = "Invoke-FileFinder" nocase ascii wide
$string1443 = "Invoke-HostEnum -" nocase ascii wide
$string1444 = "invokekerberoast" nocase ascii wide
$string1445 = "Invoke-Kerberoast" nocase ascii wide
$string1446 = "Invoke-ParentalKilling" nocase ascii wide
$string1447 = "Invoke-Phant0m" nocase ascii wide
$string1448 = /Invoke\-Phant0m\.ps1/ nocase ascii wide
$string1449 = "invokeprocesshunter" nocase ascii wide
$string1450 = "Invoke-ProcessHunter" nocase ascii wide
$string1451 = "invokereverttoself" nocase ascii wide
$string1452 = "Invoke-RevertToSelf" nocase ascii wide
$string1453 = "invokesharefinder" nocase ascii wide
$string1454 = "Invoke-ShareFinder" nocase ascii wide
$string1455 = "invokestealthuserhunter" nocase ascii wide
$string1456 = "Invoke-StealthUserHunter" nocase ascii wide
$string1457 = "invokeuserhunter" nocase ascii wide
$string1458 = "Invoke-UserHunter" nocase ascii wide
$string1459 = "Invoke-WScriptBypassUAC" nocase ascii wide
$string1460 = /Invoking\sCreateSvcRpc\s\(by\s\@x86matthew\)/ nocase ascii wide
$string1461 = "jas502n/bypassAV" nocase ascii wide
$string1462 = /java\s\-jar\sBeaconTool\.jar/ nocase ascii wide
$string1463 = /java\s\-jar\sBeaconTool\.jar/ nocase ascii wide
$string1464 = "Job killed and console drained" nocase ascii wide
$string1465 = /jquery\-c2\..{0,1000}\.profile/ nocase ascii wide
$string1466 = "jump psexec_psh" nocase ascii wide
$string1467 = "jump psexec64" nocase ascii wide
$string1468 = "jump winrm " nocase ascii wide
$string1469 = "jump winrm" nocase ascii wide
$string1470 = "jump-exec scshell" nocase ascii wide
$string1471 = /K8_CS_.{0,1000}\.rar/ nocase ascii wide
$string1472 = /k8gege\.org\// nocase ascii wide
$string1473 = "k8gege/Ladon" nocase ascii wide
$string1474 = /K8Ladon\.sln/ nocase ascii wide
$string1475 = /KaliLadon\./ nocase ascii wide
$string1476 = /KBDPAYLOAD\.dll/ nocase ascii wide
$string1477 = /kdstab\s.{0,1000}\s\/CHECK/ nocase ascii wide
$string1478 = /kdstab\s.{0,1000}\s\/CLOSE/ nocase ascii wide
$string1479 = /kdstab\s.{0,1000}\s\/DRIVER/ nocase ascii wide
$string1480 = /kdstab\s.{0,1000}\s\/KILL/ nocase ascii wide
$string1481 = /kdstab\s.{0,1000}\s\/LIST/ nocase ascii wide
$string1482 = /kdstab\s.{0,1000}\s\/NAME/ nocase ascii wide
$string1483 = /kdstab\s.{0,1000}\s\/PID/ nocase ascii wide
$string1484 = /kdstab\s.{0,1000}\s\/SERVICE/ nocase ascii wide
$string1485 = /kdstab\s.{0,1000}\s\/STRIP/ nocase ascii wide
$string1486 = /kdstab\s.{0,1000}\s\/UNLOAD/ nocase ascii wide
$string1487 = /kdstab\.cna/ nocase ascii wide
$string1488 = /kerberoasting\.x64/ nocase ascii wide
$string1489 = /Kerberos\sabuse\s\(kerbeus\sBOF\)/ nocase ascii wide
$string1490 = /kerberos.{0,1000}\.kirbi/ nocase ascii wide
$string1491 = /Kerbeus\s.{0,1000}\sby\sRalfHacker/ nocase ascii wide
$string1492 = /kerbeus_cs\.cna/ nocase ascii wide
$string1493 = /kerbeus_havoc\.py/ nocase ascii wide
$string1494 = "Kerbeus-BOF-main" nocase ascii wide
$string1495 = /kernelcallbacktable\.x64/ nocase ascii wide
$string1496 = /kernelcallbacktable\.x64/ nocase ascii wide
$string1497 = /kernelcallbacktable\.x86/ nocase ascii wide
$string1498 = /kernelcallbacktable\.x86/ nocase ascii wide
$string1499 = /KernelMii\.cna/ nocase ascii wide
$string1500 = /KernelMii\.x64\.exe/ nocase ascii wide
$string1501 = /KernelMii\.x64\.o/ nocase ascii wide
$string1502 = /KernelMii\.x86\.exe/ nocase ascii wide
$string1503 = /KernelMii\.x86\.o/ nocase ascii wide
$string1504 = "killdefender check" nocase ascii wide
$string1505 = "killdefender kill" nocase ascii wide
$string1506 = /KillDefender\.x64/ nocase ascii wide
$string1507 = /KillDefender\.x64\./ nocase ascii wide
$string1508 = "killdefender_bof" nocase ascii wide
$string1509 = "KillDefender_BOF" nocase ascii wide
$string1510 = /kirbi\.tickets/ nocase ascii wide
$string1511 = "koh filter add SID" nocase ascii wide
$string1512 = "koh filter list" nocase ascii wide
$string1513 = "koh filter remove SID" nocase ascii wide
$string1514 = "koh filter reset" nocase ascii wide
$string1515 = "koh groups LUID" nocase ascii wide
$string1516 = "koh impersonate LUID" nocase ascii wide
$string1517 = "koh release all" nocase ascii wide
$string1518 = "koh release LUID" nocase ascii wide
$string1519 = /Koh\.exe\scapture/ nocase ascii wide
$string1520 = /Koh\.exe\slist/ nocase ascii wide
$string1521 = /Koh\.exe\smonitor/ nocase ascii wide
$string1522 = "krb_asktgs /" nocase ascii wide
$string1523 = "krb_asktgt /" nocase ascii wide
$string1524 = "krb_asreproasting" nocase ascii wide
$string1525 = "krb_changepw /" nocase ascii wide
$string1526 = "krb_cross_s4u /" nocase ascii wide
$string1527 = "krb_describe /" nocase ascii wide
$string1528 = "krb_dump /" nocase ascii wide
$string1529 = "krb_hash /password" nocase ascii wide
$string1530 = "krb_klist /" nocase ascii wide
$string1531 = "krb_ptt /ticket:" nocase ascii wide
$string1532 = "krb_purge /" nocase ascii wide
$string1533 = "krb_renew /ticket:" nocase ascii wide
$string1534 = "krb_s4u /" nocase ascii wide
$string1535 = "krb_tgtdeleg /" nocase ascii wide
$string1536 = /krb_tgtdeleg\(.{0,1000}\)/ nocase ascii wide
$string1537 = "krb_triage /" nocase ascii wide
$string1538 = /krb5\/kerberosv5\.py/ nocase ascii wide
$string1539 = "krbasktgt /" nocase ascii wide
$string1540 = /krbcredccache\.py/ nocase ascii wide
$string1541 = "kyleavery/AceLdr" nocase ascii wide
$string1542 = "kyleavery/inject-assembly" nocase ascii wide
$string1543 = /Ladon\s.{0,1000}\sAllScan/ nocase ascii wide
$string1544 = /Ladon\s.{0,1000}\sCiscoScan/ nocase ascii wide
$string1545 = /Ladon\s.{0,1000}\sOnlineIP/ nocase ascii wide
$string1546 = /Ladon\s.{0,1000}\sOnlinePC/ nocase ascii wide
$string1547 = /Ladon\s.{0,1000}\sOsScan/ nocase ascii wide
$string1548 = /Ladon\s.{0,1000}\sOxidScan/ nocase ascii wide
$string1549 = /Ladon\s.{0,1000}\.txt\s/ nocase ascii wide
$string1550 = /Ladon\s.{0,1000}DeBase64/ nocase ascii wide
$string1551 = /Ladon\s.{0,1000}FtpScan/ nocase ascii wide
$string1552 = /Ladon\s.{0,1000}LdapScan/ nocase ascii wide
$string1553 = /Ladon\s.{0,1000}SMBGhost/ nocase ascii wide
$string1554 = /Ladon\s.{0,1000}SmbHashScan/ nocase ascii wide
$string1555 = /Ladon\s.{0,1000}SmbScan/ nocase ascii wide
$string1556 = /Ladon\s.{0,1000}SshScan/ nocase ascii wide
$string1557 = /Ladon\s.{0,1000}TomcatScan/ nocase ascii wide
$string1558 = /Ladon\s.{0,1000}VncScan/ nocase ascii wide
$string1559 = /Ladon\s.{0,1000}WebScan/ nocase ascii wide
$string1560 = /Ladon\s.{0,1000}WinrmScan/ nocase ascii wide
$string1561 = /Ladon\s.{0,1000}WmiHashScan/ nocase ascii wide
$string1562 = /Ladon\s.{0,1000}WmiScan/ nocase ascii wide
$string1563 = "Ladon ActiveAdmin" nocase ascii wide
$string1564 = "Ladon ActiveGuest" nocase ascii wide
$string1565 = "Ladon AdiDnsDump " nocase ascii wide
$string1566 = "Ladon at c:" nocase ascii wide
$string1567 = "Ladon AtExec" nocase ascii wide
$string1568 = "Ladon AutoRun" nocase ascii wide
$string1569 = "Ladon BadPotato" nocase ascii wide
$string1570 = "Ladon BypassUAC" nocase ascii wide
$string1571 = "Ladon CheckDoor" nocase ascii wide
$string1572 = "Ladon Clslog" nocase ascii wide
$string1573 = "Ladon CmdDll " nocase ascii wide
$string1574 = "Ladon cmdline" nocase ascii wide
$string1575 = "Ladon CVE-" nocase ascii wide
$string1576 = "Ladon DirList" nocase ascii wide
$string1577 = "Ladon DraytekExp" nocase ascii wide
$string1578 = "Ladon DumpLsass" nocase ascii wide
$string1579 = "Ladon EnableDotNet" nocase ascii wide
$string1580 = "Ladon EnumProcess" nocase ascii wide
$string1581 = "Ladon EnumShare" nocase ascii wide
$string1582 = "Ladon Exploit" nocase ascii wide
$string1583 = "Ladon FindIP " nocase ascii wide
$string1584 = "Ladon FirefoxCookie" nocase ascii wide
$string1585 = "Ladon FirefoxHistory" nocase ascii wide
$string1586 = "Ladon FirefoxPwd" nocase ascii wide
$string1587 = "Ladon ForExec " nocase ascii wide
$string1588 = "Ladon FtpDownLoad " nocase ascii wide
$string1589 = "Ladon FtpServer " nocase ascii wide
$string1590 = "Ladon GetDomainIP" nocase ascii wide
$string1591 = "Ladon gethtml " nocase ascii wide
$string1592 = "Ladon GetPipe" nocase ascii wide
$string1593 = "Ladon GetSystem" nocase ascii wide
$string1594 = "Ladon IISdoor" nocase ascii wide
$string1595 = "Ladon IISpwd" nocase ascii wide
$string1596 = "Ladon MssqlCmd " nocase ascii wide
$string1597 = "Ladon netsh " nocase ascii wide
$string1598 = "Ladon noping " nocase ascii wide
$string1599 = "Ladon Open3389" nocase ascii wide
$string1600 = "Ladon PowerCat " nocase ascii wide
$string1601 = "Ladon PrintNightmare" nocase ascii wide
$string1602 = "Ladon psexec" nocase ascii wide
$string1603 = "Ladon QueryAdmin" nocase ascii wide
$string1604 = "Ladon RdpHijack" nocase ascii wide
$string1605 = "Ladon ReadFile " nocase ascii wide
$string1606 = "Ladon RegAuto" nocase ascii wide
$string1607 = "Ladon ReverseHttps" nocase ascii wide
$string1608 = "Ladon ReverseTcp " nocase ascii wide
$string1609 = "Ladon RevShell-" nocase ascii wide
$string1610 = "Ladon Runas" nocase ascii wide
$string1611 = "Ladon RunPS " nocase ascii wide
$string1612 = "Ladon sc " nocase ascii wide
$string1613 = "Ladon SetSignAuth" nocase ascii wide
$string1614 = "Ladon SmbExec " nocase ascii wide
$string1615 = "Ladon Sniffer" nocase ascii wide
$string1616 = "Ladon SshExec " nocase ascii wide
$string1617 = "Ladon SweetPotato" nocase ascii wide
$string1618 = "Ladon TcpServer " nocase ascii wide
$string1619 = "Ladon UdpServer" nocase ascii wide
$string1620 = "Ladon WebShell" nocase ascii wide
$string1621 = "Ladon whoami" nocase ascii wide
$string1622 = "Ladon WifiPwd" nocase ascii wide
$string1623 = "Ladon wmiexec" nocase ascii wide
$string1624 = "Ladon WmiExec2 " nocase ascii wide
$string1625 = "Ladon XshellPwd" nocase ascii wide
$string1626 = "Ladon ZeroLogon" nocase ascii wide
$string1627 = "Ladon40 BypassUAC" nocase ascii wide
$string1628 = /Ladon911.{0,1000}\.ps1/ nocase ascii wide
$string1629 = /Ladon911\.exe/ nocase ascii wide
$string1630 = /Ladon911_.{0,1000}\.rar/ nocase ascii wide
$string1631 = /LadonExp\.exe/ nocase ascii wide
$string1632 = /LadonGUI\.exe/ nocase ascii wide
$string1633 = /LadonLib\.rar/ nocase ascii wide
$string1634 = /LadonStudy\.exe/ nocase ascii wide
$string1635 = /lastpass\.x86/ nocase ascii wide
$string1636 = /lastpass\/process_lp_files\.py/ nocase ascii wide
$string1637 = /ldap_shell\.py/ nocase ascii wide
$string1638 = /ldapattack\.py/ nocase ascii wide
$string1639 = /ldaprelayclient\.py/ nocase ascii wide
$string1640 = /LdapSignCheck\.exe/ nocase ascii wide
$string1641 = /LdapSignCheck\.Natives/ nocase ascii wide
$string1642 = /LdapSignCheck\.sln/ nocase ascii wide
$string1643 = /ldapsigncheck\.x64\./ nocase ascii wide
$string1644 = /ldapsigncheck\.x86\./ nocase ascii wide
$string1645 = /LetMeOutSharp\./ nocase ascii wide
$string1646 = "libs/bofalloc" nocase ascii wide
$string1647 = "libs/bofentry" nocase ascii wide
$string1648 = "libs/bofhelper" nocase ascii wide
$string1649 = /LiquidSnake\.exe/ nocase ascii wide
$string1650 = "llsrpc_##" nocase ascii wide
$string1651 = "load aggressor script" nocase ascii wide
$string1652 = /load_sc\.exe\s.{0,1000}\.bin/ nocase ascii wide
$string1653 = "Load-BeaconParameters" nocase ascii wide
$string1654 = /Load\-Bof\(/ nocase ascii wide
$string1655 = /loader\/loader\/loader\.c/ nocase ascii wide
$string1656 = /localS4U2Proxy\.tickets/ nocase ascii wide
$string1657 = "logToBeaconLog" nocase ascii wide
$string1658 = "lsarpc_##" nocase ascii wide
$string1659 = "Magnitude Exploit Kit" nocase ascii wide
$string1660 = /main_air_service\-probes\.go/ nocase ascii wide
$string1661 = /main_pro_service\-probes\.go/ nocase ascii wide
$string1662 = /makebof\.bat/ nocase ascii wide
$string1663 = "Malleable C2 Files" nocase ascii wide
$string1664 = "Malleable PE/Stage" nocase ascii wide
$string1665 = /malleable_redirector\.py/ nocase ascii wide
$string1666 = "malleable_redirector_hidden_api_endpoint" nocase ascii wide
$string1667 = "Malleable-C2-Profiles" nocase ascii wide
$string1668 = "Malleable-C2-Randomizer" nocase ascii wide
$string1669 = "Malleable-C2-Randomizer" nocase ascii wide
$string1670 = "malleable-redirector-config" nocase ascii wide
$string1671 = "mandllinject " nocase ascii wide
$string1672 = "mdsecactivebreach/CACTUSTORCH" nocase ascii wide
$string1673 = "med0x2e/SigFlip" nocase ascii wide
$string1674 = /memreader\s.{0,1000}access_token/ nocase ascii wide
$string1675 = /MemReader_BoF\./ nocase ascii wide
$string1676 = /meterpreter\./ nocase ascii wide
$string1677 = /metsrv\.dll/ nocase ascii wide
$string1678 = "mgeeky/RedWarden" nocase ascii wide
$string1679 = /mimipenguin\.cna/ nocase ascii wide
$string1680 = /mimipenguin\.so/ nocase ascii wide
$string1681 = /mimipenguin_x32\.so/ nocase ascii wide
$string1682 = "minidump_add_memory_block" nocase ascii wide
$string1683 = "minidump_add_memory64_block" nocase ascii wide
$string1684 = "miscbackdoorlnkhelp" nocase ascii wide
$string1685 = /Mockingjay_BOF\.sln/ nocase ascii wide
$string1686 = "Mockingjay_BOF-main" nocase ascii wide
$string1687 = "mojo_##" nocase ascii wide
$string1688 = "moonD4rk/HackBrowserData" nocase ascii wide
$string1689 = /MoveKit\-master\.zip/ nocase ascii wide
$string1690 = /move\-msbuild\s.{0,1000}\shttp\smove\.csproj/ nocase ascii wide
$string1691 = /move\-pre\-custom\-file\s.{0,1000}\.exe\s/ nocase ascii wide
$string1692 = "msfvemonpayload" nocase ascii wide
$string1693 = /mssqlattack\.py/ nocase ascii wide
$string1694 = /mssqlrelayclient\.py/ nocase ascii wide
$string1695 = "my_dump_my_pe" nocase ascii wide
$string1696 = /needle_sift\.x64/ nocase ascii wide
$string1697 = /needlesift\.cna/ nocase ascii wide
$string1698 = "netero1010/Quser-BOF" nocase ascii wide
$string1699 = "netero1010/ServiceMove-BOF" nocase ascii wide
$string1700 = "netlogon_##" nocase ascii wide
$string1701 = "netuser_enum" nocase ascii wide
$string1702 = "netview_enum" nocase ascii wide
$string1703 = /NoApiUser\.exe/ nocase ascii wide
$string1704 = "noconsolation /tmp/" nocase ascii wide
$string1705 = /noconsolation\s\-\-local\s.{0,1000}cmd\.exe/ nocase ascii wide
$string1706 = /noconsolation\s\-\-local\s.{0,1000}powershell\.exe/ nocase ascii wide
$string1707 = /No\-Consolation\.cna/ nocase ascii wide
$string1708 = /NoConsolation\.x64\.o/ nocase ascii wide
$string1709 = /NoConsolation\.x86\.o/ nocase ascii wide
$string1710 = "No-Consolation-main" nocase ascii wide
$string1711 = /normal\/randomized\.profile/ nocase ascii wide
$string1712 = /ntcreatethread\.x64/ nocase ascii wide
$string1713 = /ntcreatethread\.x86/ nocase ascii wide
$string1714 = /oab\-parse\.py/ nocase ascii wide
$string1715 = "obscuritylabs/ase:latest" nocase ascii wide
$string1716 = "obscuritylabs/RAI/" nocase ascii wide
$string1717 = "Octoberfest7/KDStab" nocase ascii wide
$string1718 = "OG-Sadpanda/SharpCat" nocase ascii wide
$string1719 = "OG-Sadpanda/SharpSword" nocase ascii wide
$string1720 = "OG-Sadpanda/SharpZippo" nocase ascii wide
$string1721 = /On_Demand_C2\./ nocase ascii wide
$string1722 = /On\-Demand_C2_BOF\./ nocase ascii wide
$string1723 = /OnDemandC2Class\.cs/ nocase ascii wide
$string1724 = "openBeaconBrowser" nocase ascii wide
$string1725 = "openBeaconBrowser" nocase ascii wide
$string1726 = "openBeaconConsole" nocase ascii wide
$string1727 = "openBeaconConsole" nocase ascii wide
$string1728 = "openBypassUACDialog" nocase ascii wide
$string1729 = "openBypassUACDialog" nocase ascii wide
$string1730 = "openGoldenTicketDialog" nocase ascii wide
$string1731 = "openKeystrokeBrowser" nocase ascii wide
$string1732 = "openPayloadGenerator" nocase ascii wide
$string1733 = "openPayloadGeneratorDialog" nocase ascii wide
$string1734 = "openPayloadHelper" nocase ascii wide
$string1735 = "openPortScanner" nocase ascii wide
$string1736 = "openPortScanner" nocase ascii wide
$string1737 = "openSpearPhishDialog" nocase ascii wide
$string1738 = "openWindowsExecutableStage" nocase ascii wide
$string1739 = "optiv/Registry-Recon" nocase ascii wide
$string1740 = "optiv/ScareCrow" nocase ascii wide
$string1741 = /Outflank\-Dumpert\./ nocase ascii wide
$string1742 = "outflanknl/Recon-AD" nocase ascii wide
$string1743 = "outflanknl/Spray-AD" nocase ascii wide
$string1744 = "outflanknl/WdToggle" nocase ascii wide
$string1745 = "Outflank-Recon-AD" nocase ascii wide
$string1746 = /output\/html\/data\/beacons\.json/ nocase ascii wide
$string1747 = "output/payloads/" nocase ascii wide
$string1748 = /package\scom\.blackh4t/ nocase ascii wide
$string1749 = /parse\sthe\s\.beacon_keys\sto\sRSA\sprivate\skey\sand\spublic\skey\sin\spem\sformat/ nocase ascii wide
$string1750 = "parse_aggressor_properties" nocase ascii wide
$string1751 = "parse_shellcode" nocase ascii wide
$string1752 = "patchAmsiOpenSession" nocase ascii wide
$string1753 = "payload_bootstrap_hint" nocase ascii wide
$string1754 = "payload_local" nocase ascii wide
$string1755 = /payload_scripts\.cna/ nocase ascii wide
$string1756 = "payload_scripts/sleepmask" nocase ascii wide
$string1757 = /payload_section\.cpp/ nocase ascii wide
$string1758 = /payload_section\.hpp/ nocase ascii wide
$string1759 = /payloadgenerator\.py/ nocase ascii wide
$string1760 = "Perform AS-REP roasting" nocase ascii wide
$string1761 = /perl\sadcsv\.pl\s/ nocase ascii wide
$string1762 = /PersistBOF\.cna/ nocase ascii wide
$string1763 = /PersistenceBOF\.c/ nocase ascii wide
$string1764 = /PersistenceBOF\.exe/ nocase ascii wide
$string1765 = /persist\-ice\-junction\.o/ nocase ascii wide
$string1766 = /persist\-ice\-monitor\.o/ nocase ascii wide
$string1767 = /persist\-ice\-shortcut\.o/ nocase ascii wide
$string1768 = /persist\-ice\-time\.o/ nocase ascii wide
$string1769 = /persist\-ice\-xll\.o/ nocase ascii wide
$string1770 = "Phant0m_cobaltstrike" nocase ascii wide
$string1771 = "'pipename_stager'" nocase ascii wide
$string1772 = "Pitty Tiger RAT" nocase ascii wide
$string1773 = /\-pk8gege\.org/ nocase ascii wide
$string1774 = /pkexec64\.tar\.gz/ nocase ascii wide
$string1775 = /plug_getpass_nps\.dll/ nocase ascii wide
$string1776 = /plug_katz_nps\.exe/ nocase ascii wide
$string1777 = /plug_qvte_nps\.exe/ nocase ascii wide
$string1778 = "PoolParty attack completed successfully" nocase ascii wide
$string1779 = "PoolPartyBof " nocase ascii wide
$string1780 = /PoolPartyBof\s.{0,1000}\sHTTPSLocal/ nocase ascii wide
$string1781 = /PoolPartyBof\.cna/ nocase ascii wide
$string1782 = "PoolPartyBof-main" nocase ascii wide
$string1783 = "PortBender backdoor" nocase ascii wide
$string1784 = "PortBender redirect" nocase ascii wide
$string1785 = /PortBender\.cna/ nocase ascii wide
$string1786 = /PortBender\.cpp/ nocase ascii wide
$string1787 = /portbender\.dll/ nocase ascii wide
$string1788 = /PortBender\.exe/ nocase ascii wide
$string1789 = /PortBender\.h/ nocase ascii wide
$string1790 = /PortBender\.sln/ nocase ascii wide
$string1791 = /PortBender\.zip/ nocase ascii wide
$string1792 = /portscan_result\.cna/ nocase ascii wide
$string1793 = "portscan386 " nocase ascii wide
$string1794 = "portscan64 " nocase ascii wide
$string1795 = "post_ex_amsi_disable" nocase ascii wide
$string1796 = "post_ex_keylogger" nocase ascii wide
$string1797 = "post_ex_obfuscate" nocase ascii wide
$string1798 = "Post_EX_Process_Name" nocase ascii wide
$string1799 = "post_ex_smartinject" nocase ascii wide
$string1800 = "post_ex_spawnto_x64" nocase ascii wide
$string1801 = "post_ex_spawnto_x86" nocase ascii wide
$string1802 = "powershell_encode_oneliner" nocase ascii wide
$string1803 = "powershell_encode_oneliner" nocase ascii wide
$string1804 = "powershell_encode_stager" nocase ascii wide
$string1805 = "powershell_encode_stager" nocase ascii wide
$string1806 = /powershell\-import\s.{0,1000}\.ps1/ nocase ascii wide
$string1807 = "PowerView3-Aggressor" nocase ascii wide
$string1808 = /ppenum\.c/ nocase ascii wide
$string1809 = /ppenum\.exe/ nocase ascii wide
$string1810 = /ppenum\.x64\./ nocase ascii wide
$string1811 = /ppenum\.x86\./ nocase ascii wide
$string1812 = /ppl_dump\.x64/ nocase ascii wide
$string1813 = "ppldump " nocase ascii wide
$string1814 = /PPLDump_BOF\./ nocase ascii wide
$string1815 = /pplfault\.cna/ nocase ascii wide
$string1816 = "PPLFaultDumpBOF" nocase ascii wide
$string1817 = /PPLFaultPayload\.dll/ nocase ascii wide
$string1818 = "PPLFaultTemp" nocase ascii wide
$string1819 = /praetorian\.antihacker/ nocase ascii wide
$string1820 = "praetorian-inc/PortBender" nocase ascii wide
$string1821 = "prepareResponseForHiddenAPICall" nocase ascii wide
$string1822 = "PrintSpoofer-" nocase ascii wide
$string1823 = /PrintSpoofer\./ nocase ascii wide
$string1824 = /process_imports\.cna/ nocase ascii wide
$string1825 = /process_imports\.x64/ nocase ascii wide
$string1826 = /process_imports_api\s.{0,1000}\.exe/ nocase ascii wide
$string1827 = "process_inject_allocator" nocase ascii wide
$string1828 = "process_inject_bof_allocator" nocase ascii wide
$string1829 = "process_inject_bof_reuse_memory" nocase ascii wide
$string1830 = "process_inject_execute" nocase ascii wide
$string1831 = "process_inject_min_alloc" nocase ascii wide
$string1832 = "process_inject_startrwx" nocase ascii wide
$string1833 = "Process_Inject_Struct" nocase ascii wide
$string1834 = "process_inject_transform_x" nocase ascii wide
$string1835 = "process_inject_userwx" nocase ascii wide
$string1836 = "process_protection_enum " nocase ascii wide
$string1837 = /process_protection_enum.{0,1000}\.dmp/ nocase ascii wide
$string1838 = /process_protection_enum\./ nocase ascii wide
$string1839 = /Process_Protection_Level_BOF\./ nocase ascii wide
$string1840 = "Process_Protection_Level_BOF/" nocase ascii wide
$string1841 = /ProcessDestroy\.x64/ nocase ascii wide
$string1842 = /ProcessDestroy\.x64\./ nocase ascii wide
$string1843 = /ProcessDestroy\.x86/ nocase ascii wide
$string1844 = /ProcessDestroy\.x86\./ nocase ascii wide
$string1845 = "process-inject " nocase ascii wide
$string1846 = "processinject_min_alloc" nocase ascii wide
$string1847 = /ProgIDsUACBypass\./ nocase ascii wide
$string1848 = "Proxy Shellcode Handler" nocase ascii wide
$string1849 = /proxychains.{0,1000}scshell/ nocase ascii wide
$string1850 = "proxyshellcodeurl" nocase ascii wide
$string1851 = /PSconfusion\.py/ nocase ascii wide
$string1852 = "PSEXEC_PSH " nocase ascii wide
$string1853 = "pureqh/bypassAV" nocase ascii wide
$string1854 = "pwn1sher/CS-BOFs" nocase ascii wide
$string1855 = /pycobalt\./ nocase ascii wide
$string1856 = "pycobalt/aggressor" nocase ascii wide
$string1857 = "pycobalt_debug_on" nocase ascii wide
$string1858 = "pycobalt_path" nocase ascii wide
$string1859 = "pycobalt_python" nocase ascii wide
$string1860 = "pycobalt_timeout" nocase ascii wide
$string1861 = "pyMalleableC2" nocase ascii wide
$string1862 = "pystinger_for_darkshadow" nocase ascii wide
$string1863 = "python scshell" nocase ascii wide
$string1864 = /python2\?\?\/generator\.py/ nocase ascii wide
$string1865 = /python2\?\?\/PyLoader\.py/ nocase ascii wide
$string1866 = "python3 scshell" nocase ascii wide
$string1867 = /python3\?\?\/generator\.py/ nocase ascii wide
$string1868 = /python3\?\?\/PyLoader\.py/ nocase ascii wide
$string1869 = "QUAPCInjectAsSystem" nocase ascii wide
$string1870 = "QUAPCInjectElevated" nocase ascii wide
$string1871 = "QUAPCInjectFakecmd" nocase ascii wide
$string1872 = "QUAPCInjectFakecmd" nocase ascii wide
$string1873 = "QUAPCInjectWithoutPid" nocase ascii wide
$string1874 = /quser\.x64\.o/ nocase ascii wide
$string1875 = /quser\.x86\.o/ nocase ascii wide
$string1876 = "QXh4OEF4eDhBeHg4QXh4OA==" nocase ascii wide
$string1877 = "RAI/ase_docker" nocase ascii wide
$string1878 = /rai\-attack\-servers\./ nocase ascii wide
$string1879 = "rai-redirector-dns" nocase ascii wide
$string1880 = "rai-redirector-http" nocase ascii wide
$string1881 = "RalfHacker/Kerbeus-BOF" nocase ascii wide
$string1882 = "random_c2_profile" nocase ascii wide
$string1883 = /random_c2profile\./ nocase ascii wide
$string1884 = /random_user_agent\.params/ nocase ascii wide
$string1885 = /random_user_agent\.user_agent/ nocase ascii wide
$string1886 = "rasta-mouse/PPEnum" nocase ascii wide
$string1887 = "rasta-mouse/TikiTorch" nocase ascii wide
$string1888 = /rdi_net_user\.cpp/ nocase ascii wide
$string1889 = /rdphijack\.x64/ nocase ascii wide
$string1890 = /rdphijack\.x86/ nocase ascii wide
$string1891 = "RDPHijack-BOF" nocase ascii wide
$string1892 = /RdpThief\./ nocase ascii wide
$string1893 = "read_cs_teamserver" nocase ascii wide
$string1894 = /Recon\-AD\-.{0,1000}\.dll/ nocase ascii wide
$string1895 = /Recon\-AD\-.{0,1000}\.sln/ nocase ascii wide
$string1896 = /Recon\-AD\-.{0,1000}\.vcxproj/ nocase ascii wide
$string1897 = "Recon-AD-AllLocalGroups" nocase ascii wide
$string1898 = "Recon-AD-Domain" nocase ascii wide
$string1899 = "Recon-AD-LocalGroups" nocase ascii wide
$string1900 = "Recon-AD-SPNs" nocase ascii wide
$string1901 = /Recon\-AD\-Users\./ nocase ascii wide
$string1902 = "redelk_backend_name_c2" nocase ascii wide
$string1903 = "redelk_backend_name_decoy" nocase ascii wide
$string1904 = /Red\-Team\-Infrastructure\-Wiki\./ nocase ascii wide
$string1905 = /RedWarden\.py/ nocase ascii wide
$string1906 = /RedWarden\.test/ nocase ascii wide
$string1907 = /redwarden_access\.log/ nocase ascii wide
$string1908 = /redwarden_redirector\.log/ nocase ascii wide
$string1909 = /reflective_dll\.dll/ nocase ascii wide
$string1910 = /reflective_dll\.x64\.dll/ nocase ascii wide
$string1911 = /ReflectiveDll\.x64\.dll/ nocase ascii wide
$string1912 = /ReflectiveDll\.x86\.dll/ nocase ascii wide
$string1913 = "Reflective-HackBrowserData" nocase ascii wide
$string1914 = /Remote\/lastpass\/lastpass\.x86\./ nocase ascii wide
$string1915 = "Remote/setuserpass/" nocase ascii wide
$string1916 = "Remote/shspawnas" nocase ascii wide
$string1917 = "Remote/suspendresume/" nocase ascii wide
$string1918 = /remote\-exec\s.{0,1000}jump\s/ nocase ascii wide
$string1919 = /remotereg\.cna/ nocase ascii wide
$string1920 = "replace_key_iv_shellcode" nocase ascii wide
$string1921 = "RiccardoAncarani/BOFs" nocase ascii wide
$string1922 = "RiccardoAncarani/LiquidSnake" nocase ascii wide
$string1923 = "RiccardoAncarani/TaskShell" nocase ascii wide
$string1924 = "rkervella/CarbonMonoxide" nocase ascii wide
$string1925 = "rookuu/BOFs/" nocase ascii wide
$string1926 = /rpcattack\.py/ nocase ascii wide
$string1927 = /rpcrelayclient\.py/ nocase ascii wide
$string1928 = "rsmudge/ElevateKit" nocase ascii wide
$string1929 = "runasadmin uac-cmstplua" nocase ascii wide
$string1930 = "runasadmin uac-token-duplication" nocase ascii wide
$string1931 = /RunOF\.exe\s\-/ nocase ascii wide
$string1932 = /RunOF\.Internals/ nocase ascii wide
$string1933 = /rustbof\.cna/ nocase ascii wide
$string1934 = "rvrsh3ll/BOF_Collection" nocase ascii wide
$string1935 = "rxwx/cs-rdll-ipc-example" nocase ascii wide
$string1936 = /s4u\.x64\.c/ nocase ascii wide
$string1937 = /s4u\.x64\.o/ nocase ascii wide
$string1938 = /SafetyKatz\.exe/ nocase ascii wide
$string1939 = /SamAdduser\.exe/ nocase ascii wide
$string1940 = "samr_##" nocase ascii wide
$string1941 = /ScareCrow.{0,1000}\s\-encryptionmode\s/ nocase ascii wide
$string1942 = /ScareCrow.{0,1000}\s\-Evasion/ nocase ascii wide
$string1943 = /ScareCrow.{0,1000}\s\-Exec/ nocase ascii wide
$string1944 = /ScareCrow.{0,1000}\s\-injection/ nocase ascii wide
$string1945 = /ScareCrow.{0,1000}\s\-Loader\s.{0,1000}\s/ nocase ascii wide
$string1946 = /ScareCrow.{0,1000}\s\-noamsi/ nocase ascii wide
$string1947 = /ScareCrow.{0,1000}\s\-noetw/ nocase ascii wide
$string1948 = /ScareCrow.{0,1000}\s\-obfu/ nocase ascii wide
$string1949 = /ScareCrow.{0,1000}_darwin_amd64/
$string1950 = /ScareCrow.{0,1000}_windows_amd64\.exe/ nocase ascii wide
$string1951 = /ScareCrow.{0,1000}KnownDLL/ nocase ascii wide
$string1952 = /ScareCrow.{0,1000}ProcessInjection/ nocase ascii wide
$string1953 = /ScareCrow\.cna/ nocase ascii wide
$string1954 = "ScareCrow/Cryptor" nocase ascii wide
$string1955 = "ScareCrow/limelighter" nocase ascii wide
$string1956 = "ScareCrow/Loader" nocase ascii wide
$string1957 = "ScareCrow/Utils" nocase ascii wide
$string1958 = /schshell\.cna/ nocase ascii wide
$string1959 = "schtask_callback" nocase ascii wide
$string1960 = "schtasks_elevator" nocase ascii wide
$string1961 = "schtasks_exploit " nocase ascii wide
$string1962 = /ScRunBase32\.exe/ nocase ascii wide
$string1963 = /ScRunBase32\.py/ nocase ascii wide
$string1964 = /ScRunBase64\.exe/ nocase ascii wide
$string1965 = /ScRunBase64\.py/ nocase ascii wide
$string1966 = /scshell.{0,1000}XblAuthManager/ nocase ascii wide
$string1967 = /SCShell\.exe/ nocase ascii wide
$string1968 = /scshell\.py/ nocase ascii wide
$string1969 = /scshellbof\.c/ nocase ascii wide
$string1970 = /scshellbof\.o/ nocase ascii wide
$string1971 = "scshellbofx64" nocase ascii wide
$string1972 = "searchsploit_rc" nocase ascii wide
$string1973 = /Seatbelt\.exe/ nocase ascii wide
$string1974 = "sec-inject " nocase ascii wide
$string1975 = /secinject\.cna/ nocase ascii wide
$string1976 = /secinject\.git/ nocase ascii wide
$string1977 = /secinject\.x64/ nocase ascii wide
$string1978 = /secinject\.x86/ nocase ascii wide
$string1979 = "secinject/src" nocase ascii wide
$string1980 = /secretsdump\..{0,1000}\.pyc/ nocase ascii wide
$string1981 = /secretsdump\.py/ nocase ascii wide
$string1982 = "sec-shinject " nocase ascii wide
$string1983 = /self_delete\.x64\.o/ nocase ascii wide
$string1984 = "Self_Deletion_BOF" nocase ascii wide
$string1985 = "send_shellcode_via_pipe" nocase ascii wide
$string1986 = "send_shellcode_via_pipe" nocase ascii wide
$string1987 = /serverscan\.linux\.elf/
$string1988 = /serverscan\.linux\.so/
$string1989 = /serverScan\.win\.cna/ nocase ascii wide
$string1990 = /serverscan_386\.exe/ nocase ascii wide
$string1991 = /ServerScan_Air_.{0,1000}\.exe/ nocase ascii wide
$string1992 = /ServerScan_Air_.{0,1000}_amd64/ nocase ascii wide
$string1993 = /ServerScan_Air_.{0,1000}_i386/ nocase ascii wide
$string1994 = /serverscan_air\-probes\.exe/ nocase ascii wide
$string1995 = /serverscan_amd64\.exe/ nocase ascii wide
$string1996 = /ServerScan_Pro_.{0,1000}\.exe/ nocase ascii wide
$string1997 = /ServerScan_Pro_.{0,1000}_amd64/ nocase ascii wide
$string1998 = /ServerScan_Pro_.{0,1000}_i386/ nocase ascii wide
$string1999 = "serverscan64 " nocase ascii wide
$string2000 = /serverscan64\s.{0,1000}tcp/ nocase ascii wide
$string2001 = "serverscan86 " nocase ascii wide
$string2002 = /servicemove.{0,1000}hid\.dll/ nocase ascii wide
$string2003 = "set hosts_stage" nocase ascii wide
$string2004 = "set keylogger" nocase ascii wide
$string2005 = "set obfuscate " nocase ascii wide
$string2006 = "set pipename " nocase ascii wide
$string2007 = "set smartinject" nocase ascii wide
$string2008 = "set userwx" nocase ascii wide
$string2009 = "setc_webshell" nocase ascii wide
$string2010 = "setLoaderFlagZero" nocase ascii wide
$string2011 = /setthreadcontext\.x64/ nocase ascii wide
$string2012 = /setthreadcontext\.x86/ nocase ascii wide
$string2013 = "setup_obfuscate_xor_key" nocase ascii wide
$string2014 = "setup_reflective_loader" nocase ascii wide
$string2015 = "seventeenman/CallBackDump" nocase ascii wide
$string2016 = /ShadowUser\/scvhost\.exe/ nocase ascii wide
$string2017 = /SharpCalendar\.exe/ nocase ascii wide
$string2018 = /SharpCat\.exe/ nocase ascii wide
$string2019 = /sharpcompile.{0,1000}\.exe/ nocase ascii wide
$string2020 = "sharpCompileHandler" nocase ascii wide
$string2021 = "SharpCompileServer" nocase ascii wide
$string2022 = /SharpCompileServer\.exe/ nocase ascii wide
$string2023 = /SharpCradle.{0,1000}logonpasswords/ nocase ascii wide
$string2024 = /SharpCradle\.exe/ nocase ascii wide
$string2025 = "SharpEventLoader" nocase ascii wide
$string2026 = "SharpEventPersist" nocase ascii wide
$string2027 = "SharpExcelibur" nocase ascii wide
$string2028 = "sharp-exec " nocase ascii wide
$string2029 = "sharp-fexec " nocase ascii wide
$string2030 = /SharpGen\.dll/ nocase ascii wide
$string2031 = /sharpgen\.enable_cache/ nocase ascii wide
$string2032 = /sharpgen\.py/ nocase ascii wide
$string2033 = /sharpgen\.set_location/ nocase ascii wide
$string2034 = "Sharp-HackBrowserData" nocase ascii wide
$string2035 = /SharpHound\.cna/ nocase ascii wide
$string2036 = /SharpHound\.exe/ nocase ascii wide
$string2037 = /SharpHound\.ps1/ nocase ascii wide
$string2038 = /Sharphound2\./ nocase ascii wide
$string2039 = "Sharphound-Aggressor" nocase ascii wide
$string2040 = "SharpSCShell" nocase ascii wide
$string2041 = "SharpSploitConsole_x" nocase ascii wide
$string2042 = /SharpStay\.exe/ nocase ascii wide
$string2043 = /SharpSword\.exe/ nocase ascii wide
$string2044 = "SharpZeroLogon" nocase ascii wide
$string2045 = /SharpZippo\.exe/ nocase ascii wide
$string2046 = /shell\.exe\s\-s\spayload\.txt/ nocase ascii wide
$string2047 = /Shellcode_encryption\.exe/ nocase ascii wide
$string2048 = /shellcode_generator\./ nocase ascii wide
$string2049 = /shellcode_generator_help\.html/ nocase ascii wide
$string2050 = /ShellCode_Loader\.py/ nocase ascii wide
$string2051 = /shellcode20\.exe/ nocase ascii wide
$string2052 = /shellcode30\.exe/ nocase ascii wide
$string2053 = /shellcode35\.exe/ nocase ascii wide
$string2054 = /shellcode40\.exe/ nocase ascii wide
$string2055 = "shspawn x64 " nocase ascii wide
$string2056 = "shspawn x86 " nocase ascii wide
$string2057 = /SigFlip\.exe\s\-/ nocase ascii wide
$string2058 = /SigFlip\.WinTrustData/ nocase ascii wide
$string2059 = /SigInject\s.{0,1000}\.dll/ nocase ascii wide
$string2060 = /Sigloader\s.{0,1000}\.dll/ nocase ascii wide
$string2061 = /SigLoader\/sigloader\.c/ nocase ascii wide
$string2062 = /sigwhatever\.exe/ nocase ascii wide
$string2063 = "Silent Lsass Dump" nocase ascii wide
$string2064 = "SilentCleanupWinDirBOF" nocase ascii wide
$string2065 = "silentLsassDump" nocase ascii wide
$string2066 = "-Situational-Awareness-BOF" nocase ascii wide
$string2067 = /sleep_python_bridge\.sleepy/ nocase ascii wide
$string2068 = /sleep_python_bridge\.striker/ nocase ascii wide
$string2069 = /sleepmask\.x64\.o/ nocase ascii wide
$string2070 = /sleepmask\.x86\.o/ nocase ascii wide
$string2071 = /sleepmask_pivot\.x64\.o/ nocase ascii wide
$string2072 = /sleepmask_pivot\.x86\.o/ nocase ascii wide
$string2073 = "smb_pipename_stager" nocase ascii wide
$string2074 = /smbattack\.py/ nocase ascii wide
$string2075 = /smbrelayclient\.py/ nocase ascii wide
$string2076 = /smbrelayserver\./ nocase ascii wide
$string2077 = /smtprelayclient\.py/ nocase ascii wide
$string2078 = "socky whoami" nocase ascii wide
$string2079 = /SourcePoint.{0,1000}Loader\.go/ nocase ascii wide
$string2080 = /source\-teamserver\.sh/ nocase ascii wide
$string2081 = "spawn/runshellcode" nocase ascii wide
$string2082 = /SpawnTheThing\(/ nocase ascii wide
$string2083 = /spawnto\s.{0,1000}\.exe/ nocase ascii wide
$string2084 = "'spawnto_x64'" nocase ascii wide
$string2085 = "'spawnto_x86'" nocase ascii wide
$string2086 = "spoolss_##" nocase ascii wide
$string2087 = "spoolsystem inject" nocase ascii wide
$string2088 = "spoolsystem spawn" nocase ascii wide
$string2089 = /spoolsystem\.cna/ nocase ascii wide
$string2090 = /SpoolTrigger\.x64\.dl/ nocase ascii wide
$string2091 = /SpoolTrigger\.x64\.dll/ nocase ascii wide
$string2092 = /SpoolTrigger\.x86\.dl/ nocase ascii wide
$string2093 = /SpoolTrigger\.x86\.dll/ nocase ascii wide
$string2094 = /SpoolTrigger\\SpoolTrigger\./ nocase ascii wide
$string2095 = "Spray-AD " nocase ascii wide
$string2096 = /Spray\-AD\.cna/ nocase ascii wide
$string2097 = /Spray\-AD\.dll/ nocase ascii wide
$string2098 = /Spray\-AD\.exe/ nocase ascii wide
$string2099 = /Spray\-AD\.sln/ nocase ascii wide
$string2100 = /Spray\-AD\\Spray\-AD/ nocase ascii wide
$string2101 = "src/Remote/chromeKey/" nocase ascii wide
$string2102 = "src/Remote/lastpass/" nocase ascii wide
$string2103 = "src/Remote/sc_config/" nocase ascii wide
$string2104 = "src/Remote/sc_create/" nocase ascii wide
$string2105 = "src/Remote/sc_delete/" nocase ascii wide
$string2106 = "src/Remote/sc_start/" nocase ascii wide
$string2107 = "Src/Spray-AD" nocase ascii wide
$string2108 = /src\/zerologon\.c/ nocase ascii wide
$string2109 = /src\\unhook\.c/ nocase ascii wide
$string2110 = "srvsvc_##" nocase ascii wide
$string2111 = "SspiUacBypass" nocase ascii wide
$string2112 = "SspiUacBypassBOF" nocase ascii wide
$string2113 = /stage\.obfuscate/ nocase ascii wide
$string2114 = "stage_smartinject" nocase ascii wide
$string2115 = "stage_transform_x64_prepend" nocase ascii wide
$string2116 = "stage_transform_x64_strrep1" nocase ascii wide
$string2117 = "stage_transform_x86_prepend" nocase ascii wide
$string2118 = "stage_transform_x86_strrep1" nocase ascii wide
$string2119 = "stageless payload" nocase ascii wide
$string2120 = "stager_bind_pipe" nocase ascii wide
$string2121 = "stager_bind_pipe" nocase ascii wide
$string2122 = "stager_bind_tcp" nocase ascii wide
$string2123 = "stager_bind_tcp" nocase ascii wide
$string2124 = "start stinger " nocase ascii wide
$string2125 = "Starting PoolParty attack against process id:" nocase ascii wide
$string2126 = /StartProcessFake\(/ nocase ascii wide
$string2127 = "static_syscalls_apc_spawn " nocase ascii wide
$string2128 = "static_syscalls_apc_spawn" nocase ascii wide
$string2129 = "static_syscalls_dump" nocase ascii wide
$string2130 = /StayKit\.cna/ nocase ascii wide
$string2131 = /StayKit\.exe/ nocase ascii wide
$string2132 = /StayKit\.git/ nocase ascii wide
$string2133 = /steal_token\(/ nocase ascii wide
$string2134 = "steal_token_access_mask" nocase ascii wide
$string2135 = "stinger_client -" nocase ascii wide
$string2136 = /stinger_client\.py/ nocase ascii wide
$string2137 = /stinger_server\.exe/ nocase ascii wide
$string2138 = /strip_bof\.ps1/ nocase ascii wide
$string2139 = "strip-bof -Path " nocase ascii wide
$string2140 = /sudo\s\.\/teamserver\s/
$string2141 = /suspendresume\.x64\./ nocase ascii wide
$string2142 = /suspendresume\.x86\./ nocase ascii wide
$string2143 = "SW2_GetSyscallNumber" nocase ascii wide
$string2144 = "SW2_HashSyscall" nocase ascii wide
$string2145 = "SW2_PopulateSyscallList" nocase ascii wide
$string2146 = "SW2_RVA2VA" nocase ascii wide
$string2147 = /SwampThing\.exe/ nocase ascii wide
$string2148 = /SweetPotato\.cna/ nocase ascii wide
$string2149 = /SweetPotato\.csproj/ nocase ascii wide
$string2150 = /SweetPotato\.exe/ nocase ascii wide
$string2151 = /SweetPotato\.ImpersonationToken/ nocase ascii wide
$string2152 = /SweetPotato\.sln/ nocase ascii wide
$string2153 = "syscall_disable_priv " nocase ascii wide
$string2154 = "syscall_enable_priv " nocase ascii wide
$string2155 = /syscalls\.asm/ nocase ascii wide
$string2156 = /syscalls_dump\./ nocase ascii wide
$string2157 = "syscalls_inject " nocase ascii wide
$string2158 = /syscalls_inject\./ nocase ascii wide
$string2159 = "syscalls_shinject " nocase ascii wide
$string2160 = "syscalls_shspawn " nocase ascii wide
$string2161 = "syscalls_spawn " nocase ascii wide
$string2162 = /syscalls_spawn\./ nocase ascii wide
$string2163 = /syscallsapcspawn\.x64/ nocase ascii wide
$string2164 = /syscalls\-asm\.h/ nocase ascii wide
$string2165 = /syscallsdump\.x64/ nocase ascii wide
$string2166 = /syscallsinject\.x64/ nocase ascii wide
$string2167 = /syscallsspawn\.x64/ nocase ascii wide
$string2168 = /systemctl\senable\steamserver\.service/ nocase ascii wide
$string2169 = /systemctl\sstart\steamserver\.service/ nocase ascii wide
$string2170 = /systemctl\sstatus\steamserver\.service/ nocase ascii wide
$string2171 = /SysWhispers\.git\s/ nocase ascii wide
$string2172 = /syswhispers\.py/ nocase ascii wide
$string2173 = /syswhispers\.py/ nocase ascii wide
$string2174 = "SysWhispers2" nocase ascii wide
$string2175 = /TailorScan\.exe\s/ nocase ascii wide
$string2176 = "TailorScan_darwin"
$string2177 = "TailorScan_freebsd" nocase ascii wide
$string2178 = "TailorScan_linux_"
$string2179 = "TailorScan_netbsd_" nocase ascii wide
$string2180 = "TailorScan_openbsd_" nocase ascii wide
$string2181 = /TailorScan_windows_.{0,1000}\.exe/ nocase ascii wide
$string2182 = /TaskShell\.exe\s.{0,1000}\s\-b\s.{0,1000}\.exe/ nocase ascii wide
$string2183 = /TaskShell\.exe\s.{0,1000}\s\-s\s.{0,1000}SYSTEM/ nocase ascii wide
$string2184 = /teamserver\s.{0,1000}\sc2\-profiles\// nocase ascii wide
$string2185 = /teamserver.{0,1000}\sno_evasion\.profile/ nocase ascii wide
$string2186 = /TeamServer\.prop/ nocase ascii wide
$string2187 = /Temp\\dumpert/ nocase ascii wide
$string2188 = /test_invoke_bof\.x64\.o/ nocase ascii wide
$string2189 = "tgtdelegation " nocase ascii wide
$string2190 = /tgtdelegation\.cna/ nocase ascii wide
$string2191 = /tgtdelegation\.x64/ nocase ascii wide
$string2192 = /tgtdelegation\.x86/ nocase ascii wide
$string2193 = /tgtParse\.py\s/ nocase ascii wide
$string2194 = "third_party/SharpGen" nocase ascii wide
$string2195 = /third\-party.{0,1000}winvnc.{0,1000}\.dll/ nocase ascii wide
$string2196 = /threatexpress.{0,1000}malleable/ nocase ascii wide
$string2197 = "threatexpress/cs2modrewrite" nocase ascii wide
$string2198 = /ticketConverter\.py\s.{0,1000}\.ccache\s/ nocase ascii wide
$string2199 = "tijme/kernel-mii" nocase ascii wide
$string2200 = /TikiLoader.{0,1000}Hollower/ nocase ascii wide
$string2201 = /TikiLoader\./ nocase ascii wide
$string2202 = /TikiLoader\./ nocase ascii wide
$string2203 = /TikiLoader\.dll/ nocase ascii wide
$string2204 = /TikiLoader\.dll/ nocase ascii wide
$string2205 = /TikiLoader\.Injector/ nocase ascii wide
$string2206 = /TikiLoader\\TikiLoader/ nocase ascii wide
$string2207 = /TikiSpawn\.dll/ nocase ascii wide
$string2208 = /TikiSpawn\.exe/ nocase ascii wide
$string2209 = /TikiSpawn\.ps1/ nocase ascii wide
$string2210 = "TikiSpawnAs" nocase ascii wide
$string2211 = "TikiSpawnAsAdmin" nocase ascii wide
$string2212 = "TikiSpawnElevated" nocase ascii wide
$string2213 = "TikiSpawnWOppid" nocase ascii wide
$string2214 = "TikiSpawnWppid" nocase ascii wide
$string2215 = /TikiTorch\.exe/ nocase ascii wide
$string2216 = /TikiVader\./ nocase ascii wide
$string2217 = "timwhitez/Doge-Loader" nocase ascii wide
$string2218 = /Tmprovider\.dll/ nocase ascii wide
$string2219 = /toggle_privileges\.cna/ nocase ascii wide
$string2220 = /toggle_privileges_bof\./ nocase ascii wide
$string2221 = "Toggle_Token_Privileges_BOF" nocase ascii wide
$string2222 = "ToggleWDigest" nocase ascii wide
$string2223 = "TokenStripBOF/src" nocase ascii wide
$string2224 = "token-vault steal" nocase ascii wide
$string2225 = /token\-vault\.cna/ nocase ascii wide
$string2226 = /token\-vault\.x64\.o/ nocase ascii wide
$string2227 = /token\-vault\.x86\.o/ nocase ascii wide
$string2228 = "trainr3kt/MemReader_BoF" nocase ascii wide
$string2229 = "trainr3kt/Readfile_BoF" nocase ascii wide
$string2230 = "TrustedPathDLLHijack" nocase ascii wide
$string2231 = "TrustedPath-UACBypass-BOF" nocase ascii wide
$string2232 = "Tycx2ry/SweetPotato" nocase ascii wide
$string2233 = "Tylous/SourcePoint" nocase ascii wide
$string2234 = "UACBypass-BOF" nocase ascii wide
$string2235 = "uac-schtasks " nocase ascii wide
$string2236 = "uac-schtasks" nocase ascii wide
$string2237 = "uac-silentcleanup" nocase ascii wide
$string2238 = "uac-token-duplication" nocase ascii wide
$string2239 = /uhttpsharp\./ nocase ascii wide
$string2240 = "uknowsec/TailorScan" nocase ascii wide
$string2241 = "UMJjAiNUUtvNww0lBj9tzWegwphuIn6hNP9eeIDfOrcHJ3nozYFPT-Jl7WsmbmjZnQXUesoJkcJkpdYEdqgQFE6QZgjWVsLSSDonL28DYDVJ" nocase ascii wide
$string2242 = "Un1k0d3r/SCShell" nocase ascii wide
$string2243 = /ursnif_IcedID\.profile/ nocase ascii wide
$string2244 = "Visual-Studio-BOF-template" nocase ascii wide
$string2245 = /vssenum\.x64\./ nocase ascii wide
$string2246 = /vssenum\.x86\./ nocase ascii wide
$string2247 = "vysecurity/ANGRYPUPPY" nocase ascii wide
$string2248 = /wcfrelayserver\.py/ nocase ascii wide
$string2249 = "wdigest!g_fParameter_UseLogonCredential" nocase ascii wide
$string2250 = "wdigest!g_IsCredGuardEnabled" nocase ascii wide
$string2251 = /whereami\.cna/ nocase ascii wide
$string2252 = /whereami\.x64/ nocase ascii wide
$string2253 = "WhoamiGetTokenInfo" nocase ascii wide
$string2254 = /wifidump\.cna/ nocase ascii wide
$string2255 = "windows/beacon_smb/" nocase ascii wide
$string2256 = /windows\-exploit\-suggester\./ nocase ascii wide
$string2257 = "winrmdll " nocase ascii wide
$string2258 = /winrmdll\./ nocase ascii wide
$string2259 = "Winsocky-main" nocase ascii wide
$string2260 = "WKL-Sec/HiddenDesktop" nocase ascii wide
$string2261 = "WKL-Sec/Winsocky" nocase ascii wide
$string2262 = "wkssvc_##" nocase ascii wide
$string2263 = /Wmi_Persistence\.ps1/ nocase ascii wide
$string2264 = /wmi\-event\-lateral\-movement\./ nocase ascii wide
$string2265 = /WMI\-EventSub\.cpp/ nocase ascii wide
$string2266 = /wmi\-lateral\-movement\./ nocase ascii wide
$string2267 = /WMI\-ProcessCreate\.cpp/ nocase ascii wide
$string2268 = "write_cs_teamserver" nocase ascii wide
$string2269 = "WriteAndExecuteShellcode" nocase ascii wide
$string2270 = "WritePayloadDllTransacted" nocase ascii wide
$string2271 = "wscript_elevator" nocase ascii wide
$string2272 = "wts_enum_remote_processes" nocase ascii wide
$string2273 = "wumb0/rust_bof" nocase ascii wide
$string2274 = "xforcered/CredBandit" nocase ascii wide
$string2275 = "xforcered/Detect-Hooks" nocase ascii wide
$string2276 = /xor\.exe\s.{0,1000}\.txt/ nocase ascii wide
$string2277 = "xor_payload" nocase ascii wide
$string2278 = /xpipe\s\\\\/ nocase ascii wide
$string2279 = /xpipe.{0,1000}lsass/ nocase ascii wide
$string2280 = /xpipe\.cna/ nocase ascii wide
$string2281 = /YDHCUI\/csload\.net/ nocase ascii wide
$string2282 = "YDHCUI/manjusaka" nocase ascii wide
$string2283 = "youcantpatchthis" nocase ascii wide
$string2284 = /ysoserial\.exe/ nocase ascii wide
$string2285 = "YwBhAGwAYwA=" nocase ascii wide
$string2286 = /zerologon\.x64/ nocase ascii wide
$string2287 = /zerologon\.x86/ nocase ascii wide
$string2288 = "ZeroLogon-BOF" nocase ascii wide
$string2289 = "zha0gongz1" nocase ascii wide
$string2290 = "zha0gongz1/DesertFox" nocase ascii wide
$string2291 = "ziiiiizzzb" nocase ascii wide
$string2292 = "ziiiiizzzib" nocase ascii wide
$string2293 = /\\\\demoagent_11/ nocase ascii wide
$string2294 = /\\\\demoagent_22/ nocase ascii wide
$string2295 = /\\\\DserNamePipe/ nocase ascii wide
$string2296 = /\\\\f4c3/ nocase ascii wide
$string2297 = /\\\\f53f/ nocase ascii wide
$string2298 = /\\\\fullduplex_/ nocase ascii wide
$string2299 = /\\\\interprocess_/ nocase ascii wide
$string2300 = /\\\\mojo_/ nocase ascii wide
$string2301 = /\\\\msagent_/ nocase ascii wide
$string2302 = /\\\\MsFteWds/ nocase ascii wide
$string2303 = /\\\\MSSE\-/ nocase ascii wide
$string2304 = /\\\\mypipe\-/ nocase ascii wide
$string2305 = /\\\\PGMessagePipe/ nocase ascii wide
$string2306 = /\\\\postex_/ nocase ascii wide
$string2307 = /\\\\postex_ssh_/ nocase ascii wide
$string2308 = /\\\\SearchTextHarvester/ nocase ascii wide
$string2309 = /\\\\UIA_PIPE/ nocase ascii wide
$string2310 = /\\\\Winsock2\\CatalogChangeListener\-/ nocase ascii wide
$string2311 = /\\Ladon\s.{0,1000}\.exe/ nocase ascii wide
$string2312 = "detect-hooks" nocase ascii wide
$string2313 = /doc\.1a\..{0,1000}\\\./ nocase ascii wide
$string2314 = /doc\.4a\..{0,1000}\\\./ nocase ascii wide
$string2315 = /doc\.bc\..{0,1000}\\\./ nocase ascii wide
$string2316 = /doc\.md\..{0,1000}\\\./ nocase ascii wide
$string2317 = /doc\.po\..{0,1000}\\\./ nocase ascii wide
$string2318 = /doc\.tx\..{0,1000}\\\./ nocase ascii wide
$string2319 = "dumpwifi " nocase ascii wide
$string2320 = "etw stop" nocase ascii wide
$string2321 = "fw_walk display" nocase ascii wide
$string2322 = "fw_walk status" nocase ascii wide
$string2323 = "fw_walk total" nocase ascii wide
$string2324 = "get-spns " nocase ascii wide
$string2325 = /Ladon\sMac\s.{0,1000}\s/ nocase ascii wide
$string2326 = "LdapSignCheck " nocase ascii wide
$string2327 = /load\s.{0,1000}\.cna/ nocase ascii wide
$string2328 = "make_token " nocase ascii wide
$string2329 = "needle_sift " nocase ascii wide
$string2330 = /SigFlip\s.{0,1000}\.exe/ nocase ascii wide
condition:
any of them
}