rule_cobaltstrike_offensive_tool_keyword
YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'cobaltstrike' taken from the ThreatHunting-Keywords github project
rule rule_cobaltstrike_offensive_tool_keyword
{
meta:
description = "Detection patterns for the tool 'cobaltstrike' taken from the ThreatHunting-Keywords github project"
author = "@mthcht"
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
tool = "cobaltstrike"
rule_category = "offensive_tool_keyword"
strings:
$string1_cobaltstrike_offensive_tool_keyword = /\s\$exploit_oneliner/ nocase ascii wide
$string2_cobaltstrike_offensive_tool_keyword = /\s\$payload_oneliner\s/ nocase ascii wide
$string3_cobaltstrike_offensive_tool_keyword = /\s\.beacon_keys\s\-/ nocase ascii wide
$string4_cobaltstrike_offensive_tool_keyword = /\s\/NAME\:.{0,100}\s\/KILL/ nocase ascii wide
$string5_cobaltstrike_offensive_tool_keyword = /\s\/PID\:.{0,100}\s\/DRIVER\:/ nocase ascii wide
$string6_cobaltstrike_offensive_tool_keyword = /\s\/PID\:.{0,100}\s\/KILL/ nocase ascii wide
$string7_cobaltstrike_offensive_tool_keyword = /\s\/ticket\:.{0,100}\s\/service\:.{0,100}\s\/targetdomain\:.{0,100}\s\/targetdc\:/ nocase ascii wide
$string8_cobaltstrike_offensive_tool_keyword = /\s\/user\:.{0,100}\s\/password\:.{0,100}\s\/enctype\:.{0,100}\s\/opsec\s\/ptt/ nocase ascii wide
$string9_cobaltstrike_offensive_tool_keyword = /\s1\.2\.3\.4\:8080/ nocase ascii wide
$string10_cobaltstrike_offensive_tool_keyword = " 4444 meter" nocase ascii wide
$string11_cobaltstrike_offensive_tool_keyword = " 4444 shell" nocase ascii wide
$string12_cobaltstrike_offensive_tool_keyword = " amsi_disable " nocase ascii wide
$string13_cobaltstrike_offensive_tool_keyword = /\sarp\.x64\.o/ nocase ascii wide
$string14_cobaltstrike_offensive_tool_keyword = " --assemblyargs AntiVirus" nocase ascii wide
$string15_cobaltstrike_offensive_tool_keyword = " --assemblyargs AppLocker" nocase ascii wide
$string16_cobaltstrike_offensive_tool_keyword = " base64_encode_shellcode" nocase ascii wide
$string17_cobaltstrike_offensive_tool_keyword = /\sbeacon\.dll/ nocase ascii wide
$string18_cobaltstrike_offensive_tool_keyword = " bof_allocator " nocase ascii wide
$string19_cobaltstrike_offensive_tool_keyword = " bof_reuse_memory " nocase ascii wide
$string20_cobaltstrike_offensive_tool_keyword = " -BOFBytes " nocase ascii wide
$string21_cobaltstrike_offensive_tool_keyword = " BOFNET " nocase ascii wide
$string22_cobaltstrike_offensive_tool_keyword = /\sBofRunner\(/ nocase ascii wide
$string23_cobaltstrike_offensive_tool_keyword = /\sbuild\sDent\.go/ nocase ascii wide
$string24_cobaltstrike_offensive_tool_keyword = " build_letmeout" nocase ascii wide
$string25_cobaltstrike_offensive_tool_keyword = /\sBypassUac.{0,100}\.bat/ nocase ascii wide
$string26_cobaltstrike_offensive_tool_keyword = /\sBypassUac.{0,100}\.dll/ nocase ascii wide
$string27_cobaltstrike_offensive_tool_keyword = /\sBypassUac.{0,100}\.exe/ nocase ascii wide
$string28_cobaltstrike_offensive_tool_keyword = /\s\-c\sCredEnum\.c/ nocase ascii wide
$string29_cobaltstrike_offensive_tool_keyword = " chrome logindata " nocase ascii wide
$string30_cobaltstrike_offensive_tool_keyword = " chrome masterkey " nocase ascii wide
$string31_cobaltstrike_offensive_tool_keyword = " -cobalt " nocase ascii wide
$string32_cobaltstrike_offensive_tool_keyword = " cobaltstrike" nocase ascii wide
$string33_cobaltstrike_offensive_tool_keyword = " CoffeeExecuteFunction" nocase ascii wide
$string34_cobaltstrike_offensive_tool_keyword = /\scom\.blackh4t/ nocase ascii wide
$string35_cobaltstrike_offensive_tool_keyword = " CrossC2 Listener" nocase ascii wide
$string36_cobaltstrike_offensive_tool_keyword = /\sCrossC2\./ nocase ascii wide
$string37_cobaltstrike_offensive_tool_keyword = " CrossC2Kit " nocase ascii wide
$string38_cobaltstrike_offensive_tool_keyword = /\sDelegationBOF\.c\s/ nocase ascii wide
$string39_cobaltstrike_offensive_tool_keyword = /\sdelegationx64\.o/ nocase ascii wide
$string40_cobaltstrike_offensive_tool_keyword = /\sdelegationx86\.o/ nocase ascii wide
$string41_cobaltstrike_offensive_tool_keyword = /\sDesertFox\.go/ nocase ascii wide
$string42_cobaltstrike_offensive_tool_keyword = /\sdetect\-hooks\.c\s/ nocase ascii wide
$string43_cobaltstrike_offensive_tool_keyword = " -dns_stager_prepend " nocase ascii wide
$string44_cobaltstrike_offensive_tool_keyword = " -dns_stager_subhost " nocase ascii wide
$string45_cobaltstrike_offensive_tool_keyword = /\s\-\-dotnetassembly\s.{0,100}\s\-\-amsi/ nocase ascii wide
$string46_cobaltstrike_offensive_tool_keyword = /\s\-\-dotnetassembly\s.{0,100}\s\-\-appdomain\s/ nocase ascii wide
$string47_cobaltstrike_offensive_tool_keyword = /\s\-\-dotnetassembly\s.{0,100}\s\-\-assemblyargs\s/ nocase ascii wide
$string48_cobaltstrike_offensive_tool_keyword = /\s\-\-dotnetassembly\s.{0,100}\s\-\-mailslot/ nocase ascii wide
$string49_cobaltstrike_offensive_tool_keyword = /\s\-\-dotnetassembly\s.{0,100}\s\-\-pipe\s/ nocase ascii wide
$string50_cobaltstrike_offensive_tool_keyword = " DraytekScan" nocase ascii wide
$string51_cobaltstrike_offensive_tool_keyword = " dump_memory64" nocase ascii wide
$string52_cobaltstrike_offensive_tool_keyword = " edge logindata " nocase ascii wide
$string53_cobaltstrike_offensive_tool_keyword = " edge masterkey " nocase ascii wide
$string54_cobaltstrike_offensive_tool_keyword = " EfsPotato" nocase ascii wide
$string55_cobaltstrike_offensive_tool_keyword = /\sexclusion\.c\s\/Fodefender\.o/ nocase ascii wide
$string56_cobaltstrike_offensive_tool_keyword = " -FakeCmdLine " nocase ascii wide
$string57_cobaltstrike_offensive_tool_keyword = " FileZillaPwd" nocase ascii wide
$string58_cobaltstrike_offensive_tool_keyword = /\sforgeTGT\(/ nocase ascii wide
$string59_cobaltstrike_offensive_tool_keyword = " FtpSniffer " nocase ascii wide
$string60_cobaltstrike_offensive_tool_keyword = " generate_my_dll" nocase ascii wide
$string61_cobaltstrike_offensive_tool_keyword = " generatePayload" nocase ascii wide
$string62_cobaltstrike_offensive_tool_keyword = " GetAppLockerPolicies" nocase ascii wide
$string63_cobaltstrike_offensive_tool_keyword = " GetLsassPid" nocase ascii wide
$string64_cobaltstrike_offensive_tool_keyword = /\sgophish\-.{0,100}\.zip/ nocase ascii wide
$string65_cobaltstrike_offensive_tool_keyword = " HackBrowserData" nocase ascii wide
$string66_cobaltstrike_offensive_tool_keyword = " -hasbootstraphint " nocase ascii wide
$string67_cobaltstrike_offensive_tool_keyword = /\sHiddenDesktop\.cna/ nocase ascii wide
$string68_cobaltstrike_offensive_tool_keyword = /\shollow\.x64\./ nocase ascii wide
$string69_cobaltstrike_offensive_tool_keyword = /\shostenum\.py\s/ nocase ascii wide
$string70_cobaltstrike_offensive_tool_keyword = " HTTPSniffer " nocase ascii wide
$string71_cobaltstrike_offensive_tool_keyword = /\s\-i\shavex\.profile\s/ nocase ascii wide
$string72_cobaltstrike_offensive_tool_keyword = " impacket " nocase ascii wide
$string73_cobaltstrike_offensive_tool_keyword = " -Injector NtMapViewOfSection" nocase ascii wide
$string74_cobaltstrike_offensive_tool_keyword = " -Injector VirtualAllocEx" nocase ascii wide
$string75_cobaltstrike_offensive_tool_keyword = " -isbeacon " nocase ascii wide
$string76_cobaltstrike_offensive_tool_keyword = " JspShell ua" nocase ascii wide
$string77_cobaltstrike_offensive_tool_keyword = " k8gege520 " nocase ascii wide
$string78_cobaltstrike_offensive_tool_keyword = /\skdbof\.cpp/ nocase ascii wide
$string79_cobaltstrike_offensive_tool_keyword = /\sLadon\.ps1/ nocase ascii wide
$string80_cobaltstrike_offensive_tool_keyword = /\sLadon\.py/ nocase ascii wide
$string81_cobaltstrike_offensive_tool_keyword = " --load-shellcode " nocase ascii wide
$string82_cobaltstrike_offensive_tool_keyword = /\smalleable\.profile/ nocase ascii wide
$string83_cobaltstrike_offensive_tool_keyword = " malleable-c2-randomizer" nocase ascii wide
$string84_cobaltstrike_offensive_tool_keyword = /\smemreader\.c\s/ nocase ascii wide
$string85_cobaltstrike_offensive_tool_keyword = " MemReader_BoF" nocase ascii wide
$string86_cobaltstrike_offensive_tool_keyword = " ms17010 -i " nocase ascii wide
$string87_cobaltstrike_offensive_tool_keyword = " ms17010 -n " nocase ascii wide
$string88_cobaltstrike_offensive_tool_keyword = " NTLMv1 captured " nocase ascii wide
$string89_cobaltstrike_offensive_tool_keyword = " -o /share/payloads/" nocase ascii wide
$string90_cobaltstrike_offensive_tool_keyword = " oxidfind -i " nocase ascii wide
$string91_cobaltstrike_offensive_tool_keyword = " oxidfind -n " nocase ascii wide
$string92_cobaltstrike_offensive_tool_keyword = " --payload-types all" nocase ascii wide
$string93_cobaltstrike_offensive_tool_keyword = " --payload-types bin" nocase ascii wide
$string94_cobaltstrike_offensive_tool_keyword = " --payload-types dll" nocase ascii wide
$string95_cobaltstrike_offensive_tool_keyword = " --payload-types exe" nocase ascii wide
$string96_cobaltstrike_offensive_tool_keyword = " --payload-types ps1" nocase ascii wide
$string97_cobaltstrike_offensive_tool_keyword = " --payload-types py" nocase ascii wide
$string98_cobaltstrike_offensive_tool_keyword = /\s\-\-payload\-types\ssvc\.exe/ nocase ascii wide
$string99_cobaltstrike_offensive_tool_keyword = " --payload-types vbs" nocase ascii wide
$string100_cobaltstrike_offensive_tool_keyword = " -PE_Clone " nocase ascii wide
$string101_cobaltstrike_offensive_tool_keyword = " Perform S4U constrained delegation abuse" nocase ascii wide
$string102_cobaltstrike_offensive_tool_keyword = " pipename_stager " nocase ascii wide
$string103_cobaltstrike_offensive_tool_keyword = " -pipename_stager " nocase ascii wide
$string104_cobaltstrike_offensive_tool_keyword = " pyasn1 " nocase ascii wide
$string105_cobaltstrike_offensive_tool_keyword = /\spyasn1\./ nocase ascii wide
$string106_cobaltstrike_offensive_tool_keyword = " rai-attack-dns" nocase ascii wide
$string107_cobaltstrike_offensive_tool_keyword = " rai-attack-http" nocase ascii wide
$string108_cobaltstrike_offensive_tool_keyword = " ReadFromLsass" nocase ascii wide
$string109_cobaltstrike_offensive_tool_keyword = " -RealCmdLine " nocase ascii wide
$string110_cobaltstrike_offensive_tool_keyword = " rustbof " nocase ascii wide
$string111_cobaltstrike_offensive_tool_keyword = /\sScareCrow\.go/ nocase ascii wide
$string112_cobaltstrike_offensive_tool_keyword = /\sScareCrow\.go/ nocase ascii wide
$string113_cobaltstrike_offensive_tool_keyword = /\sSeriousSam\.Execute\s/ nocase ascii wide
$string114_cobaltstrike_offensive_tool_keyword = " SetMzLogonPwd " nocase ascii wide
$string115_cobaltstrike_offensive_tool_keyword = /\ssigflip\.c\s/ nocase ascii wide
$string116_cobaltstrike_offensive_tool_keyword = /\sSigFlip\.exe/ nocase ascii wide
$string117_cobaltstrike_offensive_tool_keyword = /\sSigFlip\.PE/ nocase ascii wide
$string118_cobaltstrike_offensive_tool_keyword = /\ssigflip\.x64\./ nocase ascii wide
$string119_cobaltstrike_offensive_tool_keyword = /\ssigflip\.x86\./ nocase ascii wide
$string120_cobaltstrike_offensive_tool_keyword = " SigLoader " nocase ascii wide
$string121_cobaltstrike_offensive_tool_keyword = " Sigwhatever" nocase ascii wide
$string122_cobaltstrike_offensive_tool_keyword = /\sspawn\.x64\.c/ nocase ascii wide
$string123_cobaltstrike_offensive_tool_keyword = /\sspawn\.x64\.o/ nocase ascii wide
$string124_cobaltstrike_offensive_tool_keyword = " spawnto_x64 " nocase ascii wide
$string125_cobaltstrike_offensive_tool_keyword = " spawnto_x86 " nocase ascii wide
$string126_cobaltstrike_offensive_tool_keyword = /\sSpoolFool\s.{0,100}\.dll/ nocase ascii wide
$string127_cobaltstrike_offensive_tool_keyword = /\sStayKit\.cna/ nocase ascii wide
$string128_cobaltstrike_offensive_tool_keyword = /\sstriker\.py/ nocase ascii wide
$string129_cobaltstrike_offensive_tool_keyword = " SweetPotato by @_EthicalChaos" nocase ascii wide
$string130_cobaltstrike_offensive_tool_keyword = " SysWhispers" nocase ascii wide
$string131_cobaltstrike_offensive_tool_keyword = " TikiLoader" nocase ascii wide
$string132_cobaltstrike_offensive_tool_keyword = /\sTokenStrip\.c\s/ nocase ascii wide
$string133_cobaltstrike_offensive_tool_keyword = /\sTokenStripBOF\.o\s/ nocase ascii wide
$string134_cobaltstrike_offensive_tool_keyword = " TSCHRPCAttack" nocase ascii wide
$string135_cobaltstrike_offensive_tool_keyword = /\s\-urlcache\s.{0,100}\/debase64\// nocase ascii wide
$string136_cobaltstrike_offensive_tool_keyword = /\s\-wordlist\s.{0,100}\s\-spawnto\s/ nocase ascii wide
$string137_cobaltstrike_offensive_tool_keyword = " WriteToLsass" nocase ascii wide
$string138_cobaltstrike_offensive_tool_keyword = " xpipe" nocase ascii wide
$string139_cobaltstrike_offensive_tool_keyword = /\$C2_SERVER/ nocase ascii wide
$string140_cobaltstrike_offensive_tool_keyword = /\.\/c2lint\s/
$string141_cobaltstrike_offensive_tool_keyword = /\.\/Dent\s\-/
$string142_cobaltstrike_offensive_tool_keyword = /\.\/manjusaka/
$string143_cobaltstrike_offensive_tool_keyword = /\.\/ScareCrow\s/
$string144_cobaltstrike_offensive_tool_keyword = /\.\/SourcePoint\s/
$string145_cobaltstrike_offensive_tool_keyword = /\.admin\.123456\./ nocase ascii wide
$string146_cobaltstrike_offensive_tool_keyword = /\.api\.123456\./ nocase ascii wide
$string147_cobaltstrike_offensive_tool_keyword = /\.apps\.123456\./ nocase ascii wide
$string148_cobaltstrike_offensive_tool_keyword = /\.beta\.123456\./ nocase ascii wide
$string149_cobaltstrike_offensive_tool_keyword = /\.blog\.123456\./ nocase ascii wide
$string150_cobaltstrike_offensive_tool_keyword = /\.cobaltstrike/ nocase ascii wide
$string151_cobaltstrike_offensive_tool_keyword = /\.cobaltstrike\.beacon_keys/ nocase ascii wide
$string152_cobaltstrike_offensive_tool_keyword = /\.cobaltstrike\.beacon_keys/ nocase ascii wide
$string153_cobaltstrike_offensive_tool_keyword = /\.com\/dcsync\// nocase ascii wide
$string154_cobaltstrike_offensive_tool_keyword = /\.dev\.123456\./ nocase ascii wide
$string155_cobaltstrike_offensive_tool_keyword = /\.events\.123456\./ nocase ascii wide
$string156_cobaltstrike_offensive_tool_keyword = /\.exe\s.{0,100}\s\-eventlog\s.{0,100}Key\sManagement\sService/ nocase ascii wide
$string157_cobaltstrike_offensive_tool_keyword = /\.exe\s.{0,100}\s\-\-source\sPersistence/ nocase ascii wide
$string158_cobaltstrike_offensive_tool_keyword = /\.feeds\.123456\./ nocase ascii wide
$string159_cobaltstrike_offensive_tool_keyword = /\.files\.123456\./ nocase ascii wide
$string160_cobaltstrike_offensive_tool_keyword = /\.forums\.123456\./ nocase ascii wide
$string161_cobaltstrike_offensive_tool_keyword = /\.ftp\.123456\./ nocase ascii wide
$string162_cobaltstrike_offensive_tool_keyword = /\.go\.123456\./ nocase ascii wide
$string163_cobaltstrike_offensive_tool_keyword = /\.groups\.123456\./ nocase ascii wide
$string164_cobaltstrike_offensive_tool_keyword = /\.help\.123456\./ nocase ascii wide
$string165_cobaltstrike_offensive_tool_keyword = /\.imap\.123456\./ nocase ascii wide
$string166_cobaltstrike_offensive_tool_keyword = /\.img\.123456\./ nocase ascii wide
$string167_cobaltstrike_offensive_tool_keyword = /\.kb\.123456\./ nocase ascii wide
$string168_cobaltstrike_offensive_tool_keyword = /\.lists\.123456\./ nocase ascii wide
$string169_cobaltstrike_offensive_tool_keyword = /\.live\.123456\./ nocase ascii wide
$string170_cobaltstrike_offensive_tool_keyword = /\.m\.123456\./ nocase ascii wide
$string171_cobaltstrike_offensive_tool_keyword = /\.mail\.123456\./ nocase ascii wide
$string172_cobaltstrike_offensive_tool_keyword = /\.media\.123456\./ nocase ascii wide
$string173_cobaltstrike_offensive_tool_keyword = /\.mobile\.123456\./ nocase ascii wide
$string174_cobaltstrike_offensive_tool_keyword = /\.mysql\.123456\./ nocase ascii wide
$string175_cobaltstrike_offensive_tool_keyword = /\.news\.123456\./ nocase ascii wide
$string176_cobaltstrike_offensive_tool_keyword = /\.photos\.123456\./ nocase ascii wide
$string177_cobaltstrike_offensive_tool_keyword = /\.pic\.123456\./ nocase ascii wide
$string178_cobaltstrike_offensive_tool_keyword = /\.pipename_stager/ nocase ascii wide
$string179_cobaltstrike_offensive_tool_keyword = /\.pop\.123456\./ nocase ascii wide
$string180_cobaltstrike_offensive_tool_keyword = /\.py\s.{0,100}\s\-\-teamserver\s/ nocase ascii wide
$string181_cobaltstrike_offensive_tool_keyword = /\.py\s127\.0\.0\.1\s50050\slogtracker\spassword/ nocase ascii wide
$string182_cobaltstrike_offensive_tool_keyword = /\.py.{0,100}\s\-\-payload\s.{0,100}\.ps1/ nocase ascii wide
$string183_cobaltstrike_offensive_tool_keyword = /\.py.{0,100}\s\-service\-name\s.{0,100}\s\-hashes\s/ nocase ascii wide
$string184_cobaltstrike_offensive_tool_keyword = /\.resources\.123456\./ nocase ascii wide
$string185_cobaltstrike_offensive_tool_keyword = /\.search\.123456\./ nocase ascii wide
$string186_cobaltstrike_offensive_tool_keyword = /\.secure\.123456\./ nocase ascii wide
$string187_cobaltstrike_offensive_tool_keyword = /\.sharpgen\s/ nocase ascii wide
$string188_cobaltstrike_offensive_tool_keyword = /\.sites\.123456\./ nocase ascii wide
$string189_cobaltstrike_offensive_tool_keyword = /\.smtp\.123456\./ nocase ascii wide
$string190_cobaltstrike_offensive_tool_keyword = /\.ssl\.123456\./ nocase ascii wide
$string191_cobaltstrike_offensive_tool_keyword = /\.stage\.123456\./ nocase ascii wide
$string192_cobaltstrike_offensive_tool_keyword = /\.stage\.123456\./ nocase ascii wide
$string193_cobaltstrike_offensive_tool_keyword = /\.static\.123456\./ nocase ascii wide
$string194_cobaltstrike_offensive_tool_keyword = /\.status\.123456\./ nocase ascii wide
$string195_cobaltstrike_offensive_tool_keyword = /\.store\.123456\./ nocase ascii wide
$string196_cobaltstrike_offensive_tool_keyword = /\.support\.123456\./ nocase ascii wide
$string197_cobaltstrike_offensive_tool_keyword = /\.videos\.123456\./ nocase ascii wide
$string198_cobaltstrike_offensive_tool_keyword = /\.vpn\.123456\./ nocase ascii wide
$string199_cobaltstrike_offensive_tool_keyword = /\.webmail\.123456\./ nocase ascii wide
$string200_cobaltstrike_offensive_tool_keyword = /\.wiki\.123456\./ nocase ascii wide
$string201_cobaltstrike_offensive_tool_keyword = /\/\.aggressor\.prop/ nocase ascii wide
$string202_cobaltstrike_offensive_tool_keyword = /\/\.ssh\/RAI\.pub/ nocase ascii wide
$string203_cobaltstrike_offensive_tool_keyword = "//StaticSyscallsDump/" nocase ascii wide
$string204_cobaltstrike_offensive_tool_keyword = "/78dc91f1A716DBBAA9E4E12C884C1CB1C27FFF2BEEED7DF1" nocase ascii wide
$string205_cobaltstrike_offensive_tool_keyword = "/78dc91f1A716DBBAA9E4E12C884C1CB1C27FFF2BEEED7DF1" nocase ascii wide
$string206_cobaltstrike_offensive_tool_keyword = /\/AceLdr\.cna/ nocase ascii wide
$string207_cobaltstrike_offensive_tool_keyword = "/adcs_enum/" nocase ascii wide
$string208_cobaltstrike_offensive_tool_keyword = /\/adcs_request\/adcs_request\./ nocase ascii wide
$string209_cobaltstrike_offensive_tool_keyword = /\/adcs_request\/CertCli\./ nocase ascii wide
$string210_cobaltstrike_offensive_tool_keyword = /\/adcs_request\/certenroll\./ nocase ascii wide
$string211_cobaltstrike_offensive_tool_keyword = /\/adcs_request\/CertPol\./ nocase ascii wide
$string212_cobaltstrike_offensive_tool_keyword = /\/AddUser\-Bof\./ nocase ascii wide
$string213_cobaltstrike_offensive_tool_keyword = "/AddUser-Bof/" nocase ascii wide
$string214_cobaltstrike_offensive_tool_keyword = /\/AggressiveClean\.cna/ nocase ascii wide
$string215_cobaltstrike_offensive_tool_keyword = /\/aggressor\/.{0,100}\.java/ nocase ascii wide
$string216_cobaltstrike_offensive_tool_keyword = "/aggressor-powerview" nocase ascii wide
$string217_cobaltstrike_offensive_tool_keyword = "/AggressorScripts" nocase ascii wide
$string218_cobaltstrike_offensive_tool_keyword = "/AggressorScripts" nocase ascii wide
$string219_cobaltstrike_offensive_tool_keyword = "/AggressorScripts" nocase ascii wide
$string220_cobaltstrike_offensive_tool_keyword = "/agscript "
$string221_cobaltstrike_offensive_tool_keyword = "/agscript " nocase ascii wide
$string222_cobaltstrike_offensive_tool_keyword = /\/Alaris\.sln/ nocase ascii wide
$string223_cobaltstrike_offensive_tool_keyword = /\/ANGRYPUPPY\.cna/ nocase ascii wide
$string224_cobaltstrike_offensive_tool_keyword = "/anthemtotheego/CredBandit" nocase ascii wide
$string225_cobaltstrike_offensive_tool_keyword = /\/artifactor\.py/ nocase ascii wide
$string226_cobaltstrike_offensive_tool_keyword = "/ase_docker/" nocase ascii wide
$string227_cobaltstrike_offensive_tool_keyword = /\/asprox\.profile/ nocase ascii wide
$string228_cobaltstrike_offensive_tool_keyword = /\/asprox\.profile/ nocase ascii wide
$string229_cobaltstrike_offensive_tool_keyword = /\/ASRenum\.cpp/ nocase ascii wide
$string230_cobaltstrike_offensive_tool_keyword = /\/ASRenum\.cs/ nocase ascii wide
$string231_cobaltstrike_offensive_tool_keyword = "/ASRenum-BOF" nocase ascii wide
$string232_cobaltstrike_offensive_tool_keyword = /\/assets\/bin2uuids_file\.py/ nocase ascii wide
$string233_cobaltstrike_offensive_tool_keyword = "/AttackServers/" nocase ascii wide
$string234_cobaltstrike_offensive_tool_keyword = /\/auth\/cc2_auth\./ nocase ascii wide
$string235_cobaltstrike_offensive_tool_keyword = "/awesome-pentest" nocase ascii wide
$string236_cobaltstrike_offensive_tool_keyword = /\/backoff\.profile/ nocase ascii wide
$string237_cobaltstrike_offensive_tool_keyword = "/backstab_src/" nocase ascii wide
$string238_cobaltstrike_offensive_tool_keyword = "/BackupPrivSam/" nocase ascii wide
$string239_cobaltstrike_offensive_tool_keyword = /\/bazarloader\.profile/ nocase ascii wide
$string240_cobaltstrike_offensive_tool_keyword = "/beacon_compatibility" nocase ascii wide
$string241_cobaltstrike_offensive_tool_keyword = /\/beacon_compatibility\./ nocase ascii wide
$string242_cobaltstrike_offensive_tool_keyword = "/beacon_funcs/" nocase ascii wide
$string243_cobaltstrike_offensive_tool_keyword = "/beacon_health_check/" nocase ascii wide
$string244_cobaltstrike_offensive_tool_keyword = "/beacon_http/" nocase ascii wide
$string245_cobaltstrike_offensive_tool_keyword = /\/beacon_notify\.cna/ nocase ascii wide
$string246_cobaltstrike_offensive_tool_keyword = /\/beaconhealth\.cna/ nocase ascii wide
$string247_cobaltstrike_offensive_tool_keyword = "/beacon-injection/" nocase ascii wide
$string248_cobaltstrike_offensive_tool_keyword = "/beacon-object-file" nocase ascii wide
$string249_cobaltstrike_offensive_tool_keyword = /\/BeaconTool\.java/ nocase ascii wide
$string250_cobaltstrike_offensive_tool_keyword = "/bin/AceLdr"
$string251_cobaltstrike_offensive_tool_keyword = /\/bin\/Sleeper\.o/
$string252_cobaltstrike_offensive_tool_keyword = "/bluscreenofjeff/" nocase ascii wide
$string253_cobaltstrike_offensive_tool_keyword = /\/bof\.h/ nocase ascii wide
$string254_cobaltstrike_offensive_tool_keyword = /\/BOF\.NET\// nocase ascii wide
$string255_cobaltstrike_offensive_tool_keyword = /\/bof\.nim/ nocase ascii wide
$string256_cobaltstrike_offensive_tool_keyword = /\/bof\.x64\.o/ nocase ascii wide
$string257_cobaltstrike_offensive_tool_keyword = /\/bof\.x64\.o/ nocase ascii wide
$string258_cobaltstrike_offensive_tool_keyword = /\/bof\.x86\.o/ nocase ascii wide
$string259_cobaltstrike_offensive_tool_keyword = /\/bof\.x86\.o/ nocase ascii wide
$string260_cobaltstrike_offensive_tool_keyword = /\/bof\/bof\.c/ nocase ascii wide
$string261_cobaltstrike_offensive_tool_keyword = /\/bof\/bof\.vcxproj/ nocase ascii wide
$string262_cobaltstrike_offensive_tool_keyword = "/bof/IABOF" nocase ascii wide
$string263_cobaltstrike_offensive_tool_keyword = /\/bof\/IAStart\.asm/ nocase ascii wide
$string264_cobaltstrike_offensive_tool_keyword = "/BOF-Builder" nocase ascii wide
$string265_cobaltstrike_offensive_tool_keyword = "/bof-collection/" nocase ascii wide
$string266_cobaltstrike_offensive_tool_keyword = "/BOFNETExamples/" nocase ascii wide
$string267_cobaltstrike_offensive_tool_keyword = "/BOF-RegSave" nocase ascii wide
$string268_cobaltstrike_offensive_tool_keyword = /\/BofRunner\.cs/ nocase ascii wide
$string269_cobaltstrike_offensive_tool_keyword = /\/BOFs\.git/ nocase ascii wide
$string270_cobaltstrike_offensive_tool_keyword = "/bof-vs-template/" nocase ascii wide
$string271_cobaltstrike_offensive_tool_keyword = "/bof-vs-template/" nocase ascii wide
$string272_cobaltstrike_offensive_tool_keyword = "/boku7/spawn" nocase ascii wide
$string273_cobaltstrike_offensive_tool_keyword = "/boku7/whereami/" nocase ascii wide
$string274_cobaltstrike_offensive_tool_keyword = /\/BokuLoader\.c/ nocase ascii wide
$string275_cobaltstrike_offensive_tool_keyword = /\/BokuLoader\.h/ nocase ascii wide
$string276_cobaltstrike_offensive_tool_keyword = "/BokuLoader/" nocase ascii wide
$string277_cobaltstrike_offensive_tool_keyword = /\/BooExecutor\.cs/ nocase ascii wide
$string278_cobaltstrike_offensive_tool_keyword = "/bq1iFEP2/assert/dll/" nocase ascii wide
$string279_cobaltstrike_offensive_tool_keyword = "/bq1iFEP2/assert/exe/" nocase ascii wide
$string280_cobaltstrike_offensive_tool_keyword = /\/breg\.x64\.o/ nocase ascii wide
$string281_cobaltstrike_offensive_tool_keyword = /\/breg\.x86\.o/ nocase ascii wide
$string282_cobaltstrike_offensive_tool_keyword = "/build/encrypted_shellcode" nocase ascii wide
$string283_cobaltstrike_offensive_tool_keyword = "/build/formatted_shellcode" nocase ascii wide
$string284_cobaltstrike_offensive_tool_keyword = "/build/shellcode" nocase ascii wide
$string285_cobaltstrike_offensive_tool_keyword = "/BuildBOFs/" nocase ascii wide
$string286_cobaltstrike_offensive_tool_keyword = /\/burpee\.py/ nocase ascii wide
$string287_cobaltstrike_offensive_tool_keyword = "/BUYTHEAPTDETECTORNOW" nocase ascii wide
$string288_cobaltstrike_offensive_tool_keyword = "/BypassAV/" nocase ascii wide
$string289_cobaltstrike_offensive_tool_keyword = "/bypassAV-1/" nocase ascii wide
$string290_cobaltstrike_offensive_tool_keyword = "/C2concealer" nocase ascii wide
$string291_cobaltstrike_offensive_tool_keyword = /\/c2profile\./ nocase ascii wide
$string292_cobaltstrike_offensive_tool_keyword = /\/c2profile\.go/ nocase ascii wide
$string293_cobaltstrike_offensive_tool_keyword = "/C2script/" nocase ascii wide
$string294_cobaltstrike_offensive_tool_keyword = /\/cc2_frp\./ nocase ascii wide
$string295_cobaltstrike_offensive_tool_keyword = /\/client\/bof\/.{0,100}\.asm/ nocase ascii wide
$string296_cobaltstrike_offensive_tool_keyword = /\/clipboardinject\./ nocase ascii wide
$string297_cobaltstrike_offensive_tool_keyword = "/clipboardinject/" nocase ascii wide
$string298_cobaltstrike_offensive_tool_keyword = /\/clipmon\/clipmon\.sln/ nocase ascii wide
$string299_cobaltstrike_offensive_tool_keyword = "/clipmon/dll/" nocase ascii wide
$string300_cobaltstrike_offensive_tool_keyword = /\/cna\/pipetest\.cna/ nocase ascii wide
$string301_cobaltstrike_offensive_tool_keyword = /\/cobaltclip\.c/ nocase ascii wide
$string302_cobaltstrike_offensive_tool_keyword = /\/cobaltclip\.o/ nocase ascii wide
$string303_cobaltstrike_offensive_tool_keyword = "/Cobalt-Clip/" nocase ascii wide
$string304_cobaltstrike_offensive_tool_keyword = "/cobaltstrike" nocase ascii wide
$string305_cobaltstrike_offensive_tool_keyword = "/cobalt-strike" nocase ascii wide
$string306_cobaltstrike_offensive_tool_keyword = /\/CobaltStrike_OpenBeacon\.git/ nocase ascii wide
$string307_cobaltstrike_offensive_tool_keyword = /\/CoffeeLdr\.c/ nocase ascii wide
$string308_cobaltstrike_offensive_tool_keyword = "/CoffeeLdr/" nocase ascii wide
$string309_cobaltstrike_offensive_tool_keyword = "/COFFLoader" nocase ascii wide
$string310_cobaltstrike_offensive_tool_keyword = "/COFFLoader2/" nocase ascii wide
$string311_cobaltstrike_offensive_tool_keyword = "/com/blackh4t/" nocase ascii wide
$string312_cobaltstrike_offensive_tool_keyword = /\/comfoo\.profile/ nocase ascii wide
$string313_cobaltstrike_offensive_tool_keyword = /\/CookieProcessor\.cs/ nocase ascii wide
$string314_cobaltstrike_offensive_tool_keyword = /\/core\/browser_darwin\.go/
$string315_cobaltstrike_offensive_tool_keyword = /\/core\/browser_linux\.go/
$string316_cobaltstrike_offensive_tool_keyword = /\/core\/browser_windows\.go/ nocase ascii wide
$string317_cobaltstrike_offensive_tool_keyword = "/Cracked5pider/" nocase ascii wide
$string318_cobaltstrike_offensive_tool_keyword = "/credBandit/" nocase ascii wide
$string319_cobaltstrike_offensive_tool_keyword = /\/CredEnum\.c/ nocase ascii wide
$string320_cobaltstrike_offensive_tool_keyword = /\/CredEnum\.cna/ nocase ascii wide
$string321_cobaltstrike_offensive_tool_keyword = /\/CredEnum\.h/ nocase ascii wide
$string322_cobaltstrike_offensive_tool_keyword = /\/CredPrompt\.exe/ nocase ascii wide
$string323_cobaltstrike_offensive_tool_keyword = /\/CredPrompt\/credprompt\.c/ nocase ascii wide
$string324_cobaltstrike_offensive_tool_keyword = /\/CrossC2\./ nocase ascii wide
$string325_cobaltstrike_offensive_tool_keyword = "/CrossC2/" nocase ascii wide
$string326_cobaltstrike_offensive_tool_keyword = "/CrossC2Kit" nocase ascii wide
$string327_cobaltstrike_offensive_tool_keyword = "/CrossC2Kit/" nocase ascii wide
$string328_cobaltstrike_offensive_tool_keyword = "/CrossNet-Beta/" nocase ascii wide
$string329_cobaltstrike_offensive_tool_keyword = "/crypt0p3g/" nocase ascii wide
$string330_cobaltstrike_offensive_tool_keyword = "/cs2modrewrite/" nocase ascii wide
$string331_cobaltstrike_offensive_tool_keyword = "/CS-BOFs/" nocase ascii wide
$string332_cobaltstrike_offensive_tool_keyword = "/CSharpWinRM" nocase ascii wide
$string333_cobaltstrike_offensive_tool_keyword = "/C--Shellcode" nocase ascii wide
$string334_cobaltstrike_offensive_tool_keyword = /\/CS\-Loader\.go/ nocase ascii wide
$string335_cobaltstrike_offensive_tool_keyword = "/CS-Loader/" nocase ascii wide
$string336_cobaltstrike_offensive_tool_keyword = "/csOnvps/" nocase ascii wide
$string337_cobaltstrike_offensive_tool_keyword = "/csOnvps/" nocase ascii wide
$string338_cobaltstrike_offensive_tool_keyword = "/cs-rdll-ipc-example/" nocase ascii wide
$string339_cobaltstrike_offensive_tool_keyword = "/CS-Remote-OPs-BOF" nocase ascii wide
$string340_cobaltstrike_offensive_tool_keyword = "/cs-token-vault/" nocase ascii wide
$string341_cobaltstrike_offensive_tool_keyword = /\/curl\.cna/ nocase ascii wide
$string342_cobaltstrike_offensive_tool_keyword = /\/curl\.x64\.o/ nocase ascii wide
$string343_cobaltstrike_offensive_tool_keyword = /\/curl\.x86\.o/ nocase ascii wide
$string344_cobaltstrike_offensive_tool_keyword = "/custom_payload_generator/" nocase ascii wide
$string345_cobaltstrike_offensive_tool_keyword = "/CWoNaJLBo/VTNeWw11212/" nocase ascii wide
$string346_cobaltstrike_offensive_tool_keyword = "/CWoNaJLBo/VTNeWw11213/" nocase ascii wide
$string347_cobaltstrike_offensive_tool_keyword = "/DCOM Lateral Movement/" nocase ascii wide
$string348_cobaltstrike_offensive_tool_keyword = /\/defender\-exclusions\/.{0,100}defender/ nocase ascii wide
$string349_cobaltstrike_offensive_tool_keyword = /\/defender\-exclusions\/.{0,100}exclusion/ nocase ascii wide
$string350_cobaltstrike_offensive_tool_keyword = "/DelegationBOF/" nocase ascii wide
$string351_cobaltstrike_offensive_tool_keyword = /\/demo_bof\.c/ nocase ascii wide
$string352_cobaltstrike_offensive_tool_keyword = /\/Dent\/.{0,100}\/Loader\/Loader\.go/ nocase ascii wide
$string353_cobaltstrike_offensive_tool_keyword = /\/Dent\/Dent\.go/ nocase ascii wide
$string354_cobaltstrike_offensive_tool_keyword = "/Dent/Loader" nocase ascii wide
$string355_cobaltstrike_offensive_tool_keyword = /\/DesertFox\/archive\/.{0,100}\.zip/ nocase ascii wide
$string356_cobaltstrike_offensive_tool_keyword = /\/detect\-hooks\.c/ nocase ascii wide
$string357_cobaltstrike_offensive_tool_keyword = /\/detect\-hooks\.cna/ nocase ascii wide
$string358_cobaltstrike_offensive_tool_keyword = /\/detect\-hooks\.h/ nocase ascii wide
$string359_cobaltstrike_offensive_tool_keyword = "/Detect-Hooks/" nocase ascii wide
$string360_cobaltstrike_offensive_tool_keyword = /\/dist\/fw_walk\./ nocase ascii wide
$string361_cobaltstrike_offensive_tool_keyword = "/DLL-Hijack" nocase ascii wide
$string362_cobaltstrike_offensive_tool_keyword = "/Doge-Loader/" nocase ascii wide
$string363_cobaltstrike_offensive_tool_keyword = "/DotNet/SigFlip" nocase ascii wide
$string364_cobaltstrike_offensive_tool_keyword = /\/dukes_apt29\.profile/ nocase ascii wide
$string365_cobaltstrike_offensive_tool_keyword = /\/dump_lsass\./ nocase ascii wide
$string366_cobaltstrike_offensive_tool_keyword = /\/dumpert\.c/ nocase ascii wide
$string367_cobaltstrike_offensive_tool_keyword = "/Dumpert/" nocase ascii wide
$string368_cobaltstrike_offensive_tool_keyword = /\/dumpXor\.exe/ nocase ascii wide
$string369_cobaltstrike_offensive_tool_keyword = "/dumpXor/dumpXor" nocase ascii wide
$string370_cobaltstrike_offensive_tool_keyword = /\/ElevateKit\/elevate\./ nocase ascii wide
$string371_cobaltstrike_offensive_tool_keyword = "/ELFLoader/" nocase ascii wide
$string372_cobaltstrike_offensive_tool_keyword = /\/emotet\.profile/ nocase ascii wide
$string373_cobaltstrike_offensive_tool_keyword = /\/enableuser\/enableuser\.x64\./ nocase ascii wide
$string374_cobaltstrike_offensive_tool_keyword = /\/enableuser\/enableuser\.x86\./ nocase ascii wide
$string375_cobaltstrike_offensive_tool_keyword = /\/EnumCLR\.c/ nocase ascii wide
$string376_cobaltstrike_offensive_tool_keyword = /\/enumerate\.cna/ nocase ascii wide
$string377_cobaltstrike_offensive_tool_keyword = /\/Erebus\/.{0,100}\.dll/ nocase ascii wide
$string378_cobaltstrike_offensive_tool_keyword = /\/Erebus\/.{0,100}\.exe/ nocase ascii wide
$string379_cobaltstrike_offensive_tool_keyword = /\/Erebus\-email\./ nocase ascii wide
$string380_cobaltstrike_offensive_tool_keyword = /\/etumbot\.profile/ nocase ascii wide
$string381_cobaltstrike_offensive_tool_keyword = /\/etw\.cna/ nocase ascii wide
$string382_cobaltstrike_offensive_tool_keyword = /\/etw\.x64\./ nocase ascii wide
$string383_cobaltstrike_offensive_tool_keyword = /\/etw\.x86\./ nocase ascii wide
$string384_cobaltstrike_offensive_tool_keyword = "/EventViewerUAC/" nocase ascii wide
$string385_cobaltstrike_offensive_tool_keyword = "/EventViewerUAC/" nocase ascii wide
$string386_cobaltstrike_offensive_tool_keyword = /\/evil\.cpp/ nocase ascii wide
$string387_cobaltstrike_offensive_tool_keyword = /\/exports_function_hid\.txt/ nocase ascii wide
$string388_cobaltstrike_offensive_tool_keyword = /\/fiesta\.profile/ nocase ascii wide
$string389_cobaltstrike_offensive_tool_keyword = /\/fiesta2\.profile/ nocase ascii wide
$string390_cobaltstrike_offensive_tool_keyword = /\/final_shellcode_size\.txt/ nocase ascii wide
$string391_cobaltstrike_offensive_tool_keyword = /\/FindModule\.c/ nocase ascii wide
$string392_cobaltstrike_offensive_tool_keyword = /\/FindObjects\.cna/ nocase ascii wide
$string393_cobaltstrike_offensive_tool_keyword = "/Fodetect-hooksx64" nocase ascii wide
$string394_cobaltstrike_offensive_tool_keyword = "/FuckThatPacker" nocase ascii wide
$string395_cobaltstrike_offensive_tool_keyword = "/G0ldenGunSec/" nocase ascii wide
$string396_cobaltstrike_offensive_tool_keyword = /\/gandcrab\.profile/ nocase ascii wide
$string397_cobaltstrike_offensive_tool_keyword = /\/geacon\.git/ nocase ascii wide
$string398_cobaltstrike_offensive_tool_keyword = /\/geacon\/.{0,100}beacon/ nocase ascii wide
$string399_cobaltstrike_offensive_tool_keyword = "/geacon_pro" nocase ascii wide
$string400_cobaltstrike_offensive_tool_keyword = /\/get\-loggedon\/.{0,100}\.c/ nocase ascii wide
$string401_cobaltstrike_offensive_tool_keyword = /\/get\-system\/getsystem\.c/ nocase ascii wide
$string402_cobaltstrike_offensive_tool_keyword = "/GetWebDAVStatus_BOF/" nocase ascii wide
$string403_cobaltstrike_offensive_tool_keyword = /\/globeimposter\.profile/ nocase ascii wide
$string404_cobaltstrike_offensive_tool_keyword = "/guervild/BOFs" nocase ascii wide
$string405_cobaltstrike_offensive_tool_keyword = /\/hancitor\.profile/ nocase ascii wide
$string406_cobaltstrike_offensive_tool_keyword = "/HandleKatz_BOF" nocase ascii wide
$string407_cobaltstrike_offensive_tool_keyword = /\/HaryyUser\.exe/ nocase ascii wide
$string408_cobaltstrike_offensive_tool_keyword = /\/havex\.profile/ nocase ascii wide
$string409_cobaltstrike_offensive_tool_keyword = /\/HiddenDesktop\.git/ nocase ascii wide
$string410_cobaltstrike_offensive_tool_keyword = /\/hollow\.x64\./ nocase ascii wide
$string411_cobaltstrike_offensive_tool_keyword = /\/hooks\/spoof\.c/ nocase ascii wide
$string412_cobaltstrike_offensive_tool_keyword = /\/hostenum\.py/ nocase ascii wide
$string413_cobaltstrike_offensive_tool_keyword = /\/HouQing\/.{0,100}\/Loader\.go/ nocase ascii wide
$string414_cobaltstrike_offensive_tool_keyword = "/injectAmsiBypass/" nocase ascii wide
$string415_cobaltstrike_offensive_tool_keyword = "/inject-assembly/" nocase ascii wide
$string416_cobaltstrike_offensive_tool_keyword = /\/injectEtw\./ nocase ascii wide
$string417_cobaltstrike_offensive_tool_keyword = "/Injection/clipboard/" nocase ascii wide
$string418_cobaltstrike_offensive_tool_keyword = "/Injection/conhost/" nocase ascii wide
$string419_cobaltstrike_offensive_tool_keyword = "/Injection/createremotethread/" nocase ascii wide
$string420_cobaltstrike_offensive_tool_keyword = "/Injection/ctray/" nocase ascii wide
$string421_cobaltstrike_offensive_tool_keyword = "/Injection/dde/" nocase ascii wide
$string422_cobaltstrike_offensive_tool_keyword = /\/Injection\/Injection\.cna/ nocase ascii wide
$string423_cobaltstrike_offensive_tool_keyword = "/Injection/kernelcallbacktable" nocase ascii wide
$string424_cobaltstrike_offensive_tool_keyword = "/Injection/ntcreatethread" nocase ascii wide
$string425_cobaltstrike_offensive_tool_keyword = "/Injection/ntcreatethread/" nocase ascii wide
$string426_cobaltstrike_offensive_tool_keyword = "/Injection/ntqueueapcthread" nocase ascii wide
$string427_cobaltstrike_offensive_tool_keyword = "/Injection/setthreadcontext" nocase ascii wide
$string428_cobaltstrike_offensive_tool_keyword = "/Injection/svcctrl/" nocase ascii wide
$string429_cobaltstrike_offensive_tool_keyword = "/Injection/tooltip/" nocase ascii wide
$string430_cobaltstrike_offensive_tool_keyword = "/Injection/uxsubclassinfo" nocase ascii wide
$string431_cobaltstrike_offensive_tool_keyword = "/InlineWhispers" nocase ascii wide
$string432_cobaltstrike_offensive_tool_keyword = /\/Internals\/Coff\.cs/ nocase ascii wide
$string433_cobaltstrike_offensive_tool_keyword = /\/Inveigh\.txt/ nocase ascii wide
$string434_cobaltstrike_offensive_tool_keyword = "/Invoke-Bof/" nocase ascii wide
$string435_cobaltstrike_offensive_tool_keyword = /\/Invoke\-HostEnum\.ps1/ nocase ascii wide
$string436_cobaltstrike_offensive_tool_keyword = /\/jaff\.profile/ nocase ascii wide
$string437_cobaltstrike_offensive_tool_keyword = /\/jasperloader\.profile/ nocase ascii wide
$string438_cobaltstrike_offensive_tool_keyword = /\/K8_CS_.{0,100}_.{0,100}\.rar/ nocase ascii wide
$string439_cobaltstrike_offensive_tool_keyword = "/k8gege/" nocase ascii wide
$string440_cobaltstrike_offensive_tool_keyword = "/k8gege/scrun/" nocase ascii wide
$string441_cobaltstrike_offensive_tool_keyword = "/k8gege520" nocase ascii wide
$string442_cobaltstrike_offensive_tool_keyword = /\/kdstab\./ nocase ascii wide
$string443_cobaltstrike_offensive_tool_keyword = /\/KDStab\./ nocase ascii wide
$string444_cobaltstrike_offensive_tool_keyword = "/KDStab/" nocase ascii wide
$string445_cobaltstrike_offensive_tool_keyword = /\/Kerbeus\-BOF\.git/ nocase ascii wide
$string446_cobaltstrike_offensive_tool_keyword = "/Kerbeus-BOF/"
$string447_cobaltstrike_offensive_tool_keyword = /\/KernelMii\.c/ nocase ascii wide
$string448_cobaltstrike_offensive_tool_keyword = /\/kronos\.profile/ nocase ascii wide
$string449_cobaltstrike_offensive_tool_keyword = /\/Ladon\.go/ nocase ascii wide
$string450_cobaltstrike_offensive_tool_keyword = /\/Ladon\.ps1/ nocase ascii wide
$string451_cobaltstrike_offensive_tool_keyword = /\/Ladon\.py/ nocase ascii wide
$string452_cobaltstrike_offensive_tool_keyword = /\/Ladon\/Ladon\./ nocase ascii wide
$string453_cobaltstrike_offensive_tool_keyword = "/Ladon/obj/x86" nocase ascii wide
$string454_cobaltstrike_offensive_tool_keyword = "/LadonGo/" nocase ascii wide
$string455_cobaltstrike_offensive_tool_keyword = "/LetMeOutSharp/" nocase ascii wide
$string456_cobaltstrike_offensive_tool_keyword = /\/lib\/ipLookupHelper\.py/ nocase ascii wide
$string457_cobaltstrike_offensive_tool_keyword = /\/loader\/x64\/Release\/loader\.exe/ nocase ascii wide
$string458_cobaltstrike_offensive_tool_keyword = /\/loadercrypt_.{0,100}\.php/ nocase ascii wide
$string459_cobaltstrike_offensive_tool_keyword = /\/logs\/.{0,100}\/becon_.{0,100}\.log/
$string460_cobaltstrike_offensive_tool_keyword = "/logs/beacon_log" nocase ascii wide
$string461_cobaltstrike_offensive_tool_keyword = "/lpBunny/bof-registry" nocase ascii wide
$string462_cobaltstrike_offensive_tool_keyword = /\/lsass\/beacon\.h/ nocase ascii wide
$string463_cobaltstrike_offensive_tool_keyword = /\/magnitude\.profile/ nocase ascii wide
$string464_cobaltstrike_offensive_tool_keyword = "/malleable-c2" nocase ascii wide
$string465_cobaltstrike_offensive_tool_keyword = "/manjusaka/plugins" nocase ascii wide
$string466_cobaltstrike_offensive_tool_keyword = "/MemReader_BoF/" nocase ascii wide
$string467_cobaltstrike_offensive_tool_keyword = /\/mimipenguin\.c/ nocase ascii wide
$string468_cobaltstrike_offensive_tool_keyword = "/mimipenguin/" nocase ascii wide
$string469_cobaltstrike_offensive_tool_keyword = /\/minimal_elf\.h/ nocase ascii wide
$string470_cobaltstrike_offensive_tool_keyword = /\/Misc\/donut\.exe/ nocase ascii wide
$string471_cobaltstrike_offensive_tool_keyword = /\/Mockingjay_BOF\.git/ nocase ascii wide
$string472_cobaltstrike_offensive_tool_keyword = /\/Modules\/Exitservice\/uinit\.exe/ nocase ascii wide
$string473_cobaltstrike_offensive_tool_keyword = "/Mr-Un1k0d3r/" nocase ascii wide
$string474_cobaltstrike_offensive_tool_keyword = "/Native/SigFlip/" nocase ascii wide
$string475_cobaltstrike_offensive_tool_keyword = "/nccgroup/nccfsas/" nocase ascii wide
$string476_cobaltstrike_offensive_tool_keyword = "/Needle_Sift_BOF/" nocase ascii wide
$string477_cobaltstrike_offensive_tool_keyword = "/nettitude/RunOF/" nocase ascii wide
$string478_cobaltstrike_offensive_tool_keyword = /\/NetUser\.cpp/ nocase ascii wide
$string479_cobaltstrike_offensive_tool_keyword = /\/NetUser\.exe/ nocase ascii wide
$string480_cobaltstrike_offensive_tool_keyword = "/netuserenum/" nocase ascii wide
$string481_cobaltstrike_offensive_tool_keyword = "/Network/PortScan/" nocase ascii wide
$string482_cobaltstrike_offensive_tool_keyword = /\/No\-Consolation\.git/ nocase ascii wide
$string483_cobaltstrike_offensive_tool_keyword = "/ntlmrelayx/" nocase ascii wide
$string484_cobaltstrike_offensive_tool_keyword = /\/oab\-parse\/mspack\..{0,100}\.dll/ nocase ascii wide
$string485_cobaltstrike_offensive_tool_keyword = "/OG-Sadpanda/" nocase ascii wide
$string486_cobaltstrike_offensive_tool_keyword = "/On_Demand_C2/" nocase ascii wide
$string487_cobaltstrike_offensive_tool_keyword = "/opt/implant/" nocase ascii wide
$string488_cobaltstrike_offensive_tool_keyword = "/opt/rai/" nocase ascii wide
$string489_cobaltstrike_offensive_tool_keyword = "/optiv/Dent/" nocase ascii wide
$string490_cobaltstrike_offensive_tool_keyword = /\/oscp\.profile/ nocase ascii wide
$string491_cobaltstrike_offensive_tool_keyword = "/outflanknl/" nocase ascii wide
$string492_cobaltstrike_offensive_tool_keyword = "/output/payloads/" nocase ascii wide
$string493_cobaltstrike_offensive_tool_keyword = "/p292/Phant0m" nocase ascii wide
$string494_cobaltstrike_offensive_tool_keyword = /\/package\/portscan\/.{0,100}\.go/ nocase ascii wide
$string495_cobaltstrike_offensive_tool_keyword = "/password/mimipenguin/" nocase ascii wide
$string496_cobaltstrike_offensive_tool_keyword = "/payload_scripts" nocase ascii wide
$string497_cobaltstrike_offensive_tool_keyword = "/payload_scripts/artifact" nocase ascii wide
$string498_cobaltstrike_offensive_tool_keyword = "/PersistBOF/" nocase ascii wide
$string499_cobaltstrike_offensive_tool_keyword = "/PhishingServer/" nocase ascii wide
$string500_cobaltstrike_offensive_tool_keyword = /\/pitty_tiger\.profile/ nocase ascii wide
$string501_cobaltstrike_offensive_tool_keyword = /\/PoolPartyBof\.c/ nocase ascii wide
$string502_cobaltstrike_offensive_tool_keyword = /\/PoolPartyBof\.git/ nocase ascii wide
$string503_cobaltstrike_offensive_tool_keyword = /\/PoolPartyBof\.x64\.o/ nocase ascii wide
$string504_cobaltstrike_offensive_tool_keyword = /\/popCalc\.bin/ nocase ascii wide
$string505_cobaltstrike_offensive_tool_keyword = "/PortBender/" nocase ascii wide
$string506_cobaltstrike_offensive_tool_keyword = /\/portscan\.cna/ nocase ascii wide
$string507_cobaltstrike_offensive_tool_keyword = /\/POSeidon\.profile/ nocase ascii wide
$string508_cobaltstrike_offensive_tool_keyword = /\/PowerView\.cna/ nocase ascii wide
$string509_cobaltstrike_offensive_tool_keyword = /\/PowerView3\.cna/ nocase ascii wide
$string510_cobaltstrike_offensive_tool_keyword = "/PPEnum/" nocase ascii wide
$string511_cobaltstrike_offensive_tool_keyword = /\/ppldump\./ nocase ascii wide
$string512_cobaltstrike_offensive_tool_keyword = "/PPLDump_BOF/" nocase ascii wide
$string513_cobaltstrike_offensive_tool_keyword = /\/PrintMonitorDll\./ nocase ascii wide
$string514_cobaltstrike_offensive_tool_keyword = "/PrintMonitorDll/" nocase ascii wide
$string515_cobaltstrike_offensive_tool_keyword = "/PrintSpoofer/" nocase ascii wide
$string516_cobaltstrike_offensive_tool_keyword = "/PrivilegeEscalation/" nocase ascii wide
$string517_cobaltstrike_offensive_tool_keyword = /\/proberbyte\.go/ nocase ascii wide
$string518_cobaltstrike_offensive_tool_keyword = /\/Proxy_Def_File_Generator\.cna/ nocase ascii wide
$string519_cobaltstrike_offensive_tool_keyword = /\/putter\.profile/ nocase ascii wide
$string520_cobaltstrike_offensive_tool_keyword = "/pyasn1/" nocase ascii wide
$string521_cobaltstrike_offensive_tool_keyword = "/pycobalt-" nocase ascii wide
$string522_cobaltstrike_offensive_tool_keyword = "/pycobalt/" nocase ascii wide
$string523_cobaltstrike_offensive_tool_keyword = /\/pystinger\.zip/ nocase ascii wide
$string524_cobaltstrike_offensive_tool_keyword = /\/qakbot\.profile/ nocase ascii wide
$string525_cobaltstrike_offensive_tool_keyword = /\/quantloader\.profile/ nocase ascii wide
$string526_cobaltstrike_offensive_tool_keyword = /\/RAI\.git/ nocase ascii wide
$string527_cobaltstrike_offensive_tool_keyword = /\/ramnit\.profile/ nocase ascii wide
$string528_cobaltstrike_offensive_tool_keyword = /\/ratankba\.profile/ nocase ascii wide
$string529_cobaltstrike_offensive_tool_keyword = /\/raw_shellcode_size\.txt/ nocase ascii wide
$string530_cobaltstrike_offensive_tool_keyword = /\/RC4Payload32\.txt/ nocase ascii wide
$string531_cobaltstrike_offensive_tool_keyword = "/RCStep/CSSG/" nocase ascii wide
$string532_cobaltstrike_offensive_tool_keyword = /\/readfile_bof\./ nocase ascii wide
$string533_cobaltstrike_offensive_tool_keyword = "/Readfile_BoF/" nocase ascii wide
$string534_cobaltstrike_offensive_tool_keyword = "/red-team-scripts" nocase ascii wide
$string535_cobaltstrike_offensive_tool_keyword = /\/RedWarden\.git/ nocase ascii wide
$string536_cobaltstrike_offensive_tool_keyword = /\/RegistryPersistence\.c/ nocase ascii wide
$string537_cobaltstrike_offensive_tool_keyword = "/Registry-Recon/" nocase ascii wide
$string538_cobaltstrike_offensive_tool_keyword = "/Remote/adcs_request/" nocase ascii wide
$string539_cobaltstrike_offensive_tool_keyword = "/Remote/office_tokens/" nocase ascii wide
$string540_cobaltstrike_offensive_tool_keyword = "/Remote/procdump/" nocase ascii wide
$string541_cobaltstrike_offensive_tool_keyword = "/Remote/ProcessDestroy/" nocase ascii wide
$string542_cobaltstrike_offensive_tool_keyword = "/Remote/ProcessListHandles/" nocase ascii wide
$string543_cobaltstrike_offensive_tool_keyword = "/Remote/schtaskscreate/" nocase ascii wide
$string544_cobaltstrike_offensive_tool_keyword = "/Remote/schtasksrun/" nocase ascii wide
$string545_cobaltstrike_offensive_tool_keyword = "/Remote/setuserpass/" nocase ascii wide
$string546_cobaltstrike_offensive_tool_keyword = "/Remote/setuserpass/" nocase ascii wide
$string547_cobaltstrike_offensive_tool_keyword = "/Remote/unexpireuser/" nocase ascii wide
$string548_cobaltstrike_offensive_tool_keyword = /\/remotereg\.c/ nocase ascii wide
$string549_cobaltstrike_offensive_tool_keyword = /\/remotereg\.o/ nocase ascii wide
$string550_cobaltstrike_offensive_tool_keyword = "/RunOF/RunOF/" nocase ascii wide
$string551_cobaltstrike_offensive_tool_keyword = /\/runshellcode\./ nocase ascii wide
$string552_cobaltstrike_offensive_tool_keyword = "/S3cur3Th1sSh1t/" nocase ascii wide
$string553_cobaltstrike_offensive_tool_keyword = /\/saefko\.profile/ nocase ascii wide
$string554_cobaltstrike_offensive_tool_keyword = "/ScareCrow -I "
$string555_cobaltstrike_offensive_tool_keyword = /\/ScRunHex\.py/ nocase ascii wide
$string556_cobaltstrike_offensive_tool_keyword = "/searchsploit" nocase ascii wide
$string557_cobaltstrike_offensive_tool_keyword = /\/Seatbelt\.txt/ nocase ascii wide
$string558_cobaltstrike_offensive_tool_keyword = /\/secinject\.c/ nocase ascii wide
$string559_cobaltstrike_offensive_tool_keyword = /\/self_delete\.cna/ nocase ascii wide
$string560_cobaltstrike_offensive_tool_keyword = /\/SeriousSam\.sln/ nocase ascii wide
$string561_cobaltstrike_offensive_tool_keyword = "/serverscan/CobaltStrike" nocase ascii wide
$string562_cobaltstrike_offensive_tool_keyword = "/serverscan_Air" nocase ascii wide
$string563_cobaltstrike_offensive_tool_keyword = "/serverscan_pro" nocase ascii wide
$string564_cobaltstrike_offensive_tool_keyword = "/ServerScanForLinux/"
$string565_cobaltstrike_offensive_tool_keyword = "/ServerScanForWindows/" nocase ascii wide
$string566_cobaltstrike_offensive_tool_keyword = "/ServerScanForWindows/PE" nocase ascii wide
$string567_cobaltstrike_offensive_tool_keyword = "/ServiceMove-BOF/" nocase ascii wide
$string568_cobaltstrike_offensive_tool_keyword = /\/Services\/TransitEXE\.exe/ nocase ascii wide
$string569_cobaltstrike_offensive_tool_keyword = /\/setuserpass\.x64\./ nocase ascii wide
$string570_cobaltstrike_offensive_tool_keyword = /\/setuserpass\.x86\./ nocase ascii wide
$string571_cobaltstrike_offensive_tool_keyword = /\/SharpCalendar\/.{0,100}\./ nocase ascii wide
$string572_cobaltstrike_offensive_tool_keyword = "/SharpCat/" nocase ascii wide
$string573_cobaltstrike_offensive_tool_keyword = "/SharpCompile/" nocase ascii wide
$string574_cobaltstrike_offensive_tool_keyword = /\/sharpcompile_.{0,100}\./ nocase ascii wide
$string575_cobaltstrike_offensive_tool_keyword = "/SharpCradle/" nocase ascii wide
$string576_cobaltstrike_offensive_tool_keyword = "/SharpSword/SharpSword" nocase ascii wide
$string577_cobaltstrike_offensive_tool_keyword = "/ShellCode_Loader" nocase ascii wide
$string578_cobaltstrike_offensive_tool_keyword = "/shspawnas/" nocase ascii wide
$string579_cobaltstrike_offensive_tool_keyword = /\/sigflip\.x64\./ nocase ascii wide
$string580_cobaltstrike_offensive_tool_keyword = /\/sigflip\.x86\./ nocase ascii wide
$string581_cobaltstrike_offensive_tool_keyword = /\/SigLoader\.go/ nocase ascii wide
$string582_cobaltstrike_offensive_tool_keyword = "/SigLoader/" nocase ascii wide
$string583_cobaltstrike_offensive_tool_keyword = /\/SilentClean\.exe/ nocase ascii wide
$string584_cobaltstrike_offensive_tool_keyword = /\/SilentClean\/SilentClean\/.{0,100}\.cs/ nocase ascii wide
$string585_cobaltstrike_offensive_tool_keyword = /\/silentdump\.c/ nocase ascii wide
$string586_cobaltstrike_offensive_tool_keyword = /\/silentdump\.h/ nocase ascii wide
$string587_cobaltstrike_offensive_tool_keyword = "/sleep_python_bridge/" nocase ascii wide
$string588_cobaltstrike_offensive_tool_keyword = /\/Sleeper\/Sleeper\.cna/ nocase ascii wide
$string589_cobaltstrike_offensive_tool_keyword = /\/sleepmask\.cna/ nocase ascii wide
$string590_cobaltstrike_offensive_tool_keyword = /\/spawn\.git/ nocase ascii wide
$string591_cobaltstrike_offensive_tool_keyword = "/spoolsystem/SpoolTrigger/" nocase ascii wide
$string592_cobaltstrike_offensive_tool_keyword = /\/Spray\-AD\./ nocase ascii wide
$string593_cobaltstrike_offensive_tool_keyword = "/Spray-AD/" nocase ascii wide
$string594_cobaltstrike_offensive_tool_keyword = /\/src\/Sleeper\.cpp/ nocase ascii wide
$string595_cobaltstrike_offensive_tool_keyword = "/StaticSyscallsAPCSpawn/" nocase ascii wide
$string596_cobaltstrike_offensive_tool_keyword = "/StaticSyscallsInject/" nocase ascii wide
$string597_cobaltstrike_offensive_tool_keyword = /\/StayKit\.cna/ nocase ascii wide
$string598_cobaltstrike_offensive_tool_keyword = /\/Staykit\/StayKit\./ nocase ascii wide
$string599_cobaltstrike_offensive_tool_keyword = /\/striker\.py/ nocase ascii wide
$string600_cobaltstrike_offensive_tool_keyword = /\/string_of_paerls\.profile/ nocase ascii wide
$string601_cobaltstrike_offensive_tool_keyword = /\/suspendresume\.x64/ nocase ascii wide
$string602_cobaltstrike_offensive_tool_keyword = /\/suspendresume\.x86/ nocase ascii wide
$string603_cobaltstrike_offensive_tool_keyword = "/SweetPotato_CS" nocase ascii wide
$string604_cobaltstrike_offensive_tool_keyword = "/SyscallsInject/" nocase ascii wide
$string605_cobaltstrike_offensive_tool_keyword = /\/taidoor\.profile/ nocase ascii wide
$string606_cobaltstrike_offensive_tool_keyword = /\/tcpshell\.py/ nocase ascii wide
$string607_cobaltstrike_offensive_tool_keyword = /\/teamserver\.service/
$string608_cobaltstrike_offensive_tool_keyword = /\/test32\.dll/ nocase ascii wide
$string609_cobaltstrike_offensive_tool_keyword = /\/test64\.dll/ nocase ascii wide
$string610_cobaltstrike_offensive_tool_keyword = /\/tests\/test\-bof\.ps1/ nocase ascii wide
$string611_cobaltstrike_offensive_tool_keyword = "/tevora-threat/PowerView" nocase ascii wide
$string612_cobaltstrike_offensive_tool_keyword = /\/tgtParse\.py/ nocase ascii wide
$string613_cobaltstrike_offensive_tool_keyword = /\/tgtParse\/tgtParse\./ nocase ascii wide
$string614_cobaltstrike_offensive_tool_keyword = /\/ticketConverter\.exe/ nocase ascii wide
$string615_cobaltstrike_offensive_tool_keyword = "/TikiLoader/" nocase ascii wide
$string616_cobaltstrike_offensive_tool_keyword = /\/TikiSpawn\./ nocase ascii wide
$string617_cobaltstrike_offensive_tool_keyword = "/TikiSpawn/" nocase ascii wide
$string618_cobaltstrike_offensive_tool_keyword = "/TokenStripBOF" nocase ascii wide
$string619_cobaltstrike_offensive_tool_keyword = "/tools/BeaconTool/" nocase ascii wide
$string620_cobaltstrike_offensive_tool_keyword = "/Tools/spoolsystem/" nocase ascii wide
$string621_cobaltstrike_offensive_tool_keyword = "/Tools/Squeak/Squeak" nocase ascii wide
$string622_cobaltstrike_offensive_tool_keyword = /\/trick_ryuk\.profile/ nocase ascii wide
$string623_cobaltstrike_offensive_tool_keyword = /\/trickbot\.profile/ nocase ascii wide
$string624_cobaltstrike_offensive_tool_keyword = /\/UAC\-BOF\-Bonanza\.git/ nocase ascii wide
$string625_cobaltstrike_offensive_tool_keyword = "/UAC-SilentClean/" nocase ascii wide
$string626_cobaltstrike_offensive_tool_keyword = "/unhook-bof" nocase ascii wide
$string627_cobaltstrike_offensive_tool_keyword = "/unhook-bof" nocase ascii wide
$string628_cobaltstrike_offensive_tool_keyword = "/UTWOqVQ132/" nocase ascii wide
$string629_cobaltstrike_offensive_tool_keyword = "/vssenum/" nocase ascii wide
$string630_cobaltstrike_offensive_tool_keyword = /\/WdToggle\.c/ nocase ascii wide
$string631_cobaltstrike_offensive_tool_keyword = /\/WdToggle\.h/ nocase ascii wide
$string632_cobaltstrike_offensive_tool_keyword = /\/webshell\/.{0,100}\.aspx/ nocase ascii wide
$string633_cobaltstrike_offensive_tool_keyword = /\/webshell\/.{0,100}\.jsp/ nocase ascii wide
$string634_cobaltstrike_offensive_tool_keyword = /\/webshell\/.{0,100}\.php/ nocase ascii wide
$string635_cobaltstrike_offensive_tool_keyword = /\/wifidump\.c/ nocase ascii wide
$string636_cobaltstrike_offensive_tool_keyword = /\/WindowsVault\.cna/ nocase ascii wide
$string637_cobaltstrike_offensive_tool_keyword = /\/WindowsVault\.h/ nocase ascii wide
$string638_cobaltstrike_offensive_tool_keyword = /\/winrm\.cpp/ nocase ascii wide
$string639_cobaltstrike_offensive_tool_keyword = "/winrmdll" nocase ascii wide
$string640_cobaltstrike_offensive_tool_keyword = "/winrm-reflective-dll/" nocase ascii wide
$string641_cobaltstrike_offensive_tool_keyword = /\/Winsocky\.git/ nocase ascii wide
$string642_cobaltstrike_offensive_tool_keyword = "/WMI Lateral Movement/" nocase ascii wide
$string643_cobaltstrike_offensive_tool_keyword = "/wwlib/lolbins/" nocase ascii wide
$string644_cobaltstrike_offensive_tool_keyword = /\/xen\-mimi\.ps1/ nocase ascii wide
$string645_cobaltstrike_offensive_tool_keyword = /\/xor\/stager\.txt/ nocase ascii wide
$string646_cobaltstrike_offensive_tool_keyword = /\/xor\/xor\.go/ nocase ascii wide
$string647_cobaltstrike_offensive_tool_keyword = "/xPipe/" nocase ascii wide
$string648_cobaltstrike_offensive_tool_keyword = "/yanghaoi/_CNA" nocase ascii wide
$string649_cobaltstrike_offensive_tool_keyword = /\/zerologon\.cna/ nocase ascii wide
$string650_cobaltstrike_offensive_tool_keyword = /\[\+\]\sPrivileged\sfile\scopy\ssuccess\!\s/ nocase ascii wide
$string651_cobaltstrike_offensive_tool_keyword = /\[\'spawnto\'\]/ nocase ascii wide
$string652_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\bypassuac/ nocase ascii wide
$string653_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\hashdump/ nocase ascii wide
$string654_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\imposecost/ nocase ascii wide
$string655_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\keylogger/ nocase ascii wide
$string656_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\mimikatz/ nocase ascii wide
$string657_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\netview/ nocase ascii wide
$string658_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\PIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/ nocase ascii wide
$string659_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\portscan/ nocase ascii wide
$string660_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\screenshot/ nocase ascii wide
$string661_cobaltstrike_offensive_tool_keyword = /\\\\\.\\pipe\\sshagent/ nocase ascii wide
$string662_cobaltstrike_offensive_tool_keyword = /\\\\\.pipe\\imposingcost/ nocase ascii wide
$string663_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\bypassuac/ nocase ascii wide
$string664_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\hashdump/ nocase ascii wide
$string665_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\keylogger/ nocase ascii wide
$string666_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\mimikatz/ nocase ascii wide
$string667_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\netview/ nocase ascii wide
$string668_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\PIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/ nocase ascii wide
$string669_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\portscan/ nocase ascii wide
$string670_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\screenshot/ nocase ascii wide
$string671_cobaltstrike_offensive_tool_keyword = /\\\\\\\\\.\\\\pipe\\\\sshagent/ nocase ascii wide
$string672_cobaltstrike_offensive_tool_keyword = /\\\\GetWebDAVStatus\.exe/ nocase ascii wide
$string673_cobaltstrike_offensive_tool_keyword = /\\\\pipe\\\\DAV\sRPC\sSERVICE/ nocase ascii wide
$string674_cobaltstrike_offensive_tool_keyword = /\\8e8988b257e9dd2ea44ff03d44d26467b7c9ec16/ nocase ascii wide
$string675_cobaltstrike_offensive_tool_keyword = /\\asreproasting\.c/ nocase ascii wide
$string676_cobaltstrike_offensive_tool_keyword = /\\beacon\.exe/ nocase ascii wide
$string677_cobaltstrike_offensive_tool_keyword = /\\bypassuac\.txt/ nocase ascii wide
$string678_cobaltstrike_offensive_tool_keyword = /\\CrossC2\./ nocase ascii wide
$string679_cobaltstrike_offensive_tool_keyword = /\\CROSSNET\\CROSSNET\\/ nocase ascii wide
$string680_cobaltstrike_offensive_tool_keyword = /\\dumpert\./ nocase ascii wide
$string681_cobaltstrike_offensive_tool_keyword = /\\Dumpert\\/ nocase ascii wide
$string682_cobaltstrike_offensive_tool_keyword = /\\DumpShellcode/ nocase ascii wide
$string683_cobaltstrike_offensive_tool_keyword = /\\dumpXor\.exe/ nocase ascii wide
$string684_cobaltstrike_offensive_tool_keyword = /\\dumpXor\\x64\\/ nocase ascii wide
$string685_cobaltstrike_offensive_tool_keyword = /\\ELF\\portscan/ nocase ascii wide
$string686_cobaltstrike_offensive_tool_keyword = /\\ELF\\serverscan/ nocase ascii wide
$string687_cobaltstrike_offensive_tool_keyword = /\\evil\.dll/ nocase ascii wide
$string688_cobaltstrike_offensive_tool_keyword = /\\geacon\\tools\\BeaconTool\\/ nocase ascii wide
$string689_cobaltstrike_offensive_tool_keyword = /\\GetWebDAVStatus\\/ nocase ascii wide
$string690_cobaltstrike_offensive_tool_keyword = /\\GetWebDAVStatus_x64/ nocase ascii wide
$string691_cobaltstrike_offensive_tool_keyword = /\\HackBrowserData/ nocase ascii wide
$string692_cobaltstrike_offensive_tool_keyword = /\\HiddenDesktop\\/ nocase ascii wide
$string693_cobaltstrike_offensive_tool_keyword = /\\HostEnum\.ps1/ nocase ascii wide
$string694_cobaltstrike_offensive_tool_keyword = /\\kdstab\.exe/ nocase ascii wide
$string695_cobaltstrike_offensive_tool_keyword = /\\kerberoasting\.c/ nocase ascii wide
$string696_cobaltstrike_offensive_tool_keyword = /\\Kerbeus\-BOF\\/ nocase ascii wide
$string697_cobaltstrike_offensive_tool_keyword = /\\Koh\.exe/ nocase ascii wide
$string698_cobaltstrike_offensive_tool_keyword = /\\Koh\.pdb/ nocase ascii wide
$string699_cobaltstrike_offensive_tool_keyword = /\\Koh\\Koh\./ nocase ascii wide
$string700_cobaltstrike_offensive_tool_keyword = /\\Ladon\.exe/ nocase ascii wide
$string701_cobaltstrike_offensive_tool_keyword = /\\Ladon\.ps1/ nocase ascii wide
$string702_cobaltstrike_offensive_tool_keyword = /\\LogonScreen\.exe/ nocase ascii wide
$string703_cobaltstrike_offensive_tool_keyword = /\\lsass\.dmp/ nocase ascii wide
$string704_cobaltstrike_offensive_tool_keyword = /\\Mockingjay_BOF\./ nocase ascii wide
$string705_cobaltstrike_offensive_tool_keyword = /\\No\-Consolation\\source\\/ nocase ascii wide
$string706_cobaltstrike_offensive_tool_keyword = /\\portbender\./ nocase ascii wide
$string707_cobaltstrike_offensive_tool_keyword = /\\PowerView\.cna/ nocase ascii wide
$string708_cobaltstrike_offensive_tool_keyword = /\\PowerView\.exe/ nocase ascii wide
$string709_cobaltstrike_offensive_tool_keyword = /\\PowerView\.ps1/ nocase ascii wide
$string710_cobaltstrike_offensive_tool_keyword = /\\PowerView3\./ nocase ascii wide
$string711_cobaltstrike_offensive_tool_keyword = /\\RunBOF\.exe/ nocase ascii wide
$string712_cobaltstrike_offensive_tool_keyword = /\\RunOF\.exe/ nocase ascii wide
$string713_cobaltstrike_offensive_tool_keyword = /\\RunOF\\bin\\/ nocase ascii wide
$string714_cobaltstrike_offensive_tool_keyword = /\\samantha\.txt/ nocase ascii wide
$string715_cobaltstrike_offensive_tool_keyword = /\\SharpMove\.exe/ nocase ascii wide
$string716_cobaltstrike_offensive_tool_keyword = /\\SigFlip\.exe/ nocase ascii wide
$string717_cobaltstrike_offensive_tool_keyword = /\\SilentClean\.exe/ nocase ascii wide
$string718_cobaltstrike_offensive_tool_keyword = /\\StayKit\.cna/ nocase ascii wide
$string719_cobaltstrike_offensive_tool_keyword = /\\systemic\.txt/ nocase ascii wide
$string720_cobaltstrike_offensive_tool_keyword = /\\TASKSHELL\.EXE/ nocase ascii wide
$string721_cobaltstrike_offensive_tool_keyword = /\\TikiCompiler\.txt/ nocase ascii wide
$string722_cobaltstrike_offensive_tool_keyword = /\\TikiService\.exe/ nocase ascii wide
$string723_cobaltstrike_offensive_tool_keyword = /\\TikiSpawn\./ nocase ascii wide
$string724_cobaltstrike_offensive_tool_keyword = /\\tikispawn\.xml/ nocase ascii wide
$string725_cobaltstrike_offensive_tool_keyword = /\\TikiTorch\\Aggressor/ nocase ascii wide
$string726_cobaltstrike_offensive_tool_keyword = /\\xpipe\.c/ nocase ascii wide
$string727_cobaltstrike_offensive_tool_keyword = /\\xpipe\.o/ nocase ascii wide
$string728_cobaltstrike_offensive_tool_keyword = /\]\scompile\sgeacon\swith\sthe\spublic\skey\sfrom\s\.beacon_keys/ nocase ascii wide
$string729_cobaltstrike_offensive_tool_keyword = /\]\suse\sthe\saes\skey\sfrom\sthe\sbeacon\'s\sonline\sinfo\sto\sencrypt\stransfer\sdata\s\(base64\sformat/ nocase ascii wide
$string730_cobaltstrike_offensive_tool_keyword = /\]\suse\sthe\spublic\skey\sfrom\s\.beacon_keys\sto\sdecrypt\sthe\sbeacon\'s\sonline\sinfo/ nocase ascii wide
$string731_cobaltstrike_offensive_tool_keyword = /\]\sUsing\sKohPipe\s\s\s\s/ nocase ascii wide
$string732_cobaltstrike_offensive_tool_keyword = /\]\sWrote\shijack\sDLL\sto\s/ nocase ascii wide
$string733_cobaltstrike_offensive_tool_keyword = "_cobaltstrike" nocase ascii wide
$string734_cobaltstrike_offensive_tool_keyword = "_find_sharpgen_dll" nocase ascii wide
$string735_cobaltstrike_offensive_tool_keyword = "_pycobalt_" nocase ascii wide
$string736_cobaltstrike_offensive_tool_keyword = /_tcp_cc2\(/ nocase ascii wide
$string737_cobaltstrike_offensive_tool_keyword = /_udp_cc2\(/ nocase ascii wide
$string738_cobaltstrike_offensive_tool_keyword = /\<CoffeLdr\.h\>/ nocase ascii wide
$string739_cobaltstrike_offensive_tool_keyword = "08114a94779a336824a0c62c3d19622fb39aae355962d36a97ba1423a4d6bfcf" nocase ascii wide
$string740_cobaltstrike_offensive_tool_keyword = "0xEr3bus/PoolPartyBof" nocase ascii wide
$string741_cobaltstrike_offensive_tool_keyword = "0xthirteen/MoveKit" nocase ascii wide
$string742_cobaltstrike_offensive_tool_keyword = "0xthirteen/StayKit" nocase ascii wide
$string743_cobaltstrike_offensive_tool_keyword = "4d5350c8-7f8c-47cf-8cde-c752018af17e" nocase ascii wide
$string744_cobaltstrike_offensive_tool_keyword = "5072c4beef28abdb0c53a1f33836facec9e651f6384dedb62611dc3a4d2403d5" nocase ascii wide
$string745_cobaltstrike_offensive_tool_keyword = "516280565958" nocase ascii wide
$string746_cobaltstrike_offensive_tool_keyword = "516280565959" nocase ascii wide
$string747_cobaltstrike_offensive_tool_keyword = "518d6457e2d3e20e470f20b6399ce0f0ff5091dc6d2a0826d658247832ff4a8c" nocase ascii wide
$string748_cobaltstrike_offensive_tool_keyword = "5a40f11a99d0db4a0b06ab5b95c7da4b1c05b55a99c7c443021bff02c2cf93145c53ff5b" nocase ascii wide
$string749_cobaltstrike_offensive_tool_keyword = "5e98194a01c6b48fa582a6a9fcbb92d6" nocase ascii wide
$string750_cobaltstrike_offensive_tool_keyword = "5f9bb909c87cb452a6edbd9da0b5cfdd3f729d7393cf9f7f94e3b731503d072d" nocase ascii wide
$string751_cobaltstrike_offensive_tool_keyword = "6191bb09381c0a8a09db8e7753b7ef89084aaf7557e1605cfeb3abdca258f3ad" nocase ascii wide
$string752_cobaltstrike_offensive_tool_keyword = "6290c67de059c8c86e7051348a1fd0934c8bdf6b9badb539a878a1801b0431d6" nocase ascii wide
$string753_cobaltstrike_offensive_tool_keyword = "6e7645c4-32c5-4fe3-aabf-e94c2f4370e7" nocase ascii wide
$string754_cobaltstrike_offensive_tool_keyword = "713724C3-2367-49FA-B03F-AB4B336FB405" nocase ascii wide
$string755_cobaltstrike_offensive_tool_keyword = "732211ae-4891-40d3-b2b6-85ebd6f5ffff" nocase ascii wide
$string756_cobaltstrike_offensive_tool_keyword = "76318bcd19b5f3efe0e51c77593bccd6804c6a30b95c4c51ec528c30c7faca83" nocase ascii wide
$string757_cobaltstrike_offensive_tool_keyword = /7CFC52\.dll/ nocase ascii wide
$string758_cobaltstrike_offensive_tool_keyword = /7CFC52CD3F\.dll/ nocase ascii wide
$string759_cobaltstrike_offensive_tool_keyword = "913d774e5cf0bfad4adfa900997f7a1a" nocase ascii wide
$string760_cobaltstrike_offensive_tool_keyword = "95502b5e-5763-4ec5-a64c-1e9e33409e2f" nocase ascii wide
$string761_cobaltstrike_offensive_tool_keyword = "9a7dc8a314e69eca7cfcd77046061485331e43c3c153ab9953e9c75f9e3db7d3" nocase ascii wide
$string762_cobaltstrike_offensive_tool_keyword = /AceLdr\..{0,100}\.bin/ nocase ascii wide
$string763_cobaltstrike_offensive_tool_keyword = /AceLdr\.zip/ nocase ascii wide
$string764_cobaltstrike_offensive_tool_keyword = /adcs_enum\./ nocase ascii wide
$string765_cobaltstrike_offensive_tool_keyword = /adcs_enum_com\./ nocase ascii wide
$string766_cobaltstrike_offensive_tool_keyword = /adcs_enum_com2\./ nocase ascii wide
$string767_cobaltstrike_offensive_tool_keyword = /AddUser\-Bof\.c/ nocase ascii wide
$string768_cobaltstrike_offensive_tool_keyword = /AddUser\-Bof\.git/ nocase ascii wide
$string769_cobaltstrike_offensive_tool_keyword = /AddUser\-Bof\.o/ nocase ascii wide
$string770_cobaltstrike_offensive_tool_keyword = /AddUser\-Bof\.x64/ nocase ascii wide
$string771_cobaltstrike_offensive_tool_keyword = /AddUser\-Bof\.x86/ nocase ascii wide
$string772_cobaltstrike_offensive_tool_keyword = /AddUserToDomainGroup\s.{0,100}Domain\sAdmins/ nocase ascii wide
$string773_cobaltstrike_offensive_tool_keyword = /AddUserToDomainGroup\./ nocase ascii wide
$string774_cobaltstrike_offensive_tool_keyword = /AddUserToDomainGroup\.cna/ nocase ascii wide
$string775_cobaltstrike_offensive_tool_keyword = "Adminisme/ServerScan/" nocase ascii wide
$string776_cobaltstrike_offensive_tool_keyword = "ag_load_script" nocase ascii wide
$string777_cobaltstrike_offensive_tool_keyword = /AggressiveProxy\.cna/ nocase ascii wide
$string778_cobaltstrike_offensive_tool_keyword = /aggressor\.beacons/ nocase ascii wide
$string779_cobaltstrike_offensive_tool_keyword = /aggressor\.bshell/ nocase ascii wide
$string780_cobaltstrike_offensive_tool_keyword = /aggressor\.cna/ nocase ascii wide
$string781_cobaltstrike_offensive_tool_keyword = /aggressor\.dialog/ nocase ascii wide
$string782_cobaltstrike_offensive_tool_keyword = /aggressor\.println/ nocase ascii wide
$string783_cobaltstrike_offensive_tool_keyword = /aggressor\.py/ nocase ascii wide
$string784_cobaltstrike_offensive_tool_keyword = "Aggressor/TikiTorch" nocase ascii wide
$string785_cobaltstrike_offensive_tool_keyword = "aggressor-scripts" nocase ascii wide
$string786_cobaltstrike_offensive_tool_keyword = "ajpc500/BOFs" nocase ascii wide
$string787_cobaltstrike_offensive_tool_keyword = "Allocated shellcode memory in the target process: " nocase ascii wide
$string788_cobaltstrike_offensive_tool_keyword = "Alphabug_CS" nocase ascii wide
$string789_cobaltstrike_offensive_tool_keyword = "Alphabug_CS" nocase ascii wide
$string790_cobaltstrike_offensive_tool_keyword = "AlphabugX/csOnvps" nocase ascii wide
$string791_cobaltstrike_offensive_tool_keyword = "AlphabugX/csOnvps" nocase ascii wide
$string792_cobaltstrike_offensive_tool_keyword = /Already\sSYSTEM.{0,100}not\selevating/ nocase ascii wide
$string793_cobaltstrike_offensive_tool_keyword = /ANGRYPUPPY2\.cna/ nocase ascii wide
$string794_cobaltstrike_offensive_tool_keyword = "anthemtotheego/Detect-Hooks" nocase ascii wide
$string795_cobaltstrike_offensive_tool_keyword = "apokryptein/secinject" nocase ascii wide
$string796_cobaltstrike_offensive_tool_keyword = "applocker_enum" nocase ascii wide
$string797_cobaltstrike_offensive_tool_keyword = "applocker-enumerator" nocase ascii wide
$string798_cobaltstrike_offensive_tool_keyword = /apt1_virtuallythere\.profile/ nocase ascii wide
$string799_cobaltstrike_offensive_tool_keyword = /arsenal_kit\.cna/ nocase ascii wide
$string800_cobaltstrike_offensive_tool_keyword = /artifact\.cna/ nocase ascii wide
$string801_cobaltstrike_offensive_tool_keyword = /artifact\.cna/ nocase ascii wide
$string802_cobaltstrike_offensive_tool_keyword = /artifact\.exe/ nocase ascii wide
$string803_cobaltstrike_offensive_tool_keyword = /artifact\.x64\.exe/ nocase ascii wide
$string804_cobaltstrike_offensive_tool_keyword = /artifact\.x86\.dll/ nocase ascii wide
$string805_cobaltstrike_offensive_tool_keyword = /artifact\.x86\.exe/ nocase ascii wide
$string806_cobaltstrike_offensive_tool_keyword = "artifact_payload" nocase ascii wide
$string807_cobaltstrike_offensive_tool_keyword = "artifact_stageless" nocase ascii wide
$string808_cobaltstrike_offensive_tool_keyword = "artifact_stager" nocase ascii wide
$string809_cobaltstrike_offensive_tool_keyword = /artifact32.{0,100}\.exe/ nocase ascii wide
$string810_cobaltstrike_offensive_tool_keyword = /artifact32\.dll/ nocase ascii wide
$string811_cobaltstrike_offensive_tool_keyword = /artifact32\.exe/ nocase ascii wide
$string812_cobaltstrike_offensive_tool_keyword = /artifact32big\.dll/ nocase ascii wide
$string813_cobaltstrike_offensive_tool_keyword = /artifact32big\.exe/ nocase ascii wide
$string814_cobaltstrike_offensive_tool_keyword = /artifact32svc\.exe/ nocase ascii wide
$string815_cobaltstrike_offensive_tool_keyword = /artifact32svcbig\.exe/ nocase ascii wide
$string816_cobaltstrike_offensive_tool_keyword = /artifact64.{0,100}\.exe/ nocase ascii wide
$string817_cobaltstrike_offensive_tool_keyword = /artifact64\.dll/ nocase ascii wide
$string818_cobaltstrike_offensive_tool_keyword = /artifact64\.exe/ nocase ascii wide
$string819_cobaltstrike_offensive_tool_keyword = /artifact64\.x64\.dll/ nocase ascii wide
$string820_cobaltstrike_offensive_tool_keyword = /artifact64big\.exe/ nocase ascii wide
$string821_cobaltstrike_offensive_tool_keyword = /artifact64big\.x64\.dll/ nocase ascii wide
$string822_cobaltstrike_offensive_tool_keyword = /artifact64svc\.exe/ nocase ascii wide
$string823_cobaltstrike_offensive_tool_keyword = /artifact64svcbig\.exe/ nocase ascii wide
$string824_cobaltstrike_offensive_tool_keyword = /artifactbig64\.exe/ nocase ascii wide
$string825_cobaltstrike_offensive_tool_keyword = /artifactuac.{0,100}\.dll/ nocase ascii wide
$string826_cobaltstrike_offensive_tool_keyword = /asktgs\.x64\.o/ nocase ascii wide
$string827_cobaltstrike_offensive_tool_keyword = /ASRenum\-BOF\./ nocase ascii wide
$string828_cobaltstrike_offensive_tool_keyword = /asreproasting\.x64/ nocase ascii wide
$string829_cobaltstrike_offensive_tool_keyword = /Assemblies\/SharpMove\.exe/ nocase ascii wide
$string830_cobaltstrike_offensive_tool_keyword = /AttackTeamFamily.{0,100}\-bof\-toolset/ nocase ascii wide
$string831_cobaltstrike_offensive_tool_keyword = "ausecwa/bof-registry" nocase ascii wide
$string832_cobaltstrike_offensive_tool_keyword = /auth\/cc2_ssh\./ nocase ascii wide
$string833_cobaltstrike_offensive_tool_keyword = "Backdoor LNK" nocase ascii wide
$string834_cobaltstrike_offensive_tool_keyword = "--backdoor-all" nocase ascii wide
$string835_cobaltstrike_offensive_tool_keyword = "backdoorlnkdialog" nocase ascii wide
$string836_cobaltstrike_offensive_tool_keyword = /backstab\.x64\./ nocase ascii wide
$string837_cobaltstrike_offensive_tool_keyword = /backstab\.x86\./ nocase ascii wide
$string838_cobaltstrike_offensive_tool_keyword = /BackupPrivSAM\s\\\\/ nocase ascii wide
$string839_cobaltstrike_offensive_tool_keyword = /backupprivsam\./ nocase ascii wide
$string840_cobaltstrike_offensive_tool_keyword = /BadPotato\.exe/ nocase ascii wide
$string841_cobaltstrike_offensive_tool_keyword = "bawait_upload" nocase ascii wide
$string842_cobaltstrike_offensive_tool_keyword = "bawait_upload_raw" nocase ascii wide
$string843_cobaltstrike_offensive_tool_keyword = "bblockdlls" nocase ascii wide
$string844_cobaltstrike_offensive_tool_keyword = "bbrowserpivot" nocase ascii wide
$string845_cobaltstrike_offensive_tool_keyword = "bbrowserpivot" nocase ascii wide
$string846_cobaltstrike_offensive_tool_keyword = "bbypassuac" nocase ascii wide
$string847_cobaltstrike_offensive_tool_keyword = "bcc2_setenv" nocase ascii wide
$string848_cobaltstrike_offensive_tool_keyword = "bcc2_spawn" nocase ascii wide
$string849_cobaltstrike_offensive_tool_keyword = "bcrossc2_load_dyn" nocase ascii wide
$string850_cobaltstrike_offensive_tool_keyword = /BC\-SECURITY.{0,100}Malleable/ nocase ascii wide
$string851_cobaltstrike_offensive_tool_keyword = "bdcsync" nocase ascii wide
$string852_cobaltstrike_offensive_tool_keyword = "bdllinject" nocase ascii wide
$string853_cobaltstrike_offensive_tool_keyword = "bdllinject" nocase ascii wide
$string854_cobaltstrike_offensive_tool_keyword = "bdllload" nocase ascii wide
$string855_cobaltstrike_offensive_tool_keyword = "bdllload" nocase ascii wide
$string856_cobaltstrike_offensive_tool_keyword = "bdllspawn" nocase ascii wide
$string857_cobaltstrike_offensive_tool_keyword = "bdllspawn" nocase ascii wide
$string858_cobaltstrike_offensive_tool_keyword = "be041565c155ce5a9129e2d79a2c8d18acf4143a7f3aa2237c15a15a89b6625e" nocase ascii wide
$string859_cobaltstrike_offensive_tool_keyword = "Beacon Payload Generator" nocase ascii wide
$string860_cobaltstrike_offensive_tool_keyword = /beacon\..{0,100}winsrv\.dll/ nocase ascii wide
$string861_cobaltstrike_offensive_tool_keyword = /beacon\.CommandBuilder/ nocase ascii wide
$string862_cobaltstrike_offensive_tool_keyword = /beacon\.dll/ nocase ascii wide
$string863_cobaltstrike_offensive_tool_keyword = /beacon\.exe/ nocase ascii wide
$string864_cobaltstrike_offensive_tool_keyword = /beacon\.exe/ nocase ascii wide
$string865_cobaltstrike_offensive_tool_keyword = /beacon\.nim/ nocase ascii wide
$string866_cobaltstrike_offensive_tool_keyword = /Beacon\.Object\.File\.zip/ nocase ascii wide
$string867_cobaltstrike_offensive_tool_keyword = /beacon\.x64.{0,100}\.dll/ nocase ascii wide
$string868_cobaltstrike_offensive_tool_keyword = /beacon\.x64.{0,100}\.exe/ nocase ascii wide
$string869_cobaltstrike_offensive_tool_keyword = /beacon\.x64\.dll/ nocase ascii wide
$string870_cobaltstrike_offensive_tool_keyword = /beacon\.x86.{0,100}\.dll/ nocase ascii wide
$string871_cobaltstrike_offensive_tool_keyword = /beacon\.x86.{0,100}\.exe/ nocase ascii wide
$string872_cobaltstrike_offensive_tool_keyword = /beacon_api\.h/ nocase ascii wide
$string873_cobaltstrike_offensive_tool_keyword = "beacon_bottom " nocase ascii wide
$string874_cobaltstrike_offensive_tool_keyword = "Beacon_Com_Struct" nocase ascii wide
$string875_cobaltstrike_offensive_tool_keyword = "beacon_command_describe" nocase ascii wide
$string876_cobaltstrike_offensive_tool_keyword = "beacon_command_detail" nocase ascii wide
$string877_cobaltstrike_offensive_tool_keyword = "beacon_command_register" nocase ascii wide
$string878_cobaltstrike_offensive_tool_keyword = "beacon_commands" nocase ascii wide
$string879_cobaltstrike_offensive_tool_keyword = /beacon_compatibility\.c/ nocase ascii wide
$string880_cobaltstrike_offensive_tool_keyword = /beacon_compatibility\.h/ nocase ascii wide
$string881_cobaltstrike_offensive_tool_keyword = "beacon_elevator_describe" nocase ascii wide
$string882_cobaltstrike_offensive_tool_keyword = "beacon_elevator_register" nocase ascii wide
$string883_cobaltstrike_offensive_tool_keyword = "beacon_elevators" nocase ascii wide
$string884_cobaltstrike_offensive_tool_keyword = "beacon_elevators" nocase ascii wide
$string885_cobaltstrike_offensive_tool_keyword = "beacon_execute_job" nocase ascii wide
$string886_cobaltstrike_offensive_tool_keyword = "beacon_exploit_describe" nocase ascii wide
$string887_cobaltstrike_offensive_tool_keyword = "beacon_exploit_register" nocase ascii wide
$string888_cobaltstrike_offensive_tool_keyword = /beacon_funcs\.c/ nocase ascii wide
$string889_cobaltstrike_offensive_tool_keyword = /beacon_funcs\.h/ nocase ascii wide
$string890_cobaltstrike_offensive_tool_keyword = /beacon_funcs\.x64\./ nocase ascii wide
$string891_cobaltstrike_offensive_tool_keyword = /beacon_funcs\.x86\./ nocase ascii wide
$string892_cobaltstrike_offensive_tool_keyword = /beacon_generate\.py/ nocase ascii wide
$string893_cobaltstrike_offensive_tool_keyword = "Beacon_GETPOST" nocase ascii wide
$string894_cobaltstrike_offensive_tool_keyword = "beacon_host_script" nocase ascii wide
$string895_cobaltstrike_offensive_tool_keyword = "beacon_host_script" nocase ascii wide
$string896_cobaltstrike_offensive_tool_keyword = "beacon_inline_execute" nocase ascii wide
$string897_cobaltstrike_offensive_tool_keyword = "beacon_keys -compile geacon_sourcecode_folder" nocase ascii wide
$string898_cobaltstrike_offensive_tool_keyword = "beacon_log_clean" nocase ascii wide
$string899_cobaltstrike_offensive_tool_keyword = /beacon_output_ps\.cna/ nocase ascii wide
$string900_cobaltstrike_offensive_tool_keyword = "beacon_print" nocase ascii wide
$string901_cobaltstrike_offensive_tool_keyword = "BEACON_RDLL_" nocase ascii wide
$string902_cobaltstrike_offensive_tool_keyword = "beacon_remote_exec_" nocase ascii wide
$string903_cobaltstrike_offensive_tool_keyword = "beacon_remote_exec_method_describe" nocase ascii wide
$string904_cobaltstrike_offensive_tool_keyword = "beacon_remote_exec_method_register" nocase ascii wide
$string905_cobaltstrike_offensive_tool_keyword = "beacon_remote_exec_methods" nocase ascii wide
$string906_cobaltstrike_offensive_tool_keyword = "beacon_remote_exploit" nocase ascii wide
$string907_cobaltstrike_offensive_tool_keyword = "beacon_remote_exploit_arch" nocase ascii wide
$string908_cobaltstrike_offensive_tool_keyword = "beacon_remote_exploit_describe" nocase ascii wide
$string909_cobaltstrike_offensive_tool_keyword = "beacon_remote_exploit_register" nocase ascii wide
$string910_cobaltstrike_offensive_tool_keyword = "beacon_remote_exploits" nocase ascii wide
$string911_cobaltstrike_offensive_tool_keyword = /beacon_smb\.exe/ nocase ascii wide
$string912_cobaltstrike_offensive_tool_keyword = "Beacon_Stage_p2_Stuct" nocase ascii wide
$string913_cobaltstrike_offensive_tool_keyword = "beacon_stage_pipe" nocase ascii wide
$string914_cobaltstrike_offensive_tool_keyword = "Beacon_Stage_Struct_p1" nocase ascii wide
$string915_cobaltstrike_offensive_tool_keyword = "Beacon_Stage_Struct_p3" nocase ascii wide
$string916_cobaltstrike_offensive_tool_keyword = "beacon_stage_tcp" nocase ascii wide
$string917_cobaltstrike_offensive_tool_keyword = "beacon_stage_tcp" nocase ascii wide
$string918_cobaltstrike_offensive_tool_keyword = /beacon_test\.exe/ nocase ascii wide
$string919_cobaltstrike_offensive_tool_keyword = "beacon_top " nocase ascii wide
$string920_cobaltstrike_offensive_tool_keyword = "beacon_top_callback" nocase ascii wide
$string921_cobaltstrike_offensive_tool_keyword = /BeaconApi\.cs/ nocase ascii wide
$string922_cobaltstrike_offensive_tool_keyword = "beacon-c2-go" nocase ascii wide
$string923_cobaltstrike_offensive_tool_keyword = "BeaconCleanupProcess" nocase ascii wide
$string924_cobaltstrike_offensive_tool_keyword = /BeaconConsoleWriter\.cs/ nocase ascii wide
$string925_cobaltstrike_offensive_tool_keyword = "BeaconGetSpawnTo" nocase ascii wide
$string926_cobaltstrike_offensive_tool_keyword = "BeaconGetSpawnTo" nocase ascii wide
$string927_cobaltstrike_offensive_tool_keyword = "BeaconGetSpawnTo" nocase ascii wide
$string928_cobaltstrike_offensive_tool_keyword = /beacongrapher\.py/ nocase ascii wide
$string929_cobaltstrike_offensive_tool_keyword = "BeaconInjectProcess" nocase ascii wide
$string930_cobaltstrike_offensive_tool_keyword = "BeaconInjectProcess" nocase ascii wide
$string931_cobaltstrike_offensive_tool_keyword = "BeaconInjectTemporaryProcess" nocase ascii wide
$string932_cobaltstrike_offensive_tool_keyword = "BeaconInjectTemporaryProcess" nocase ascii wide
$string933_cobaltstrike_offensive_tool_keyword = /BeaconJob\.cs/ nocase ascii wide
$string934_cobaltstrike_offensive_tool_keyword = /BeaconJobWriter\.cs/ nocase ascii wide
$string935_cobaltstrike_offensive_tool_keyword = /beaconlogs\.json/ nocase ascii wide
$string936_cobaltstrike_offensive_tool_keyword = /beaconlogtracker\.py/ nocase ascii wide
$string937_cobaltstrike_offensive_tool_keyword = /BeaconNote\.cna/ nocase ascii wide
$string938_cobaltstrike_offensive_tool_keyword = /BeaconNotify\.cna/ nocase ascii wide
$string939_cobaltstrike_offensive_tool_keyword = /BeaconObject\.cs/ nocase ascii wide
$string940_cobaltstrike_offensive_tool_keyword = "BeaconOutputStreamW" nocase ascii wide
$string941_cobaltstrike_offensive_tool_keyword = /BeaconOutputWriter\.cs/ nocase ascii wide
$string942_cobaltstrike_offensive_tool_keyword = /BeaconPrintf\(/ nocase ascii wide
$string943_cobaltstrike_offensive_tool_keyword = "BeaconPrintf" nocase ascii wide
$string944_cobaltstrike_offensive_tool_keyword = "BeaconPrintToStreamW" nocase ascii wide
$string945_cobaltstrike_offensive_tool_keyword = "BeaconSpawnTemporaryProcess" nocase ascii wide
$string946_cobaltstrike_offensive_tool_keyword = "BeaconSpawnTemporaryProcess" nocase ascii wide
$string947_cobaltstrike_offensive_tool_keyword = "BeaconTool -" nocase ascii wide
$string948_cobaltstrike_offensive_tool_keyword = /BeaconTool\s\-i\sonline_info\.txt\s\-aes\sdecrypt/ nocase ascii wide
$string949_cobaltstrike_offensive_tool_keyword = /BeaconTool\/lib\/sleep\.jar/ nocase ascii wide
$string950_cobaltstrike_offensive_tool_keyword = "BeaconUseToken" nocase ascii wide
$string951_cobaltstrike_offensive_tool_keyword = "bgetprivs" nocase ascii wide
$string952_cobaltstrike_offensive_tool_keyword = "bhashdump" nocase ascii wide
$string953_cobaltstrike_offensive_tool_keyword = /bin\/bof_c\.o/ nocase ascii wide
$string954_cobaltstrike_offensive_tool_keyword = /bin\/bof_nim\.o/ nocase ascii wide
$string955_cobaltstrike_offensive_tool_keyword = "bkerberos_ccache_use" nocase ascii wide
$string956_cobaltstrike_offensive_tool_keyword = "bkerberos_ticket_purge" nocase ascii wide
$string957_cobaltstrike_offensive_tool_keyword = "bkerberos_ticket_use" nocase ascii wide
$string958_cobaltstrike_offensive_tool_keyword = "bkeylogger" nocase ascii wide
$string959_cobaltstrike_offensive_tool_keyword = "blockdlls start" nocase ascii wide
$string960_cobaltstrike_offensive_tool_keyword = "blockdlls stop" nocase ascii wide
$string961_cobaltstrike_offensive_tool_keyword = "bloginuser" nocase ascii wide
$string962_cobaltstrike_offensive_tool_keyword = "blogonpasswords" nocase ascii wide
$string963_cobaltstrike_offensive_tool_keyword = "BOF prototype works!" nocase ascii wide
$string964_cobaltstrike_offensive_tool_keyword = /bof.{0,100}\/CredEnum\// nocase ascii wide
$string965_cobaltstrike_offensive_tool_keyword = /BOF\/.{0,100}procdump\// nocase ascii wide
$string966_cobaltstrike_offensive_tool_keyword = "bof_allocator" nocase ascii wide
$string967_cobaltstrike_offensive_tool_keyword = /bof_helper\.py/ nocase ascii wide
$string968_cobaltstrike_offensive_tool_keyword = /bof_net_user\.c/ nocase ascii wide
$string969_cobaltstrike_offensive_tool_keyword = /bof_net_user\.o/ nocase ascii wide
$string970_cobaltstrike_offensive_tool_keyword = "bof_reuse_memory" nocase ascii wide
$string971_cobaltstrike_offensive_tool_keyword = "BOF2shellcode" nocase ascii wide
$string972_cobaltstrike_offensive_tool_keyword = /bof2shellcode\.py/ nocase ascii wide
$string973_cobaltstrike_offensive_tool_keyword = "BOF-DLL-Inject" nocase ascii wide
$string974_cobaltstrike_offensive_tool_keyword = "bofentry::bof_entry" nocase ascii wide
$string975_cobaltstrike_offensive_tool_keyword = "BOF-ForeignLsass" nocase ascii wide
$string976_cobaltstrike_offensive_tool_keyword = /BOF\-IShellWindows\-DCOM\./ nocase ascii wide
$string977_cobaltstrike_offensive_tool_keyword = "BofLdapSignCheck" nocase ascii wide
$string978_cobaltstrike_offensive_tool_keyword = /bofloader\.bin/ nocase ascii wide
$string979_cobaltstrike_offensive_tool_keyword = /bofnet.{0,100}SeriousSam\./ nocase ascii wide
$string980_cobaltstrike_offensive_tool_keyword = /BOFNET\.Bofs/ nocase ascii wide
$string981_cobaltstrike_offensive_tool_keyword = /bofnet\.cna/ nocase ascii wide
$string982_cobaltstrike_offensive_tool_keyword = /BOFNET\.csproj/ nocase ascii wide
$string983_cobaltstrike_offensive_tool_keyword = /BOFNET\.sln/ nocase ascii wide
$string984_cobaltstrike_offensive_tool_keyword = /bofnet_boo\s.{0,100}\.boo/ nocase ascii wide
$string985_cobaltstrike_offensive_tool_keyword = "bofnet_execute " nocase ascii wide
$string986_cobaltstrike_offensive_tool_keyword = /bofnet_execute\./ nocase ascii wide
$string987_cobaltstrike_offensive_tool_keyword = "bofnet_init" nocase ascii wide
$string988_cobaltstrike_offensive_tool_keyword = "bofnet_job " nocase ascii wide
$string989_cobaltstrike_offensive_tool_keyword = "bofnet_jobkill" nocase ascii wide
$string990_cobaltstrike_offensive_tool_keyword = "bofnet_jobs" nocase ascii wide
$string991_cobaltstrike_offensive_tool_keyword = "bofnet_jobstatus " nocase ascii wide
$string992_cobaltstrike_offensive_tool_keyword = "bofnet_list" nocase ascii wide
$string993_cobaltstrike_offensive_tool_keyword = "bofnet_listassembiles" nocase ascii wide
$string994_cobaltstrike_offensive_tool_keyword = /bofnet_load\s.{0,100}\./ nocase ascii wide
$string995_cobaltstrike_offensive_tool_keyword = "bofnet_shutdown" nocase ascii wide
$string996_cobaltstrike_offensive_tool_keyword = "BOFNET_Tests" nocase ascii wide
$string997_cobaltstrike_offensive_tool_keyword = "bofportscan " nocase ascii wide
$string998_cobaltstrike_offensive_tool_keyword = /bof\-quser\s.{0,100}\./ nocase ascii wide
$string999_cobaltstrike_offensive_tool_keyword = /bof\-quser\.cna/ nocase ascii wide
$string1000_cobaltstrike_offensive_tool_keyword = "bof-rdphijack" nocase ascii wide
$string1001_cobaltstrike_offensive_tool_keyword = "bof-regsave " nocase ascii wide
$string1002_cobaltstrike_offensive_tool_keyword = "BofRunnerOutput" nocase ascii wide
$string1003_cobaltstrike_offensive_tool_keyword = /BOFs.{0,100}\/SyscallsSpawn\// nocase ascii wide
$string1004_cobaltstrike_offensive_tool_keyword = "Bofs/AssemblyLoader" nocase ascii wide
$string1005_cobaltstrike_offensive_tool_keyword = "bof-servicemove " nocase ascii wide
$string1006_cobaltstrike_offensive_tool_keyword = "bof-trustedpath-uacbypass" nocase ascii wide
$string1007_cobaltstrike_offensive_tool_keyword = "boku_pe_customMZ" nocase ascii wide
$string1008_cobaltstrike_offensive_tool_keyword = "boku_pe_customPE" nocase ascii wide
$string1009_cobaltstrike_offensive_tool_keyword = "boku_pe_dll" nocase ascii wide
$string1010_cobaltstrike_offensive_tool_keyword = "boku_pe_mask_" nocase ascii wide
$string1011_cobaltstrike_offensive_tool_keyword = "boku_pe_MZ_from_C2Profile" nocase ascii wide
$string1012_cobaltstrike_offensive_tool_keyword = "boku_strrep" nocase ascii wide
$string1013_cobaltstrike_offensive_tool_keyword = "boku7/BokuLoader" nocase ascii wide
$string1014_cobaltstrike_offensive_tool_keyword = "boku7/HOLLOW" nocase ascii wide
$string1015_cobaltstrike_offensive_tool_keyword = /BokuLoader\.cna/ nocase ascii wide
$string1016_cobaltstrike_offensive_tool_keyword = /BokuLoader\.exe/ nocase ascii wide
$string1017_cobaltstrike_offensive_tool_keyword = /BokuLoader\.x64/ nocase ascii wide
$string1018_cobaltstrike_offensive_tool_keyword = /BooExecutorImpl\.cs/ nocase ascii wide
$string1019_cobaltstrike_offensive_tool_keyword = "bpassthehash" nocase ascii wide
$string1020_cobaltstrike_offensive_tool_keyword = "bpowerpick" nocase ascii wide
$string1021_cobaltstrike_offensive_tool_keyword = "bpsexec_command" nocase ascii wide
$string1022_cobaltstrike_offensive_tool_keyword = "bpsexec_command" nocase ascii wide
$string1023_cobaltstrike_offensive_tool_keyword = "bpsexec_psh" nocase ascii wide
$string1024_cobaltstrike_offensive_tool_keyword = "bpsinject" nocase ascii wide
$string1025_cobaltstrike_offensive_tool_keyword = /breg\sadd\s.{0,100}HK/ nocase ascii wide
$string1026_cobaltstrike_offensive_tool_keyword = /breg\sdelete\s.{0,100}HK/ nocase ascii wide
$string1027_cobaltstrike_offensive_tool_keyword = /breg\squery\s.{0,100}HK/ nocase ascii wide
$string1028_cobaltstrike_offensive_tool_keyword = "breg_add_string_value" nocase ascii wide
$string1029_cobaltstrike_offensive_tool_keyword = "bremote_exec" nocase ascii wide
$string1030_cobaltstrike_offensive_tool_keyword = "browser_##" nocase ascii wide
$string1031_cobaltstrike_offensive_tool_keyword = "browserpivot " nocase ascii wide
$string1032_cobaltstrike_offensive_tool_keyword = "brun_script_in_mem" nocase ascii wide
$string1033_cobaltstrike_offensive_tool_keyword = "brunasadmin" nocase ascii wide
$string1034_cobaltstrike_offensive_tool_keyword = "bshinject" nocase ascii wide
$string1035_cobaltstrike_offensive_tool_keyword = "bshinject" nocase ascii wide
$string1036_cobaltstrike_offensive_tool_keyword = "bshspawn" nocase ascii wide
$string1037_cobaltstrike_offensive_tool_keyword = "bsteal_token" nocase ascii wide
$string1038_cobaltstrike_offensive_tool_keyword = "bsteal_token" nocase ascii wide
$string1039_cobaltstrike_offensive_tool_keyword = /build\sSourcePoint\.go/ nocase ascii wide
$string1040_cobaltstrike_offensive_tool_keyword = /build\/breg\.cna/ nocase ascii wide
$string1041_cobaltstrike_offensive_tool_keyword = "build_c_shellcode" nocase ascii wide
$string1042_cobaltstrike_offensive_tool_keyword = /BuildBOFs\.exe/ nocase ascii wide
$string1043_cobaltstrike_offensive_tool_keyword = /BuildBOFs\.sln/ nocase ascii wide
$string1044_cobaltstrike_offensive_tool_keyword = "Building Koh BOFs" nocase ascii wide
$string1045_cobaltstrike_offensive_tool_keyword = /bupload_raw.{0,100}\.dll/ nocase ascii wide
$string1046_cobaltstrike_offensive_tool_keyword = /burp2malleable\./ nocase ascii wide
$string1047_cobaltstrike_offensive_tool_keyword = "Bypass Success! Now impersonating the forged token" nocase ascii wide
$string1048_cobaltstrike_offensive_tool_keyword = /BypassAV\.exe/ nocase ascii wide
$string1049_cobaltstrike_offensive_tool_keyword = /bypass\-pipe\.c/ nocase ascii wide
$string1050_cobaltstrike_offensive_tool_keyword = "byt3bl33d3r/BOF-Nim" nocase ascii wide
$string1051_cobaltstrike_offensive_tool_keyword = /\-c\sBOF\.cpp\s\-o\sBOF\.o/ nocase ascii wide
$string1052_cobaltstrike_offensive_tool_keyword = /\-c\sBOF\.cpp\s\-o\sBOF\.x64\.o/ nocase ascii wide
$string1053_cobaltstrike_offensive_tool_keyword = /C\:\\Temp\\poc\.txt/ nocase ascii wide
$string1054_cobaltstrike_offensive_tool_keyword = /C\:\\Windows\\Temp\\move\.exe/ nocase ascii wide
$string1055_cobaltstrike_offensive_tool_keyword = /C\:\\Windows\\Temp\\moveme\.exe/ nocase ascii wide
$string1056_cobaltstrike_offensive_tool_keyword = /C\?\?\/generator\.cpp/ nocase ascii wide
$string1057_cobaltstrike_offensive_tool_keyword = "c2lint " nocase ascii wide
$string1058_cobaltstrike_offensive_tool_keyword = "C2ListenerPort" nocase ascii wide
$string1059_cobaltstrike_offensive_tool_keyword = /\-c2\-randomizer\.py/ nocase ascii wide
$string1060_cobaltstrike_offensive_tool_keyword = "C2ReverseClint" nocase ascii wide
$string1061_cobaltstrike_offensive_tool_keyword = "C2ReverseProxy" nocase ascii wide
$string1062_cobaltstrike_offensive_tool_keyword = "C2ReverseServer" nocase ascii wide
$string1063_cobaltstrike_offensive_tool_keyword = /C2script\/proxy\./ nocase ascii wide
$string1064_cobaltstrike_offensive_tool_keyword = "'c2server'" nocase ascii wide
$string1065_cobaltstrike_offensive_tool_keyword = "c5c2ca31085c518b48980da28238d622ba5bb77d0caf36bae116ad90c2a7920f" nocase ascii wide
$string1066_cobaltstrike_offensive_tool_keyword = /CACTUSTORCH\.cna/ nocase ascii wide
$string1067_cobaltstrike_offensive_tool_keyword = /CACTUSTORCH\.cs/ nocase ascii wide
$string1068_cobaltstrike_offensive_tool_keyword = /CACTUSTORCH\.hta/ nocase ascii wide
$string1069_cobaltstrike_offensive_tool_keyword = /CACTUSTORCH\.js/ nocase ascii wide
$string1070_cobaltstrike_offensive_tool_keyword = /CACTUSTORCH\.vba/ nocase ascii wide
$string1071_cobaltstrike_offensive_tool_keyword = /CACTUSTORCH\.vbe/ nocase ascii wide
$string1072_cobaltstrike_offensive_tool_keyword = /CACTUSTORCH\.vbs/ nocase ascii wide
$string1073_cobaltstrike_offensive_tool_keyword = "CALLBACK_HASHDUMP" nocase ascii wide
$string1074_cobaltstrike_offensive_tool_keyword = "CALLBACK_KEYSTROKES" nocase ascii wide
$string1075_cobaltstrike_offensive_tool_keyword = "CALLBACK_NETVIEW" nocase ascii wide
$string1076_cobaltstrike_offensive_tool_keyword = "CALLBACK_PORTSCAN" nocase ascii wide
$string1077_cobaltstrike_offensive_tool_keyword = "CALLBACK_TOKEN_STOLEN" nocase ascii wide
$string1078_cobaltstrike_offensive_tool_keyword = /CallBackDump.{0,100}dumpXor/ nocase ascii wide
$string1079_cobaltstrike_offensive_tool_keyword = /CallbackDump\.exe/ nocase ascii wide
$string1080_cobaltstrike_offensive_tool_keyword = /careCrow.{0,100}_linux_amd64/
$string1081_cobaltstrike_offensive_tool_keyword = /cat\s.{0,100}\.bin\s\|\sbase64\s\-w\s0\s\>\s.{0,100}\.txt/ nocase ascii wide
$string1082_cobaltstrike_offensive_tool_keyword = "cc2_keystrokes_" nocase ascii wide
$string1083_cobaltstrike_offensive_tool_keyword = /cc2_mimipenguin\./ nocase ascii wide
$string1084_cobaltstrike_offensive_tool_keyword = "cc2_portscan_" nocase ascii wide
$string1085_cobaltstrike_offensive_tool_keyword = /cc2_rebind_.{0,100}_get_recv/ nocase ascii wide
$string1086_cobaltstrike_offensive_tool_keyword = /cc2_rebind_.{0,100}_get_send/ nocase ascii wide
$string1087_cobaltstrike_offensive_tool_keyword = /cc2_rebind_.{0,100}_post_recv/ nocase ascii wide
$string1088_cobaltstrike_offensive_tool_keyword = /cc2_rebind_.{0,100}_post_send/ nocase ascii wide
$string1089_cobaltstrike_offensive_tool_keyword = "cc2_udp_server" nocase ascii wide
$string1090_cobaltstrike_offensive_tool_keyword = /cc2FilesColor\./ nocase ascii wide
$string1091_cobaltstrike_offensive_tool_keyword = /cc2ProcessColor\./ nocase ascii wide
$string1092_cobaltstrike_offensive_tool_keyword = /CCob\/BOF\.NET/ nocase ascii wide
$string1093_cobaltstrike_offensive_tool_keyword = /cd\s\.\/whereami\//
$string1094_cobaltstrike_offensive_tool_keyword = /ChatLadon\.exe/ nocase ascii wide
$string1095_cobaltstrike_offensive_tool_keyword = /ChatLadon\.rar/ nocase ascii wide
$string1096_cobaltstrike_offensive_tool_keyword = "check_and_write_IAT_Hook" nocase ascii wide
$string1097_cobaltstrike_offensive_tool_keyword = /check_function\sntdll\.dll\sEtwEventWrite/ nocase ascii wide
$string1098_cobaltstrike_offensive_tool_keyword = "checkIfHiddenAPICall" nocase ascii wide
$string1099_cobaltstrike_offensive_tool_keyword = /chromeKey\.x64/ nocase ascii wide
$string1100_cobaltstrike_offensive_tool_keyword = /chromeKey\.x86/ nocase ascii wide
$string1101_cobaltstrike_offensive_tool_keyword = "chromiumkeydump" nocase ascii wide
$string1102_cobaltstrike_offensive_tool_keyword = "cHux014r17SG3v4gPUrZ0BZjDabMTY2eWDj1tuYdREBg" nocase ascii wide
$string1103_cobaltstrike_offensive_tool_keyword = /clipboardinject\./ nocase ascii wide
$string1104_cobaltstrike_offensive_tool_keyword = /clipboardinject\.x64/ nocase ascii wide
$string1105_cobaltstrike_offensive_tool_keyword = /clipboardinject\.x86/ nocase ascii wide
$string1106_cobaltstrike_offensive_tool_keyword = "ClipboardWindow-Inject" nocase ascii wide
$string1107_cobaltstrike_offensive_tool_keyword = /clipmon\.sln/ nocase ascii wide
$string1108_cobaltstrike_offensive_tool_keyword = "CmstpElevatedCOM" nocase ascii wide
$string1109_cobaltstrike_offensive_tool_keyword = "Cobalt Strike" nocase ascii wide
$string1110_cobaltstrike_offensive_tool_keyword = /cobaltclip\.cna/ nocase ascii wide
$string1111_cobaltstrike_offensive_tool_keyword = /cobaltclip\.exe/ nocase ascii wide
$string1112_cobaltstrike_offensive_tool_keyword = "cobaltstrike" nocase ascii wide
$string1113_cobaltstrike_offensive_tool_keyword = "cobalt-strike" nocase ascii wide
$string1114_cobaltstrike_offensive_tool_keyword = /cobaltstrike\.store/ nocase ascii wide
$string1115_cobaltstrike_offensive_tool_keyword = "Cobalt-Strike/bof_template" nocase ascii wide
$string1116_cobaltstrike_offensive_tool_keyword = /CodeLoad\(shellcode\)/ nocase ascii wide
$string1117_cobaltstrike_offensive_tool_keyword = /coff_definitions\.h/ nocase ascii wide
$string1118_cobaltstrike_offensive_tool_keyword = /COFF_Loader\./ nocase ascii wide
$string1119_cobaltstrike_offensive_tool_keyword = "COFF_PREP_BEACON" nocase ascii wide
$string1120_cobaltstrike_offensive_tool_keyword = /CoffeeLdr.{0,100}\sgo\s/ nocase ascii wide
$string1121_cobaltstrike_offensive_tool_keyword = /CoffeeLdr\.x64\.exe/ nocase ascii wide
$string1122_cobaltstrike_offensive_tool_keyword = /CoffeeLdr\.x86\.exe/ nocase ascii wide
$string1123_cobaltstrike_offensive_tool_keyword = "COFFELDR_COFFELDR_H" nocase ascii wide
$string1124_cobaltstrike_offensive_tool_keyword = /COFFLoader\./ nocase ascii wide
$string1125_cobaltstrike_offensive_tool_keyword = /COFFLoader64\.exe/ nocase ascii wide
$string1126_cobaltstrike_offensive_tool_keyword = "ColorDataProxyUACBypass" nocase ascii wide
$string1127_cobaltstrike_offensive_tool_keyword = /com_exec_go\(/ nocase ascii wide
$string1128_cobaltstrike_offensive_tool_keyword = /com\-exec\.cna/ nocase ascii wide
$string1129_cobaltstrike_offensive_tool_keyword = /common\.ReflectiveDLL/ nocase ascii wide
$string1130_cobaltstrike_offensive_tool_keyword = "comnap_##" nocase ascii wide
$string1131_cobaltstrike_offensive_tool_keyword = "comnode_##" nocase ascii wide
$string1132_cobaltstrike_offensive_tool_keyword = "connormcgarr/tgtdelegation" nocase ascii wide
$string1133_cobaltstrike_offensive_tool_keyword = /cookie_graber_x64\.o/ nocase ascii wide
$string1134_cobaltstrike_offensive_tool_keyword = /cookie\-graber\.c/ nocase ascii wide
$string1135_cobaltstrike_offensive_tool_keyword = /cookie\-graber_x64\.exe/ nocase ascii wide
$string1136_cobaltstrike_offensive_tool_keyword = "Cookie-Graber-BOF" nocase ascii wide
$string1137_cobaltstrike_offensive_tool_keyword = /CookieProcessor\.exe/ nocase ascii wide
$string1138_cobaltstrike_offensive_tool_keyword = /covid19_koadic\.profile/ nocase ascii wide
$string1139_cobaltstrike_offensive_tool_keyword = "crawlLdrDllList" nocase ascii wide
$string1140_cobaltstrike_offensive_tool_keyword = /credBandit\s.{0,100}\soutput/ nocase ascii wide
$string1141_cobaltstrike_offensive_tool_keyword = /credBandit\./ nocase ascii wide
$string1142_cobaltstrike_offensive_tool_keyword = "credBanditx64" nocase ascii wide
$string1143_cobaltstrike_offensive_tool_keyword = /CredPrompt\/CredPrompt\.cna/ nocase ascii wide
$string1144_cobaltstrike_offensive_tool_keyword = "cribdragg3r/Alaris" nocase ascii wide
$string1145_cobaltstrike_offensive_tool_keyword = /crimeware.{0,100}\/zeus\.profile/ nocase ascii wide
$string1146_cobaltstrike_offensive_tool_keyword = "crisprss/PrintSpoofer" nocase ascii wide
$string1147_cobaltstrike_offensive_tool_keyword = /cross_s4u\.c/ nocase ascii wide
$string1148_cobaltstrike_offensive_tool_keyword = /cross_s4u\.x64\.o/ nocase ascii wide
$string1149_cobaltstrike_offensive_tool_keyword = "CrossC2 beacon" nocase ascii wide
$string1150_cobaltstrike_offensive_tool_keyword = /CrossC2\.cna/ nocase ascii wide
$string1151_cobaltstrike_offensive_tool_keyword = "crossc2_entry" nocase ascii wide
$string1152_cobaltstrike_offensive_tool_keyword = /crossc2_portscan\./ nocase ascii wide
$string1153_cobaltstrike_offensive_tool_keyword = /crossc2_serverscan\./ nocase ascii wide
$string1154_cobaltstrike_offensive_tool_keyword = "CrossC2Beacon" nocase ascii wide
$string1155_cobaltstrike_offensive_tool_keyword = /CrossC2Kit\./ nocase ascii wide
$string1156_cobaltstrike_offensive_tool_keyword = /CrossC2Kit\./ nocase ascii wide
$string1157_cobaltstrike_offensive_tool_keyword = /CrossC2Kit\.git/ nocase ascii wide
$string1158_cobaltstrike_offensive_tool_keyword = "CrossC2Kit_demo" nocase ascii wide
$string1159_cobaltstrike_offensive_tool_keyword = "crossc2kit_latest" nocase ascii wide
$string1160_cobaltstrike_offensive_tool_keyword = "CrossC2Kit_Loader" nocase ascii wide
$string1161_cobaltstrike_offensive_tool_keyword = "CrossC2Listener" nocase ascii wide
$string1162_cobaltstrike_offensive_tool_keyword = "CrossC2MemScriptEng" nocase ascii wide
$string1163_cobaltstrike_offensive_tool_keyword = "CrossC2Script" nocase ascii wide
$string1164_cobaltstrike_offensive_tool_keyword = /CrossNet\.exe/ nocase ascii wide
$string1165_cobaltstrike_offensive_tool_keyword = "CRTInjectAsSystem" nocase ascii wide
$string1166_cobaltstrike_offensive_tool_keyword = "CRTInjectElevated" nocase ascii wide
$string1167_cobaltstrike_offensive_tool_keyword = "CRTInjectWithoutPid" nocase ascii wide
$string1168_cobaltstrike_offensive_tool_keyword = /cs2modrewrite\.py/ nocase ascii wide
$string1169_cobaltstrike_offensive_tool_keyword = /cs2nginx\.py/ nocase ascii wide
$string1170_cobaltstrike_offensive_tool_keyword = "CS-Avoid-killing" nocase ascii wide
$string1171_cobaltstrike_offensive_tool_keyword = "CS-BOFs/lsass" nocase ascii wide
$string1172_cobaltstrike_offensive_tool_keyword = "CSharpNamedPipeLoader" nocase ascii wide
$string1173_cobaltstrike_offensive_tool_keyword = /csload\.net\/.{0,100}\/muma\./ nocase ascii wide
$string1174_cobaltstrike_offensive_tool_keyword = /csOnvps.{0,100}teamserver/ nocase ascii wide
$string1175_cobaltstrike_offensive_tool_keyword = "CS-Remote-OPs-BOF" nocase ascii wide
$string1176_cobaltstrike_offensive_tool_keyword = /CSSG_load\.cna/ nocase ascii wide
$string1177_cobaltstrike_offensive_tool_keyword = /cs\-token\-vault\.git/ nocase ascii wide
$string1178_cobaltstrike_offensive_tool_keyword = "cube0x0/LdapSignCheck" nocase ascii wide
$string1179_cobaltstrike_offensive_tool_keyword = /custom_payload_generator\./ nocase ascii wide
$string1180_cobaltstrike_offensive_tool_keyword = "CustomKeyboardLayoutPersistence" nocase ascii wide
$string1181_cobaltstrike_offensive_tool_keyword = /CVE_20.{0,100}\.dll/ nocase ascii wide
$string1182_cobaltstrike_offensive_tool_keyword = /cve\-20\.x64\.dll/ nocase ascii wide
$string1183_cobaltstrike_offensive_tool_keyword = /cve\-20\.x86\.dll/ nocase ascii wide
$string1184_cobaltstrike_offensive_tool_keyword = "DallasFR/Cobalt-Clip" nocase ascii wide
$string1185_cobaltstrike_offensive_tool_keyword = "darkr4y/geacon" nocase ascii wide
$string1186_cobaltstrike_offensive_tool_keyword = /dcsync\@protonmail\.com/ nocase ascii wide
$string1187_cobaltstrike_offensive_tool_keyword = /dcsyncattack\(/ nocase ascii wide
$string1188_cobaltstrike_offensive_tool_keyword = /dcsyncattack\.py/ nocase ascii wide
$string1189_cobaltstrike_offensive_tool_keyword = /dcsyncclient\./ nocase ascii wide
$string1190_cobaltstrike_offensive_tool_keyword = /dcsyncclient\.py/ nocase ascii wide
$string1191_cobaltstrike_offensive_tool_keyword = "DeEpinGh0st/Erebus" nocase ascii wide
$string1192_cobaltstrike_offensive_tool_keyword = "DefaultBeaconApi" nocase ascii wide
$string1193_cobaltstrike_offensive_tool_keyword = /demo\-bof\.cna/ nocase ascii wide
$string1194_cobaltstrike_offensive_tool_keyword = /detect\-hooksx64\./ nocase ascii wide
$string1195_cobaltstrike_offensive_tool_keyword = "DisableAllWindowsSoftwareFirewalls" nocase ascii wide
$string1196_cobaltstrike_offensive_tool_keyword = /disableeventvwr\/.{0,100}\.ps1/ nocase ascii wide
$string1197_cobaltstrike_offensive_tool_keyword = /dll\\reflective_dll\./ nocase ascii wide
$string1198_cobaltstrike_offensive_tool_keyword = "dll_hijack_hunter" nocase ascii wide
$string1199_cobaltstrike_offensive_tool_keyword = "DLL_Imports_BOF" nocase ascii wide
$string1200_cobaltstrike_offensive_tool_keyword = "DLL_TO_HIJACK_WIN10" nocase ascii wide
$string1201_cobaltstrike_offensive_tool_keyword = "DLL-Hijack-Search-Order-BOF" nocase ascii wide
$string1202_cobaltstrike_offensive_tool_keyword = "dllinject " nocase ascii wide
$string1203_cobaltstrike_offensive_tool_keyword = "dns_beacon_beacon" nocase ascii wide
$string1204_cobaltstrike_offensive_tool_keyword = "dns_beacon_dns_idle" nocase ascii wide
$string1205_cobaltstrike_offensive_tool_keyword = "dns_beacon_dns_sleep" nocase ascii wide
$string1206_cobaltstrike_offensive_tool_keyword = "dns_beacon_dns_stager_prepend" nocase ascii wide
$string1207_cobaltstrike_offensive_tool_keyword = "dns_beacon_dns_stager_subhost" nocase ascii wide
$string1208_cobaltstrike_offensive_tool_keyword = "dns_beacon_dns_ttl" nocase ascii wide
$string1209_cobaltstrike_offensive_tool_keyword = "dns_beacon_get_A" nocase ascii wide
$string1210_cobaltstrike_offensive_tool_keyword = "dns_beacon_get_TXT" nocase ascii wide
$string1211_cobaltstrike_offensive_tool_keyword = "dns_beacon_maxdns" nocase ascii wide
$string1212_cobaltstrike_offensive_tool_keyword = "dns_beacon_ns_response" nocase ascii wide
$string1213_cobaltstrike_offensive_tool_keyword = "dns_beacon_put_metadata" nocase ascii wide
$string1214_cobaltstrike_offensive_tool_keyword = "dns_beacon_put_output" nocase ascii wide
$string1215_cobaltstrike_offensive_tool_keyword = /dns_redir\.sh\s/
$string1216_cobaltstrike_offensive_tool_keyword = "dns_stager_prepend" nocase ascii wide
$string1217_cobaltstrike_offensive_tool_keyword = "'dns_stager_prepend'" nocase ascii wide
$string1218_cobaltstrike_offensive_tool_keyword = "'dns_stager_subhost'" nocase ascii wide
$string1219_cobaltstrike_offensive_tool_keyword = "dns-beacon " nocase ascii wide
$string1220_cobaltstrike_offensive_tool_keyword = /dnspayload\.bin/ nocase ascii wide
$string1221_cobaltstrike_offensive_tool_keyword = /do_attack\(/ nocase ascii wide
$string1222_cobaltstrike_offensive_tool_keyword = /Doge\-Loader.{0,100}xor\.go/ nocase ascii wide
$string1223_cobaltstrike_offensive_tool_keyword = /douknowwhoami\?d/ nocase ascii wide
$string1224_cobaltstrike_offensive_tool_keyword = "dr0op/CrossNet" nocase ascii wide
$string1225_cobaltstrike_offensive_tool_keyword = /DReverseProxy\.git/ nocase ascii wide
$string1226_cobaltstrike_offensive_tool_keyword = /DReverseServer\.go/ nocase ascii wide
$string1227_cobaltstrike_offensive_tool_keyword = "drop_malleable_unknown_" nocase ascii wide
$string1228_cobaltstrike_offensive_tool_keyword = "drop_malleable_with_invalid_" nocase ascii wide
$string1229_cobaltstrike_offensive_tool_keyword = "drop_malleable_without_" nocase ascii wide
$string1230_cobaltstrike_offensive_tool_keyword = /dropper32\.exe/ nocase ascii wide
$string1231_cobaltstrike_offensive_tool_keyword = /dropper64\.exe/ nocase ascii wide
$string1232_cobaltstrike_offensive_tool_keyword = "dtmsecurity/bof_helper" nocase ascii wide
$string1233_cobaltstrike_offensive_tool_keyword = /Dumpert\.bin/ nocase ascii wide
$string1234_cobaltstrike_offensive_tool_keyword = /Dumpert\.exe/ nocase ascii wide
$string1235_cobaltstrike_offensive_tool_keyword = "Dumpert-Aggressor" nocase ascii wide
$string1236_cobaltstrike_offensive_tool_keyword = /DumpShellcode\.exe/ nocase ascii wide
$string1237_cobaltstrike_offensive_tool_keyword = /dumpXor\.exe\s/ nocase ascii wide
$string1238_cobaltstrike_offensive_tool_keyword = "e42e1a7fcd23299df2ad4a3fe66e0f1df5a367ffe96015fd3a3b9c0a6dfcefdb" nocase ascii wide
$string1239_cobaltstrike_offensive_tool_keyword = /EasyPersistent\.cna/ nocase ascii wide
$string1240_cobaltstrike_offensive_tool_keyword = "ebdf64076861a73d92416c6203d50dd25f4c991372f7d47e7146e29ab41a6892" nocase ascii wide
$string1241_cobaltstrike_offensive_tool_keyword = "elevate juicypotato " nocase ascii wide
$string1242_cobaltstrike_offensive_tool_keyword = "elevate Printspoofer" nocase ascii wide
$string1243_cobaltstrike_offensive_tool_keyword = "elevate svc-exe " nocase ascii wide
$string1244_cobaltstrike_offensive_tool_keyword = /ELFLoader\.c/ nocase ascii wide
$string1245_cobaltstrike_offensive_tool_keyword = /ELFLoader\.h/ nocase ascii wide
$string1246_cobaltstrike_offensive_tool_keyword = /ELFLoader\.out/ nocase ascii wide
$string1247_cobaltstrike_offensive_tool_keyword = "ElJaviLuki/CobaltStrike_OpenBeacon" nocase ascii wide
$string1248_cobaltstrike_offensive_tool_keyword = "empire AttackServers" nocase ascii wide
$string1249_cobaltstrike_offensive_tool_keyword = "EncodeGroup/AggressiveProxy" nocase ascii wide
$string1250_cobaltstrike_offensive_tool_keyword = "EncodeGroup/UAC-SilentClean" nocase ascii wide
$string1251_cobaltstrike_offensive_tool_keyword = /encrypt\/encryptFile\.go/ nocase ascii wide
$string1252_cobaltstrike_offensive_tool_keyword = /encrypt\/encryptUrl\.go/ nocase ascii wide
$string1253_cobaltstrike_offensive_tool_keyword = /EncryptShellcode\(/ nocase ascii wide
$string1254_cobaltstrike_offensive_tool_keyword = "engjibo/NetUser" nocase ascii wide
$string1255_cobaltstrike_offensive_tool_keyword = /EnumCLR\.exe/ nocase ascii wide
$string1256_cobaltstrike_offensive_tool_keyword = /Erebus\/.{0,100}spacerunner/ nocase ascii wide
$string1257_cobaltstrike_offensive_tool_keyword = "EspressoCake/PPLDump_BOF" nocase ascii wide
$string1258_cobaltstrike_offensive_tool_keyword = /EventAggregation\.dll\.bak/ nocase ascii wide
$string1259_cobaltstrike_offensive_tool_keyword = /eventspy\.cna/ nocase ascii wide
$string1260_cobaltstrike_offensive_tool_keyword = /EventSub\-Aggressor\./ nocase ascii wide
$string1261_cobaltstrike_offensive_tool_keyword = /EventViewerUAC\./ nocase ascii wide
$string1262_cobaltstrike_offensive_tool_keyword = /EventViewerUAC\./ nocase ascii wide
$string1263_cobaltstrike_offensive_tool_keyword = /EventViewerUAC\.x64/ nocase ascii wide
$string1264_cobaltstrike_offensive_tool_keyword = /EventViewerUAC\.x86/ nocase ascii wide
$string1265_cobaltstrike_offensive_tool_keyword = "EventViewerUAC_BOF" nocase ascii wide
$string1266_cobaltstrike_offensive_tool_keyword = "eventvwr_elevator" nocase ascii wide
$string1267_cobaltstrike_offensive_tool_keyword = /EVUAC\s.{0,100}\.exe/ nocase ascii wide
$string1268_cobaltstrike_offensive_tool_keyword = "ewby/Mockingjay_BOF" nocase ascii wide
$string1269_cobaltstrike_offensive_tool_keyword = /example\-bof\.sln/ nocase ascii wide
$string1270_cobaltstrike_offensive_tool_keyword = /execmethod.{0,100}PowerPick/ nocase ascii wide
$string1271_cobaltstrike_offensive_tool_keyword = /execmethod.{0,100}PowerShell/ nocase ascii wide
$string1272_cobaltstrike_offensive_tool_keyword = "execute_bof " nocase ascii wide
$string1273_cobaltstrike_offensive_tool_keyword = /execute\-assembly\s.{0,100}\.exe\s/ nocase ascii wide
$string1274_cobaltstrike_offensive_tool_keyword = "executepersistence" nocase ascii wide
$string1275_cobaltstrike_offensive_tool_keyword = "Export-PowerViewCSV" nocase ascii wide
$string1276_cobaltstrike_offensive_tool_keyword = "extract_reflective_loader" nocase ascii wide
$string1277_cobaltstrike_offensive_tool_keyword = "f65740929e9608e0590eee78f1ba20793d99163ac5f6dc1c8b8734b742c4da11" nocase ascii wide
$string1278_cobaltstrike_offensive_tool_keyword = "f8ce37975b71cc8f51fcb93e3e32ec81a9b5da5cead7dcb987d0a3127bde027c" nocase ascii wide
$string1279_cobaltstrike_offensive_tool_keyword = "ff732bedb8593016ffbe4925ce8fd87a74478b06391079413b70ee9e151826f2" nocase ascii wide
$string1280_cobaltstrike_offensive_tool_keyword = "Fiesta Exploit Kit" nocase ascii wide
$string1281_cobaltstrike_offensive_tool_keyword = /FileControler\/FileControler_x64\.dll/ nocase ascii wide
$string1282_cobaltstrike_offensive_tool_keyword = /FileControler\/FileControler_x86\.dll/ nocase ascii wide
$string1283_cobaltstrike_offensive_tool_keyword = /find_payload\(/ nocase ascii wide
$string1284_cobaltstrike_offensive_tool_keyword = "findgpocomputeradmin" nocase ascii wide
$string1285_cobaltstrike_offensive_tool_keyword = "Find-GPOComputerAdmin" nocase ascii wide
$string1286_cobaltstrike_offensive_tool_keyword = "Find-InterestingDomainAcl" nocase ascii wide
$string1287_cobaltstrike_offensive_tool_keyword = "findinterestingdomainsharefile" nocase ascii wide
$string1288_cobaltstrike_offensive_tool_keyword = "Find-InterestingDomainShareFile" nocase ascii wide
$string1289_cobaltstrike_offensive_tool_keyword = "findlocaladminaccess" nocase ascii wide
$string1290_cobaltstrike_offensive_tool_keyword = "findlocaladminaccess" nocase ascii wide
$string1291_cobaltstrike_offensive_tool_keyword = "Find-LocalAdminAccess" nocase ascii wide
$string1292_cobaltstrike_offensive_tool_keyword = "Find-LocalAdminAccess" nocase ascii wide
$string1293_cobaltstrike_offensive_tool_keyword = /FindModule\s.{0,100}\.dll/ nocase ascii wide
$string1294_cobaltstrike_offensive_tool_keyword = "FindObjects-BOF" nocase ascii wide
$string1295_cobaltstrike_offensive_tool_keyword = "FindProcessTokenAndDuplicate" nocase ascii wide
$string1296_cobaltstrike_offensive_tool_keyword = /FindProcHandle\s.{0,100}lsass/ nocase ascii wide
$string1297_cobaltstrike_offensive_tool_keyword = "Firewall_Walker_BOF" nocase ascii wide
$string1298_cobaltstrike_offensive_tool_keyword = "fishing_with_hollowing" nocase ascii wide
$string1299_cobaltstrike_offensive_tool_keyword = /foreign_access\.cna/ nocase ascii wide
$string1300_cobaltstrike_offensive_tool_keyword = /foreign_lsass\s.{0,100}\s/ nocase ascii wide
$string1301_cobaltstrike_offensive_tool_keyword = /foreign_lsass\.c/ nocase ascii wide
$string1302_cobaltstrike_offensive_tool_keyword = /foreign_lsass\.x64/ nocase ascii wide
$string1303_cobaltstrike_offensive_tool_keyword = /foreign_lsass\.x86/ nocase ascii wide
$string1304_cobaltstrike_offensive_tool_keyword = /\-\-format\-string\sziiiiizzzb\s.{0,100}\s/ nocase ascii wide
$string1305_cobaltstrike_offensive_tool_keyword = "--format-string ziiiiizzzib " nocase ascii wide
$string1306_cobaltstrike_offensive_tool_keyword = "fortra/No-Consolation" nocase ascii wide
$string1307_cobaltstrike_offensive_tool_keyword = "fucksetuptools" nocase ascii wide
$string1308_cobaltstrike_offensive_tool_keyword = /FuckThatPacker\./ nocase ascii wide
$string1309_cobaltstrike_offensive_tool_keyword = "FunnyWolf/pystinger" nocase ascii wide
$string1310_cobaltstrike_offensive_tool_keyword = "fw_walk disable" nocase ascii wide
$string1311_cobaltstrike_offensive_tool_keyword = "G0ldenGunSec/GetWebDAVStatus" nocase ascii wide
$string1312_cobaltstrike_offensive_tool_keyword = /GadgetToJScript\.exe\s\-a\s/ nocase ascii wide
$string1313_cobaltstrike_offensive_tool_keyword = "Gality369/CS-Loader" nocase ascii wide
$string1314_cobaltstrike_offensive_tool_keyword = "gather/keylogger" nocase ascii wide
$string1315_cobaltstrike_offensive_tool_keyword = /geacon.{0,100}\/cmd\// nocase ascii wide
$string1316_cobaltstrike_offensive_tool_keyword = /genCrossC2\./ nocase ascii wide
$string1317_cobaltstrike_offensive_tool_keyword = "generate_beacon" nocase ascii wide
$string1318_cobaltstrike_offensive_tool_keyword = /generate\-rotating\-beacon\./ nocase ascii wide
$string1319_cobaltstrike_offensive_tool_keyword = "GeorgePatsias/ScareCrow" nocase ascii wide
$string1320_cobaltstrike_offensive_tool_keyword = "get_BeaconHealthCheck_settings" nocase ascii wide
$string1321_cobaltstrike_offensive_tool_keyword = "get_dns_dnsidle" nocase ascii wide
$string1322_cobaltstrike_offensive_tool_keyword = "get_dns_sleep" nocase ascii wide
$string1323_cobaltstrike_offensive_tool_keyword = /get_password_policy\.x64\./ nocase ascii wide
$string1324_cobaltstrike_offensive_tool_keyword = /get_password_policy\.x86\./ nocase ascii wide
$string1325_cobaltstrike_offensive_tool_keyword = "get_post_ex_pipename_list" nocase ascii wide
$string1326_cobaltstrike_offensive_tool_keyword = "get_post_ex_spawnto_x" nocase ascii wide
$string1327_cobaltstrike_offensive_tool_keyword = "get_process_inject_allocator" nocase ascii wide
$string1328_cobaltstrike_offensive_tool_keyword = "get_process_inject_bof_allocator" nocase ascii wide
$string1329_cobaltstrike_offensive_tool_keyword = "get_process_inject_execute" nocase ascii wide
$string1330_cobaltstrike_offensive_tool_keyword = "get_stage_allocator" nocase ascii wide
$string1331_cobaltstrike_offensive_tool_keyword = "get_stage_magic_mz_64" nocase ascii wide
$string1332_cobaltstrike_offensive_tool_keyword = "get_stage_magic_mz_86" nocase ascii wide
$string1333_cobaltstrike_offensive_tool_keyword = "get_stage_magic_pe" nocase ascii wide
$string1334_cobaltstrike_offensive_tool_keyword = "get_virtual_Hook_address" nocase ascii wide
$string1335_cobaltstrike_offensive_tool_keyword = "getAggressorClient" nocase ascii wide
$string1336_cobaltstrike_offensive_tool_keyword = "Get-BeaconAPI" nocase ascii wide
$string1337_cobaltstrike_offensive_tool_keyword = "Get-CachedRDPConnection" nocase ascii wide
$string1338_cobaltstrike_offensive_tool_keyword = "getCrossC2Beacon" nocase ascii wide
$string1339_cobaltstrike_offensive_tool_keyword = "getCrossC2Site" nocase ascii wide
$string1340_cobaltstrike_offensive_tool_keyword = "getdomainspnticket" nocase ascii wide
$string1341_cobaltstrike_offensive_tool_keyword = "Get-DomainSPNTicket" nocase ascii wide
$string1342_cobaltstrike_offensive_tool_keyword = "getexploitablesystem" nocase ascii wide
$string1343_cobaltstrike_offensive_tool_keyword = "Get-ExploitableSystem" nocase ascii wide
$string1344_cobaltstrike_offensive_tool_keyword = "GetHijackableDllName" nocase ascii wide
$string1345_cobaltstrike_offensive_tool_keyword = "GetNTLMChallengeBase64" nocase ascii wide
$string1346_cobaltstrike_offensive_tool_keyword = /GetShellcode\(/ nocase ascii wide
$string1347_cobaltstrike_offensive_tool_keyword = /GetWebDAVStatus\.csproj/ nocase ascii wide
$string1348_cobaltstrike_offensive_tool_keyword = /GetWebDAVStatus\.sln/ nocase ascii wide
$string1349_cobaltstrike_offensive_tool_keyword = "GetWebDAVStatus_DotNet" nocase ascii wide
$string1350_cobaltstrike_offensive_tool_keyword = /GetWebDAVStatus_x64\.o/ nocase ascii wide
$string1351_cobaltstrike_offensive_tool_keyword = "getwmiregcachedrdpconnection" nocase ascii wide
$string1352_cobaltstrike_offensive_tool_keyword = "Get-WMIRegCachedRDPConnection" nocase ascii wide
$string1353_cobaltstrike_offensive_tool_keyword = "getwmireglastloggedon" nocase ascii wide
$string1354_cobaltstrike_offensive_tool_keyword = "Get-WMIRegLastLoggedOn" nocase ascii wide
$string1355_cobaltstrike_offensive_tool_keyword = /gexplorer\.exe/ nocase ascii wide
$string1356_cobaltstrike_offensive_tool_keyword = "GhostPack/Koh" nocase ascii wide
$string1357_cobaltstrike_offensive_tool_keyword = /github.{0,100}\/MoveKit\.git/ nocase ascii wide
$string1358_cobaltstrike_offensive_tool_keyword = /github\.com\/k8gege/ nocase ascii wide
$string1359_cobaltstrike_offensive_tool_keyword = /github\.com\/rasta\-mouse\// nocase ascii wide
$string1360_cobaltstrike_offensive_tool_keyword = /github\.com\/SpiderLabs\// nocase ascii wide
$string1361_cobaltstrike_offensive_tool_keyword = "gloxec/CrossC2" nocase ascii wide
$string1362_cobaltstrike_offensive_tool_keyword = /go_shellcode_encode\.py/ nocase ascii wide
$string1363_cobaltstrike_offensive_tool_keyword = /go\-shellcode\.py/ nocase ascii wide
$string1364_cobaltstrike_offensive_tool_keyword = "goShellCodeByPassVT" nocase ascii wide
$string1365_cobaltstrike_offensive_tool_keyword = /hackbrowersdata\.cna/ nocase ascii wide
$string1366_cobaltstrike_offensive_tool_keyword = "hack-browser-data/" nocase ascii wide
$string1367_cobaltstrike_offensive_tool_keyword = /handlekatz\.x64\./ nocase ascii wide
$string1368_cobaltstrike_offensive_tool_keyword = /handlekatz_bof\./ nocase ascii wide
$string1369_cobaltstrike_offensive_tool_keyword = "Hangingsword/HouQing" nocase ascii wide
$string1370_cobaltstrike_offensive_tool_keyword = /Havoc\-UACBypass\.py/ nocase ascii wide
$string1371_cobaltstrike_offensive_tool_keyword = "hd-launch-cmd " nocase ascii wide
$string1372_cobaltstrike_offensive_tool_keyword = /headers\/exploit\.h/ nocase ascii wide
$string1373_cobaltstrike_offensive_tool_keyword = /headers\/HandleKatz\.h/ nocase ascii wide
$string1374_cobaltstrike_offensive_tool_keyword = "Henkru/cs-token-vault" nocase ascii wide
$string1375_cobaltstrike_offensive_tool_keyword = /Hidden\.Desktop\.mp4/ nocase ascii wide
$string1376_cobaltstrike_offensive_tool_keyword = /HiddenDesktop\s.{0,100}\s/ nocase ascii wide
$string1377_cobaltstrike_offensive_tool_keyword = /HiddenDesktop\./ nocase ascii wide
$string1378_cobaltstrike_offensive_tool_keyword = /HiddenDesktop\.x64\.bin/ nocase ascii wide
$string1379_cobaltstrike_offensive_tool_keyword = /HiddenDesktop\.x86\.bin/ nocase ascii wide
$string1380_cobaltstrike_offensive_tool_keyword = /HiddenDesktop\.zip/ nocase ascii wide
$string1381_cobaltstrike_offensive_tool_keyword = "hijack_hunter " nocase ascii wide
$string1382_cobaltstrike_offensive_tool_keyword = "hijack_remote_thread" nocase ascii wide
$string1383_cobaltstrike_offensive_tool_keyword = /HiveJack\-Console\.exe/ nocase ascii wide
$string1384_cobaltstrike_offensive_tool_keyword = /hollow\s.{0,100}\.exe\s.{0,100}\.bin/ nocase ascii wide
$string1385_cobaltstrike_offensive_tool_keyword = /hollower\.Hollow\(/ nocase ascii wide
$string1386_cobaltstrike_offensive_tool_keyword = /houqingv1\.0\.zip/ nocase ascii wide
$string1387_cobaltstrike_offensive_tool_keyword = /html\/js\/beacons\.js/ nocase ascii wide
$string1388_cobaltstrike_offensive_tool_keyword = /http.{0,100}\/zha0gongz1/ nocase ascii wide
$string1389_cobaltstrike_offensive_tool_keyword = /http.{0,100}\:3200\/manjusaka/ nocase ascii wide
$string1390_cobaltstrike_offensive_tool_keyword = /http.{0,100}\:801\/bq1iFEP2/ nocase ascii wide
$string1391_cobaltstrike_offensive_tool_keyword = /http\:\/\/127\.0\.0\.1\:8000\/1\.jpg/ nocase ascii wide
$string1392_cobaltstrike_offensive_tool_keyword = "http_stager_client_header" nocase ascii wide
$string1393_cobaltstrike_offensive_tool_keyword = "http_stager_server_append" nocase ascii wide
$string1394_cobaltstrike_offensive_tool_keyword = "http_stager_server_header" nocase ascii wide
$string1395_cobaltstrike_offensive_tool_keyword = "http_stager_server_prepend" nocase ascii wide
$string1396_cobaltstrike_offensive_tool_keyword = "http_stager_uri_x64" nocase ascii wide
$string1397_cobaltstrike_offensive_tool_keyword = "http_stager_uri_x86" nocase ascii wide
$string1398_cobaltstrike_offensive_tool_keyword = /http1\.x64\.bin/ nocase ascii wide
$string1399_cobaltstrike_offensive_tool_keyword = /http1\.x64\.dll/ nocase ascii wide
$string1400_cobaltstrike_offensive_tool_keyword = /httpattack\.py/ nocase ascii wide
$string1401_cobaltstrike_offensive_tool_keyword = /httppayload\.bin/ nocase ascii wide
$string1402_cobaltstrike_offensive_tool_keyword = "http-redwarden" nocase ascii wide
$string1403_cobaltstrike_offensive_tool_keyword = /httprelayclient\.py/ nocase ascii wide
$string1404_cobaltstrike_offensive_tool_keyword = /httprelayserver\.py/ nocase ascii wide
$string1405_cobaltstrike_offensive_tool_keyword = "'http-stager'" nocase ascii wide
$string1406_cobaltstrike_offensive_tool_keyword = /HVNC\sServer\.exe/ nocase ascii wide
$string1407_cobaltstrike_offensive_tool_keyword = /HVNC\\\sServer/ nocase ascii wide
$string1408_cobaltstrike_offensive_tool_keyword = "IcebreakerSecurity/DelegationBOF" nocase ascii wide
$string1409_cobaltstrike_offensive_tool_keyword = "IcebreakerSecurity/PersistBOF" nocase ascii wide
$string1410_cobaltstrike_offensive_tool_keyword = "icyguider/UAC-BOF-Bonanza" nocase ascii wide
$string1411_cobaltstrike_offensive_tool_keyword = /imapattack\.py/ nocase ascii wide
$string1412_cobaltstrike_offensive_tool_keyword = /imaprelayclient\.py/ nocase ascii wide
$string1413_cobaltstrike_offensive_tool_keyword = /impacket\./ nocase ascii wide
$string1414_cobaltstrike_offensive_tool_keyword = "ImpersonateLocalService" nocase ascii wide
$string1415_cobaltstrike_offensive_tool_keyword = /import\spe\.OBJExecutable/ nocase ascii wide
$string1416_cobaltstrike_offensive_tool_keyword = /include\sbeacon\.h/ nocase ascii wide
$string1417_cobaltstrike_offensive_tool_keyword = /include\sinjection\.c/ nocase ascii wide
$string1418_cobaltstrike_offensive_tool_keyword = "inject-amsiBypass " nocase ascii wide
$string1419_cobaltstrike_offensive_tool_keyword = /inject\-amsiBypass\./ nocase ascii wide
$string1420_cobaltstrike_offensive_tool_keyword = "inject-assembly " nocase ascii wide
$string1421_cobaltstrike_offensive_tool_keyword = /inject\-assembly\.cna/ nocase ascii wide
$string1422_cobaltstrike_offensive_tool_keyword = /injectassembly\.x64\.bin/ nocase ascii wide
$string1423_cobaltstrike_offensive_tool_keyword = /injectassembly\.x64\.o/ nocase ascii wide
$string1424_cobaltstrike_offensive_tool_keyword = "injectEtwBypass" nocase ascii wide
$string1425_cobaltstrike_offensive_tool_keyword = "InjectShellcode" nocase ascii wide
$string1426_cobaltstrike_offensive_tool_keyword = "inline-execute " nocase ascii wide
$string1427_cobaltstrike_offensive_tool_keyword = /inline\-execute.{0,100}whereami\.x64/ nocase ascii wide
$string1428_cobaltstrike_offensive_tool_keyword = "InlineExecute-Assembly" nocase ascii wide
$string1429_cobaltstrike_offensive_tool_keyword = /InlineWhispers\.py/ nocase ascii wide
$string1430_cobaltstrike_offensive_tool_keyword = "InlineWhispers2" nocase ascii wide
$string1431_cobaltstrike_offensive_tool_keyword = "install impacket" nocase ascii wide
$string1432_cobaltstrike_offensive_tool_keyword = "InvokeBloodHound" nocase ascii wide
$string1433_cobaltstrike_offensive_tool_keyword = "Invoke-Bof " nocase ascii wide
$string1434_cobaltstrike_offensive_tool_keyword = /Invoke\-Bof\.ps1/ nocase ascii wide
$string1435_cobaltstrike_offensive_tool_keyword = "invokechecklocaladminaccess" nocase ascii wide
$string1436_cobaltstrike_offensive_tool_keyword = "Invoke-CheckLocalAdminAccess" nocase ascii wide
$string1437_cobaltstrike_offensive_tool_keyword = "invokeenumeratelocaladmin" nocase ascii wide
$string1438_cobaltstrike_offensive_tool_keyword = "Invoke-EnumerateLocalAdmin" nocase ascii wide
$string1439_cobaltstrike_offensive_tool_keyword = /Invoke\-EnvBypass\./ nocase ascii wide
$string1440_cobaltstrike_offensive_tool_keyword = "Invoke-EventVwrBypass" nocase ascii wide
$string1441_cobaltstrike_offensive_tool_keyword = "invokefilefinder" nocase ascii wide
$string1442_cobaltstrike_offensive_tool_keyword = "Invoke-FileFinder" nocase ascii wide
$string1443_cobaltstrike_offensive_tool_keyword = "Invoke-HostEnum -" nocase ascii wide
$string1444_cobaltstrike_offensive_tool_keyword = "invokekerberoast" nocase ascii wide
$string1445_cobaltstrike_offensive_tool_keyword = "Invoke-Kerberoast" nocase ascii wide
$string1446_cobaltstrike_offensive_tool_keyword = "Invoke-ParentalKilling" nocase ascii wide
$string1447_cobaltstrike_offensive_tool_keyword = "Invoke-Phant0m" nocase ascii wide
$string1448_cobaltstrike_offensive_tool_keyword = /Invoke\-Phant0m\.ps1/ nocase ascii wide
$string1449_cobaltstrike_offensive_tool_keyword = "invokeprocesshunter" nocase ascii wide
$string1450_cobaltstrike_offensive_tool_keyword = "Invoke-ProcessHunter" nocase ascii wide
$string1451_cobaltstrike_offensive_tool_keyword = "invokereverttoself" nocase ascii wide
$string1452_cobaltstrike_offensive_tool_keyword = "Invoke-RevertToSelf" nocase ascii wide
$string1453_cobaltstrike_offensive_tool_keyword = "invokesharefinder" nocase ascii wide
$string1454_cobaltstrike_offensive_tool_keyword = "Invoke-ShareFinder" nocase ascii wide
$string1455_cobaltstrike_offensive_tool_keyword = "invokestealthuserhunter" nocase ascii wide
$string1456_cobaltstrike_offensive_tool_keyword = "Invoke-StealthUserHunter" nocase ascii wide
$string1457_cobaltstrike_offensive_tool_keyword = "invokeuserhunter" nocase ascii wide
$string1458_cobaltstrike_offensive_tool_keyword = "Invoke-UserHunter" nocase ascii wide
$string1459_cobaltstrike_offensive_tool_keyword = "Invoke-WScriptBypassUAC" nocase ascii wide
$string1460_cobaltstrike_offensive_tool_keyword = /Invoking\sCreateSvcRpc\s\(by\s\@x86matthew\)/ nocase ascii wide
$string1461_cobaltstrike_offensive_tool_keyword = "jas502n/bypassAV" nocase ascii wide
$string1462_cobaltstrike_offensive_tool_keyword = /java\s\-jar\sBeaconTool\.jar/ nocase ascii wide
$string1463_cobaltstrike_offensive_tool_keyword = /java\s\-jar\sBeaconTool\.jar/ nocase ascii wide
$string1464_cobaltstrike_offensive_tool_keyword = "Job killed and console drained" nocase ascii wide
$string1465_cobaltstrike_offensive_tool_keyword = /jquery\-c2\..{0,100}\.profile/ nocase ascii wide
$string1466_cobaltstrike_offensive_tool_keyword = "jump psexec_psh" nocase ascii wide
$string1467_cobaltstrike_offensive_tool_keyword = "jump psexec64" nocase ascii wide
$string1468_cobaltstrike_offensive_tool_keyword = "jump winrm " nocase ascii wide
$string1469_cobaltstrike_offensive_tool_keyword = "jump winrm" nocase ascii wide
$string1470_cobaltstrike_offensive_tool_keyword = "jump-exec scshell" nocase ascii wide
$string1471_cobaltstrike_offensive_tool_keyword = /K8_CS_.{0,100}\.rar/ nocase ascii wide
$string1472_cobaltstrike_offensive_tool_keyword = /k8gege\.org\// nocase ascii wide
$string1473_cobaltstrike_offensive_tool_keyword = "k8gege/Ladon" nocase ascii wide
$string1474_cobaltstrike_offensive_tool_keyword = /K8Ladon\.sln/ nocase ascii wide
$string1475_cobaltstrike_offensive_tool_keyword = /KaliLadon\./ nocase ascii wide
$string1476_cobaltstrike_offensive_tool_keyword = /KBDPAYLOAD\.dll/ nocase ascii wide
$string1477_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/CHECK/ nocase ascii wide
$string1478_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/CLOSE/ nocase ascii wide
$string1479_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/DRIVER/ nocase ascii wide
$string1480_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/KILL/ nocase ascii wide
$string1481_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/LIST/ nocase ascii wide
$string1482_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/NAME/ nocase ascii wide
$string1483_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/PID/ nocase ascii wide
$string1484_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/SERVICE/ nocase ascii wide
$string1485_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/STRIP/ nocase ascii wide
$string1486_cobaltstrike_offensive_tool_keyword = /kdstab\s.{0,100}\s\/UNLOAD/ nocase ascii wide
$string1487_cobaltstrike_offensive_tool_keyword = /kdstab\.cna/ nocase ascii wide
$string1488_cobaltstrike_offensive_tool_keyword = /kerberoasting\.x64/ nocase ascii wide
$string1489_cobaltstrike_offensive_tool_keyword = /Kerberos\sabuse\s\(kerbeus\sBOF\)/ nocase ascii wide
$string1490_cobaltstrike_offensive_tool_keyword = /kerberos.{0,100}\.kirbi/ nocase ascii wide
$string1491_cobaltstrike_offensive_tool_keyword = /Kerbeus\s.{0,100}\sby\sRalfHacker/ nocase ascii wide
$string1492_cobaltstrike_offensive_tool_keyword = /kerbeus_cs\.cna/ nocase ascii wide
$string1493_cobaltstrike_offensive_tool_keyword = /kerbeus_havoc\.py/ nocase ascii wide
$string1494_cobaltstrike_offensive_tool_keyword = "Kerbeus-BOF-main" nocase ascii wide
$string1495_cobaltstrike_offensive_tool_keyword = /kernelcallbacktable\.x64/ nocase ascii wide
$string1496_cobaltstrike_offensive_tool_keyword = /kernelcallbacktable\.x64/ nocase ascii wide
$string1497_cobaltstrike_offensive_tool_keyword = /kernelcallbacktable\.x86/ nocase ascii wide
$string1498_cobaltstrike_offensive_tool_keyword = /kernelcallbacktable\.x86/ nocase ascii wide
$string1499_cobaltstrike_offensive_tool_keyword = /KernelMii\.cna/ nocase ascii wide
$string1500_cobaltstrike_offensive_tool_keyword = /KernelMii\.x64\.exe/ nocase ascii wide
$string1501_cobaltstrike_offensive_tool_keyword = /KernelMii\.x64\.o/ nocase ascii wide
$string1502_cobaltstrike_offensive_tool_keyword = /KernelMii\.x86\.exe/ nocase ascii wide
$string1503_cobaltstrike_offensive_tool_keyword = /KernelMii\.x86\.o/ nocase ascii wide
$string1504_cobaltstrike_offensive_tool_keyword = "killdefender check" nocase ascii wide
$string1505_cobaltstrike_offensive_tool_keyword = "killdefender kill" nocase ascii wide
$string1506_cobaltstrike_offensive_tool_keyword = /KillDefender\.x64/ nocase ascii wide
$string1507_cobaltstrike_offensive_tool_keyword = /KillDefender\.x64\./ nocase ascii wide
$string1508_cobaltstrike_offensive_tool_keyword = "killdefender_bof" nocase ascii wide
$string1509_cobaltstrike_offensive_tool_keyword = "KillDefender_BOF" nocase ascii wide
$string1510_cobaltstrike_offensive_tool_keyword = /kirbi\.tickets/ nocase ascii wide
$string1511_cobaltstrike_offensive_tool_keyword = "koh filter add SID" nocase ascii wide
$string1512_cobaltstrike_offensive_tool_keyword = "koh filter list" nocase ascii wide
$string1513_cobaltstrike_offensive_tool_keyword = "koh filter remove SID" nocase ascii wide
$string1514_cobaltstrike_offensive_tool_keyword = "koh filter reset" nocase ascii wide
$string1515_cobaltstrike_offensive_tool_keyword = "koh groups LUID" nocase ascii wide
$string1516_cobaltstrike_offensive_tool_keyword = "koh impersonate LUID" nocase ascii wide
$string1517_cobaltstrike_offensive_tool_keyword = "koh release all" nocase ascii wide
$string1518_cobaltstrike_offensive_tool_keyword = "koh release LUID" nocase ascii wide
$string1519_cobaltstrike_offensive_tool_keyword = /Koh\.exe\scapture/ nocase ascii wide
$string1520_cobaltstrike_offensive_tool_keyword = /Koh\.exe\slist/ nocase ascii wide
$string1521_cobaltstrike_offensive_tool_keyword = /Koh\.exe\smonitor/ nocase ascii wide
$string1522_cobaltstrike_offensive_tool_keyword = "krb_asktgs /" nocase ascii wide
$string1523_cobaltstrike_offensive_tool_keyword = "krb_asktgt /" nocase ascii wide
$string1524_cobaltstrike_offensive_tool_keyword = "krb_asreproasting" nocase ascii wide
$string1525_cobaltstrike_offensive_tool_keyword = "krb_changepw /" nocase ascii wide
$string1526_cobaltstrike_offensive_tool_keyword = "krb_cross_s4u /" nocase ascii wide
$string1527_cobaltstrike_offensive_tool_keyword = "krb_describe /" nocase ascii wide
$string1528_cobaltstrike_offensive_tool_keyword = "krb_dump /" nocase ascii wide
$string1529_cobaltstrike_offensive_tool_keyword = "krb_hash /password" nocase ascii wide
$string1530_cobaltstrike_offensive_tool_keyword = "krb_klist /" nocase ascii wide
$string1531_cobaltstrike_offensive_tool_keyword = "krb_ptt /ticket:" nocase ascii wide
$string1532_cobaltstrike_offensive_tool_keyword = "krb_purge /" nocase ascii wide
$string1533_cobaltstrike_offensive_tool_keyword = "krb_renew /ticket:" nocase ascii wide
$string1534_cobaltstrike_offensive_tool_keyword = "krb_s4u /" nocase ascii wide
$string1535_cobaltstrike_offensive_tool_keyword = "krb_tgtdeleg /" nocase ascii wide
$string1536_cobaltstrike_offensive_tool_keyword = /krb_tgtdeleg\(.{0,100}\)/ nocase ascii wide
$string1537_cobaltstrike_offensive_tool_keyword = "krb_triage /" nocase ascii wide
$string1538_cobaltstrike_offensive_tool_keyword = /krb5\/kerberosv5\.py/ nocase ascii wide
$string1539_cobaltstrike_offensive_tool_keyword = "krbasktgt /" nocase ascii wide
$string1540_cobaltstrike_offensive_tool_keyword = /krbcredccache\.py/ nocase ascii wide
$string1541_cobaltstrike_offensive_tool_keyword = "kyleavery/AceLdr" nocase ascii wide
$string1542_cobaltstrike_offensive_tool_keyword = "kyleavery/inject-assembly" nocase ascii wide
$string1543_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}\sAllScan/ nocase ascii wide
$string1544_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}\sCiscoScan/ nocase ascii wide
$string1545_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}\sOnlineIP/ nocase ascii wide
$string1546_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}\sOnlinePC/ nocase ascii wide
$string1547_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}\sOsScan/ nocase ascii wide
$string1548_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}\sOxidScan/ nocase ascii wide
$string1549_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}\.txt\s/ nocase ascii wide
$string1550_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}DeBase64/ nocase ascii wide
$string1551_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}FtpScan/ nocase ascii wide
$string1552_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}LdapScan/ nocase ascii wide
$string1553_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}SMBGhost/ nocase ascii wide
$string1554_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}SmbHashScan/ nocase ascii wide
$string1555_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}SmbScan/ nocase ascii wide
$string1556_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}SshScan/ nocase ascii wide
$string1557_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}TomcatScan/ nocase ascii wide
$string1558_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}VncScan/ nocase ascii wide
$string1559_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}WebScan/ nocase ascii wide
$string1560_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}WinrmScan/ nocase ascii wide
$string1561_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}WmiHashScan/ nocase ascii wide
$string1562_cobaltstrike_offensive_tool_keyword = /Ladon\s.{0,100}WmiScan/ nocase ascii wide
$string1563_cobaltstrike_offensive_tool_keyword = "Ladon ActiveAdmin" nocase ascii wide
$string1564_cobaltstrike_offensive_tool_keyword = "Ladon ActiveGuest" nocase ascii wide
$string1565_cobaltstrike_offensive_tool_keyword = "Ladon AdiDnsDump " nocase ascii wide
$string1566_cobaltstrike_offensive_tool_keyword = "Ladon at c:" nocase ascii wide
$string1567_cobaltstrike_offensive_tool_keyword = "Ladon AtExec" nocase ascii wide
$string1568_cobaltstrike_offensive_tool_keyword = "Ladon AutoRun" nocase ascii wide
$string1569_cobaltstrike_offensive_tool_keyword = "Ladon BadPotato" nocase ascii wide
$string1570_cobaltstrike_offensive_tool_keyword = "Ladon BypassUAC" nocase ascii wide
$string1571_cobaltstrike_offensive_tool_keyword = "Ladon CheckDoor" nocase ascii wide
$string1572_cobaltstrike_offensive_tool_keyword = "Ladon Clslog" nocase ascii wide
$string1573_cobaltstrike_offensive_tool_keyword = "Ladon CmdDll " nocase ascii wide
$string1574_cobaltstrike_offensive_tool_keyword = "Ladon cmdline" nocase ascii wide
$string1575_cobaltstrike_offensive_tool_keyword = "Ladon CVE-" nocase ascii wide
$string1576_cobaltstrike_offensive_tool_keyword = "Ladon DirList" nocase ascii wide
$string1577_cobaltstrike_offensive_tool_keyword = "Ladon DraytekExp" nocase ascii wide
$string1578_cobaltstrike_offensive_tool_keyword = "Ladon DumpLsass" nocase ascii wide
$string1579_cobaltstrike_offensive_tool_keyword = "Ladon EnableDotNet" nocase ascii wide
$string1580_cobaltstrike_offensive_tool_keyword = "Ladon EnumProcess" nocase ascii wide
$string1581_cobaltstrike_offensive_tool_keyword = "Ladon EnumShare" nocase ascii wide
$string1582_cobaltstrike_offensive_tool_keyword = "Ladon Exploit" nocase ascii wide
$string1583_cobaltstrike_offensive_tool_keyword = "Ladon FindIP " nocase ascii wide
$string1584_cobaltstrike_offensive_tool_keyword = "Ladon FirefoxCookie" nocase ascii wide
$string1585_cobaltstrike_offensive_tool_keyword = "Ladon FirefoxHistory" nocase ascii wide
$string1586_cobaltstrike_offensive_tool_keyword = "Ladon FirefoxPwd" nocase ascii wide
$string1587_cobaltstrike_offensive_tool_keyword = "Ladon ForExec " nocase ascii wide
$string1588_cobaltstrike_offensive_tool_keyword = "Ladon FtpDownLoad " nocase ascii wide
$string1589_cobaltstrike_offensive_tool_keyword = "Ladon FtpServer " nocase ascii wide
$string1590_cobaltstrike_offensive_tool_keyword = "Ladon GetDomainIP" nocase ascii wide
$string1591_cobaltstrike_offensive_tool_keyword = "Ladon gethtml " nocase ascii wide
$string1592_cobaltstrike_offensive_tool_keyword = "Ladon GetPipe" nocase ascii wide
$string1593_cobaltstrike_offensive_tool_keyword = "Ladon GetSystem" nocase ascii wide
$string1594_cobaltstrike_offensive_tool_keyword = "Ladon IISdoor" nocase ascii wide
$string1595_cobaltstrike_offensive_tool_keyword = "Ladon IISpwd" nocase ascii wide
$string1596_cobaltstrike_offensive_tool_keyword = "Ladon MssqlCmd " nocase ascii wide
$string1597_cobaltstrike_offensive_tool_keyword = "Ladon netsh " nocase ascii wide
$string1598_cobaltstrike_offensive_tool_keyword = "Ladon noping " nocase ascii wide
$string1599_cobaltstrike_offensive_tool_keyword = "Ladon Open3389" nocase ascii wide
$string1600_cobaltstrike_offensive_tool_keyword = "Ladon PowerCat " nocase ascii wide
$string1601_cobaltstrike_offensive_tool_keyword = "Ladon PrintNightmare" nocase ascii wide
$string1602_cobaltstrike_offensive_tool_keyword = "Ladon psexec" nocase ascii wide
$string1603_cobaltstrike_offensive_tool_keyword = "Ladon QueryAdmin" nocase ascii wide
$string1604_cobaltstrike_offensive_tool_keyword = "Ladon RdpHijack" nocase ascii wide
$string1605_cobaltstrike_offensive_tool_keyword = "Ladon ReadFile " nocase ascii wide
$string1606_cobaltstrike_offensive_tool_keyword = "Ladon RegAuto" nocase ascii wide
$string1607_cobaltstrike_offensive_tool_keyword = "Ladon ReverseHttps" nocase ascii wide
$string1608_cobaltstrike_offensive_tool_keyword = "Ladon ReverseTcp " nocase ascii wide
$string1609_cobaltstrike_offensive_tool_keyword = "Ladon RevShell-" nocase ascii wide
$string1610_cobaltstrike_offensive_tool_keyword = "Ladon Runas" nocase ascii wide
$string1611_cobaltstrike_offensive_tool_keyword = "Ladon RunPS " nocase ascii wide
$string1612_cobaltstrike_offensive_tool_keyword = "Ladon sc " nocase ascii wide
$string1613_cobaltstrike_offensive_tool_keyword = "Ladon SetSignAuth" nocase ascii wide
$string1614_cobaltstrike_offensive_tool_keyword = "Ladon SmbExec " nocase ascii wide
$string1615_cobaltstrike_offensive_tool_keyword = "Ladon Sniffer" nocase ascii wide
$string1616_cobaltstrike_offensive_tool_keyword = "Ladon SshExec " nocase ascii wide
$string1617_cobaltstrike_offensive_tool_keyword = "Ladon SweetPotato" nocase ascii wide
$string1618_cobaltstrike_offensive_tool_keyword = "Ladon TcpServer " nocase ascii wide
$string1619_cobaltstrike_offensive_tool_keyword = "Ladon UdpServer" nocase ascii wide
$string1620_cobaltstrike_offensive_tool_keyword = "Ladon WebShell" nocase ascii wide
$string1621_cobaltstrike_offensive_tool_keyword = "Ladon whoami" nocase ascii wide
$string1622_cobaltstrike_offensive_tool_keyword = "Ladon WifiPwd" nocase ascii wide
$string1623_cobaltstrike_offensive_tool_keyword = "Ladon wmiexec" nocase ascii wide
$string1624_cobaltstrike_offensive_tool_keyword = "Ladon WmiExec2 " nocase ascii wide
$string1625_cobaltstrike_offensive_tool_keyword = "Ladon XshellPwd" nocase ascii wide
$string1626_cobaltstrike_offensive_tool_keyword = "Ladon ZeroLogon" nocase ascii wide
$string1627_cobaltstrike_offensive_tool_keyword = "Ladon40 BypassUAC" nocase ascii wide
$string1628_cobaltstrike_offensive_tool_keyword = /Ladon911.{0,100}\.ps1/ nocase ascii wide
$string1629_cobaltstrike_offensive_tool_keyword = /Ladon911\.exe/ nocase ascii wide
$string1630_cobaltstrike_offensive_tool_keyword = /Ladon911_.{0,100}\.rar/ nocase ascii wide
$string1631_cobaltstrike_offensive_tool_keyword = /LadonExp\.exe/ nocase ascii wide
$string1632_cobaltstrike_offensive_tool_keyword = /LadonGUI\.exe/ nocase ascii wide
$string1633_cobaltstrike_offensive_tool_keyword = /LadonLib\.rar/ nocase ascii wide
$string1634_cobaltstrike_offensive_tool_keyword = /LadonStudy\.exe/ nocase ascii wide
$string1635_cobaltstrike_offensive_tool_keyword = /lastpass\.x86/ nocase ascii wide
$string1636_cobaltstrike_offensive_tool_keyword = /lastpass\/process_lp_files\.py/ nocase ascii wide
$string1637_cobaltstrike_offensive_tool_keyword = /ldap_shell\.py/ nocase ascii wide
$string1638_cobaltstrike_offensive_tool_keyword = /ldapattack\.py/ nocase ascii wide
$string1639_cobaltstrike_offensive_tool_keyword = /ldaprelayclient\.py/ nocase ascii wide
$string1640_cobaltstrike_offensive_tool_keyword = /LdapSignCheck\.exe/ nocase ascii wide
$string1641_cobaltstrike_offensive_tool_keyword = /LdapSignCheck\.Natives/ nocase ascii wide
$string1642_cobaltstrike_offensive_tool_keyword = /LdapSignCheck\.sln/ nocase ascii wide
$string1643_cobaltstrike_offensive_tool_keyword = /ldapsigncheck\.x64\./ nocase ascii wide
$string1644_cobaltstrike_offensive_tool_keyword = /ldapsigncheck\.x86\./ nocase ascii wide
$string1645_cobaltstrike_offensive_tool_keyword = /LetMeOutSharp\./ nocase ascii wide
$string1646_cobaltstrike_offensive_tool_keyword = "libs/bofalloc" nocase ascii wide
$string1647_cobaltstrike_offensive_tool_keyword = "libs/bofentry" nocase ascii wide
$string1648_cobaltstrike_offensive_tool_keyword = "libs/bofhelper" nocase ascii wide
$string1649_cobaltstrike_offensive_tool_keyword = /LiquidSnake\.exe/ nocase ascii wide
$string1650_cobaltstrike_offensive_tool_keyword = "llsrpc_##" nocase ascii wide
$string1651_cobaltstrike_offensive_tool_keyword = "load aggressor script" nocase ascii wide
$string1652_cobaltstrike_offensive_tool_keyword = /load_sc\.exe\s.{0,100}\.bin/ nocase ascii wide
$string1653_cobaltstrike_offensive_tool_keyword = "Load-BeaconParameters" nocase ascii wide
$string1654_cobaltstrike_offensive_tool_keyword = /Load\-Bof\(/ nocase ascii wide
$string1655_cobaltstrike_offensive_tool_keyword = /loader\/loader\/loader\.c/ nocase ascii wide
$string1656_cobaltstrike_offensive_tool_keyword = /localS4U2Proxy\.tickets/ nocase ascii wide
$string1657_cobaltstrike_offensive_tool_keyword = "logToBeaconLog" nocase ascii wide
$string1658_cobaltstrike_offensive_tool_keyword = "lsarpc_##" nocase ascii wide
$string1659_cobaltstrike_offensive_tool_keyword = "Magnitude Exploit Kit" nocase ascii wide
$string1660_cobaltstrike_offensive_tool_keyword = /main_air_service\-probes\.go/ nocase ascii wide
$string1661_cobaltstrike_offensive_tool_keyword = /main_pro_service\-probes\.go/ nocase ascii wide
$string1662_cobaltstrike_offensive_tool_keyword = /makebof\.bat/ nocase ascii wide
$string1663_cobaltstrike_offensive_tool_keyword = "Malleable C2 Files" nocase ascii wide
$string1664_cobaltstrike_offensive_tool_keyword = "Malleable PE/Stage" nocase ascii wide
$string1665_cobaltstrike_offensive_tool_keyword = /malleable_redirector\.py/ nocase ascii wide
$string1666_cobaltstrike_offensive_tool_keyword = "malleable_redirector_hidden_api_endpoint" nocase ascii wide
$string1667_cobaltstrike_offensive_tool_keyword = "Malleable-C2-Profiles" nocase ascii wide
$string1668_cobaltstrike_offensive_tool_keyword = "Malleable-C2-Randomizer" nocase ascii wide
$string1669_cobaltstrike_offensive_tool_keyword = "Malleable-C2-Randomizer" nocase ascii wide
$string1670_cobaltstrike_offensive_tool_keyword = "malleable-redirector-config" nocase ascii wide
$string1671_cobaltstrike_offensive_tool_keyword = "mandllinject " nocase ascii wide
$string1672_cobaltstrike_offensive_tool_keyword = "mdsecactivebreach/CACTUSTORCH" nocase ascii wide
$string1673_cobaltstrike_offensive_tool_keyword = "med0x2e/SigFlip" nocase ascii wide
$string1674_cobaltstrike_offensive_tool_keyword = /memreader\s.{0,100}access_token/ nocase ascii wide
$string1675_cobaltstrike_offensive_tool_keyword = /MemReader_BoF\./ nocase ascii wide
$string1676_cobaltstrike_offensive_tool_keyword = /meterpreter\./ nocase ascii wide
$string1677_cobaltstrike_offensive_tool_keyword = /metsrv\.dll/ nocase ascii wide
$string1678_cobaltstrike_offensive_tool_keyword = "mgeeky/RedWarden" nocase ascii wide
$string1679_cobaltstrike_offensive_tool_keyword = /mimipenguin\.cna/ nocase ascii wide
$string1680_cobaltstrike_offensive_tool_keyword = /mimipenguin\.so/ nocase ascii wide
$string1681_cobaltstrike_offensive_tool_keyword = /mimipenguin_x32\.so/ nocase ascii wide
$string1682_cobaltstrike_offensive_tool_keyword = "minidump_add_memory_block" nocase ascii wide
$string1683_cobaltstrike_offensive_tool_keyword = "minidump_add_memory64_block" nocase ascii wide
$string1684_cobaltstrike_offensive_tool_keyword = "miscbackdoorlnkhelp" nocase ascii wide
$string1685_cobaltstrike_offensive_tool_keyword = /Mockingjay_BOF\.sln/ nocase ascii wide
$string1686_cobaltstrike_offensive_tool_keyword = "Mockingjay_BOF-main" nocase ascii wide
$string1687_cobaltstrike_offensive_tool_keyword = "mojo_##" nocase ascii wide
$string1688_cobaltstrike_offensive_tool_keyword = "moonD4rk/HackBrowserData" nocase ascii wide
$string1689_cobaltstrike_offensive_tool_keyword = /MoveKit\-master\.zip/ nocase ascii wide
$string1690_cobaltstrike_offensive_tool_keyword = /move\-msbuild\s.{0,100}\shttp\smove\.csproj/ nocase ascii wide
$string1691_cobaltstrike_offensive_tool_keyword = /move\-pre\-custom\-file\s.{0,100}\.exe\s/ nocase ascii wide
$string1692_cobaltstrike_offensive_tool_keyword = "msfvemonpayload" nocase ascii wide
$string1693_cobaltstrike_offensive_tool_keyword = /mssqlattack\.py/ nocase ascii wide
$string1694_cobaltstrike_offensive_tool_keyword = /mssqlrelayclient\.py/ nocase ascii wide
$string1695_cobaltstrike_offensive_tool_keyword = "my_dump_my_pe" nocase ascii wide
$string1696_cobaltstrike_offensive_tool_keyword = /needle_sift\.x64/ nocase ascii wide
$string1697_cobaltstrike_offensive_tool_keyword = /needlesift\.cna/ nocase ascii wide
$string1698_cobaltstrike_offensive_tool_keyword = "netero1010/Quser-BOF" nocase ascii wide
$string1699_cobaltstrike_offensive_tool_keyword = "netero1010/ServiceMove-BOF" nocase ascii wide
$string1700_cobaltstrike_offensive_tool_keyword = "netlogon_##" nocase ascii wide
$string1701_cobaltstrike_offensive_tool_keyword = "netuser_enum" nocase ascii wide
$string1702_cobaltstrike_offensive_tool_keyword = "netview_enum" nocase ascii wide
$string1703_cobaltstrike_offensive_tool_keyword = /NoApiUser\.exe/ nocase ascii wide
$string1704_cobaltstrike_offensive_tool_keyword = "noconsolation /tmp/" nocase ascii wide
$string1705_cobaltstrike_offensive_tool_keyword = /noconsolation\s\-\-local\s.{0,100}cmd\.exe/ nocase ascii wide
$string1706_cobaltstrike_offensive_tool_keyword = /noconsolation\s\-\-local\s.{0,100}powershell\.exe/ nocase ascii wide
$string1707_cobaltstrike_offensive_tool_keyword = /No\-Consolation\.cna/ nocase ascii wide
$string1708_cobaltstrike_offensive_tool_keyword = /NoConsolation\.x64\.o/ nocase ascii wide
$string1709_cobaltstrike_offensive_tool_keyword = /NoConsolation\.x86\.o/ nocase ascii wide
$string1710_cobaltstrike_offensive_tool_keyword = "No-Consolation-main" nocase ascii wide
$string1711_cobaltstrike_offensive_tool_keyword = /normal\/randomized\.profile/ nocase ascii wide
$string1712_cobaltstrike_offensive_tool_keyword = /ntcreatethread\.x64/ nocase ascii wide
$string1713_cobaltstrike_offensive_tool_keyword = /ntcreatethread\.x86/ nocase ascii wide
$string1714_cobaltstrike_offensive_tool_keyword = /oab\-parse\.py/ nocase ascii wide
$string1715_cobaltstrike_offensive_tool_keyword = "obscuritylabs/ase:latest" nocase ascii wide
$string1716_cobaltstrike_offensive_tool_keyword = "obscuritylabs/RAI/" nocase ascii wide
$string1717_cobaltstrike_offensive_tool_keyword = "Octoberfest7/KDStab" nocase ascii wide
$string1718_cobaltstrike_offensive_tool_keyword = "OG-Sadpanda/SharpCat" nocase ascii wide
$string1719_cobaltstrike_offensive_tool_keyword = "OG-Sadpanda/SharpSword" nocase ascii wide
$string1720_cobaltstrike_offensive_tool_keyword = "OG-Sadpanda/SharpZippo" nocase ascii wide
$string1721_cobaltstrike_offensive_tool_keyword = /On_Demand_C2\./ nocase ascii wide
$string1722_cobaltstrike_offensive_tool_keyword = /On\-Demand_C2_BOF\./ nocase ascii wide
$string1723_cobaltstrike_offensive_tool_keyword = /OnDemandC2Class\.cs/ nocase ascii wide
$string1724_cobaltstrike_offensive_tool_keyword = "openBeaconBrowser" nocase ascii wide
$string1725_cobaltstrike_offensive_tool_keyword = "openBeaconBrowser" nocase ascii wide
$string1726_cobaltstrike_offensive_tool_keyword = "openBeaconConsole" nocase ascii wide
$string1727_cobaltstrike_offensive_tool_keyword = "openBeaconConsole" nocase ascii wide
$string1728_cobaltstrike_offensive_tool_keyword = "openBypassUACDialog" nocase ascii wide
$string1729_cobaltstrike_offensive_tool_keyword = "openBypassUACDialog" nocase ascii wide
$string1730_cobaltstrike_offensive_tool_keyword = "openGoldenTicketDialog" nocase ascii wide
$string1731_cobaltstrike_offensive_tool_keyword = "openKeystrokeBrowser" nocase ascii wide
$string1732_cobaltstrike_offensive_tool_keyword = "openPayloadGenerator" nocase ascii wide
$string1733_cobaltstrike_offensive_tool_keyword = "openPayloadGeneratorDialog" nocase ascii wide
$string1734_cobaltstrike_offensive_tool_keyword = "openPayloadHelper" nocase ascii wide
$string1735_cobaltstrike_offensive_tool_keyword = "openPortScanner" nocase ascii wide
$string1736_cobaltstrike_offensive_tool_keyword = "openPortScanner" nocase ascii wide
$string1737_cobaltstrike_offensive_tool_keyword = "openSpearPhishDialog" nocase ascii wide
$string1738_cobaltstrike_offensive_tool_keyword = "openWindowsExecutableStage" nocase ascii wide
$string1739_cobaltstrike_offensive_tool_keyword = "optiv/Registry-Recon" nocase ascii wide
$string1740_cobaltstrike_offensive_tool_keyword = "optiv/ScareCrow" nocase ascii wide
$string1741_cobaltstrike_offensive_tool_keyword = /Outflank\-Dumpert\./ nocase ascii wide
$string1742_cobaltstrike_offensive_tool_keyword = "outflanknl/Recon-AD" nocase ascii wide
$string1743_cobaltstrike_offensive_tool_keyword = "outflanknl/Spray-AD" nocase ascii wide
$string1744_cobaltstrike_offensive_tool_keyword = "outflanknl/WdToggle" nocase ascii wide
$string1745_cobaltstrike_offensive_tool_keyword = "Outflank-Recon-AD" nocase ascii wide
$string1746_cobaltstrike_offensive_tool_keyword = /output\/html\/data\/beacons\.json/ nocase ascii wide
$string1747_cobaltstrike_offensive_tool_keyword = "output/payloads/" nocase ascii wide
$string1748_cobaltstrike_offensive_tool_keyword = /package\scom\.blackh4t/ nocase ascii wide
$string1749_cobaltstrike_offensive_tool_keyword = /parse\sthe\s\.beacon_keys\sto\sRSA\sprivate\skey\sand\spublic\skey\sin\spem\sformat/ nocase ascii wide
$string1750_cobaltstrike_offensive_tool_keyword = "parse_aggressor_properties" nocase ascii wide
$string1751_cobaltstrike_offensive_tool_keyword = "parse_shellcode" nocase ascii wide
$string1752_cobaltstrike_offensive_tool_keyword = "patchAmsiOpenSession" nocase ascii wide
$string1753_cobaltstrike_offensive_tool_keyword = "payload_bootstrap_hint" nocase ascii wide
$string1754_cobaltstrike_offensive_tool_keyword = "payload_local" nocase ascii wide
$string1755_cobaltstrike_offensive_tool_keyword = /payload_scripts\.cna/ nocase ascii wide
$string1756_cobaltstrike_offensive_tool_keyword = "payload_scripts/sleepmask" nocase ascii wide
$string1757_cobaltstrike_offensive_tool_keyword = /payload_section\.cpp/ nocase ascii wide
$string1758_cobaltstrike_offensive_tool_keyword = /payload_section\.hpp/ nocase ascii wide
$string1759_cobaltstrike_offensive_tool_keyword = /payloadgenerator\.py/ nocase ascii wide
$string1760_cobaltstrike_offensive_tool_keyword = "Perform AS-REP roasting" nocase ascii wide
$string1761_cobaltstrike_offensive_tool_keyword = /perl\sadcsv\.pl\s/ nocase ascii wide
$string1762_cobaltstrike_offensive_tool_keyword = /PersistBOF\.cna/ nocase ascii wide
$string1763_cobaltstrike_offensive_tool_keyword = /PersistenceBOF\.c/ nocase ascii wide
$string1764_cobaltstrike_offensive_tool_keyword = /PersistenceBOF\.exe/ nocase ascii wide
$string1765_cobaltstrike_offensive_tool_keyword = /persist\-ice\-junction\.o/ nocase ascii wide
$string1766_cobaltstrike_offensive_tool_keyword = /persist\-ice\-monitor\.o/ nocase ascii wide
$string1767_cobaltstrike_offensive_tool_keyword = /persist\-ice\-shortcut\.o/ nocase ascii wide
$string1768_cobaltstrike_offensive_tool_keyword = /persist\-ice\-time\.o/ nocase ascii wide
$string1769_cobaltstrike_offensive_tool_keyword = /persist\-ice\-xll\.o/ nocase ascii wide
$string1770_cobaltstrike_offensive_tool_keyword = "Phant0m_cobaltstrike" nocase ascii wide
$string1771_cobaltstrike_offensive_tool_keyword = "'pipename_stager'" nocase ascii wide
$string1772_cobaltstrike_offensive_tool_keyword = "Pitty Tiger RAT" nocase ascii wide
$string1773_cobaltstrike_offensive_tool_keyword = /\-pk8gege\.org/ nocase ascii wide
$string1774_cobaltstrike_offensive_tool_keyword = /pkexec64\.tar\.gz/ nocase ascii wide
$string1775_cobaltstrike_offensive_tool_keyword = /plug_getpass_nps\.dll/ nocase ascii wide
$string1776_cobaltstrike_offensive_tool_keyword = /plug_katz_nps\.exe/ nocase ascii wide
$string1777_cobaltstrike_offensive_tool_keyword = /plug_qvte_nps\.exe/ nocase ascii wide
$string1778_cobaltstrike_offensive_tool_keyword = "PoolParty attack completed successfully" nocase ascii wide
$string1779_cobaltstrike_offensive_tool_keyword = "PoolPartyBof " nocase ascii wide
$string1780_cobaltstrike_offensive_tool_keyword = /PoolPartyBof\s.{0,100}\sHTTPSLocal/ nocase ascii wide
$string1781_cobaltstrike_offensive_tool_keyword = /PoolPartyBof\.cna/ nocase ascii wide
$string1782_cobaltstrike_offensive_tool_keyword = "PoolPartyBof-main" nocase ascii wide
$string1783_cobaltstrike_offensive_tool_keyword = "PortBender backdoor" nocase ascii wide
$string1784_cobaltstrike_offensive_tool_keyword = "PortBender redirect" nocase ascii wide
$string1785_cobaltstrike_offensive_tool_keyword = /PortBender\.cna/ nocase ascii wide
$string1786_cobaltstrike_offensive_tool_keyword = /PortBender\.cpp/ nocase ascii wide
$string1787_cobaltstrike_offensive_tool_keyword = /portbender\.dll/ nocase ascii wide
$string1788_cobaltstrike_offensive_tool_keyword = /PortBender\.exe/ nocase ascii wide
$string1789_cobaltstrike_offensive_tool_keyword = /PortBender\.h/ nocase ascii wide
$string1790_cobaltstrike_offensive_tool_keyword = /PortBender\.sln/ nocase ascii wide
$string1791_cobaltstrike_offensive_tool_keyword = /PortBender\.zip/ nocase ascii wide
$string1792_cobaltstrike_offensive_tool_keyword = /portscan_result\.cna/ nocase ascii wide
$string1793_cobaltstrike_offensive_tool_keyword = "portscan386 " nocase ascii wide
$string1794_cobaltstrike_offensive_tool_keyword = "portscan64 " nocase ascii wide
$string1795_cobaltstrike_offensive_tool_keyword = "post_ex_amsi_disable" nocase ascii wide
$string1796_cobaltstrike_offensive_tool_keyword = "post_ex_keylogger" nocase ascii wide
$string1797_cobaltstrike_offensive_tool_keyword = "post_ex_obfuscate" nocase ascii wide
$string1798_cobaltstrike_offensive_tool_keyword = "Post_EX_Process_Name" nocase ascii wide
$string1799_cobaltstrike_offensive_tool_keyword = "post_ex_smartinject" nocase ascii wide
$string1800_cobaltstrike_offensive_tool_keyword = "post_ex_spawnto_x64" nocase ascii wide
$string1801_cobaltstrike_offensive_tool_keyword = "post_ex_spawnto_x86" nocase ascii wide
$string1802_cobaltstrike_offensive_tool_keyword = "powershell_encode_oneliner" nocase ascii wide
$string1803_cobaltstrike_offensive_tool_keyword = "powershell_encode_oneliner" nocase ascii wide
$string1804_cobaltstrike_offensive_tool_keyword = "powershell_encode_stager" nocase ascii wide
$string1805_cobaltstrike_offensive_tool_keyword = "powershell_encode_stager" nocase ascii wide
$string1806_cobaltstrike_offensive_tool_keyword = /powershell\-import\s.{0,100}\.ps1/ nocase ascii wide
$string1807_cobaltstrike_offensive_tool_keyword = "PowerView3-Aggressor" nocase ascii wide
$string1808_cobaltstrike_offensive_tool_keyword = /ppenum\.c/ nocase ascii wide
$string1809_cobaltstrike_offensive_tool_keyword = /ppenum\.exe/ nocase ascii wide
$string1810_cobaltstrike_offensive_tool_keyword = /ppenum\.x64\./ nocase ascii wide
$string1811_cobaltstrike_offensive_tool_keyword = /ppenum\.x86\./ nocase ascii wide
$string1812_cobaltstrike_offensive_tool_keyword = /ppl_dump\.x64/ nocase ascii wide
$string1813_cobaltstrike_offensive_tool_keyword = "ppldump " nocase ascii wide
$string1814_cobaltstrike_offensive_tool_keyword = /PPLDump_BOF\./ nocase ascii wide
$string1815_cobaltstrike_offensive_tool_keyword = /pplfault\.cna/ nocase ascii wide
$string1816_cobaltstrike_offensive_tool_keyword = "PPLFaultDumpBOF" nocase ascii wide
$string1817_cobaltstrike_offensive_tool_keyword = /PPLFaultPayload\.dll/ nocase ascii wide
$string1818_cobaltstrike_offensive_tool_keyword = "PPLFaultTemp" nocase ascii wide
$string1819_cobaltstrike_offensive_tool_keyword = /praetorian\.antihacker/ nocase ascii wide
$string1820_cobaltstrike_offensive_tool_keyword = "praetorian-inc/PortBender" nocase ascii wide
$string1821_cobaltstrike_offensive_tool_keyword = "prepareResponseForHiddenAPICall" nocase ascii wide
$string1822_cobaltstrike_offensive_tool_keyword = "PrintSpoofer-" nocase ascii wide
$string1823_cobaltstrike_offensive_tool_keyword = /PrintSpoofer\./ nocase ascii wide
$string1824_cobaltstrike_offensive_tool_keyword = /process_imports\.cna/ nocase ascii wide
$string1825_cobaltstrike_offensive_tool_keyword = /process_imports\.x64/ nocase ascii wide
$string1826_cobaltstrike_offensive_tool_keyword = /process_imports_api\s.{0,100}\.exe/ nocase ascii wide
$string1827_cobaltstrike_offensive_tool_keyword = "process_inject_allocator" nocase ascii wide
$string1828_cobaltstrike_offensive_tool_keyword = "process_inject_bof_allocator" nocase ascii wide
$string1829_cobaltstrike_offensive_tool_keyword = "process_inject_bof_reuse_memory" nocase ascii wide
$string1830_cobaltstrike_offensive_tool_keyword = "process_inject_execute" nocase ascii wide
$string1831_cobaltstrike_offensive_tool_keyword = "process_inject_min_alloc" nocase ascii wide
$string1832_cobaltstrike_offensive_tool_keyword = "process_inject_startrwx" nocase ascii wide
$string1833_cobaltstrike_offensive_tool_keyword = "Process_Inject_Struct" nocase ascii wide
$string1834_cobaltstrike_offensive_tool_keyword = "process_inject_transform_x" nocase ascii wide
$string1835_cobaltstrike_offensive_tool_keyword = "process_inject_userwx" nocase ascii wide
$string1836_cobaltstrike_offensive_tool_keyword = "process_protection_enum " nocase ascii wide
$string1837_cobaltstrike_offensive_tool_keyword = /process_protection_enum.{0,100}\.dmp/ nocase ascii wide
$string1838_cobaltstrike_offensive_tool_keyword = /process_protection_enum\./ nocase ascii wide
$string1839_cobaltstrike_offensive_tool_keyword = /Process_Protection_Level_BOF\./ nocase ascii wide
$string1840_cobaltstrike_offensive_tool_keyword = "Process_Protection_Level_BOF/" nocase ascii wide
$string1841_cobaltstrike_offensive_tool_keyword = /ProcessDestroy\.x64/ nocase ascii wide
$string1842_cobaltstrike_offensive_tool_keyword = /ProcessDestroy\.x64\./ nocase ascii wide
$string1843_cobaltstrike_offensive_tool_keyword = /ProcessDestroy\.x86/ nocase ascii wide
$string1844_cobaltstrike_offensive_tool_keyword = /ProcessDestroy\.x86\./ nocase ascii wide
$string1845_cobaltstrike_offensive_tool_keyword = "process-inject " nocase ascii wide
$string1846_cobaltstrike_offensive_tool_keyword = "processinject_min_alloc" nocase ascii wide
$string1847_cobaltstrike_offensive_tool_keyword = /ProgIDsUACBypass\./ nocase ascii wide
$string1848_cobaltstrike_offensive_tool_keyword = "Proxy Shellcode Handler" nocase ascii wide
$string1849_cobaltstrike_offensive_tool_keyword = /proxychains.{0,100}scshell/ nocase ascii wide
$string1850_cobaltstrike_offensive_tool_keyword = "proxyshellcodeurl" nocase ascii wide
$string1851_cobaltstrike_offensive_tool_keyword = /PSconfusion\.py/ nocase ascii wide
$string1852_cobaltstrike_offensive_tool_keyword = "PSEXEC_PSH " nocase ascii wide
$string1853_cobaltstrike_offensive_tool_keyword = "pureqh/bypassAV" nocase ascii wide
$string1854_cobaltstrike_offensive_tool_keyword = "pwn1sher/CS-BOFs" nocase ascii wide
$string1855_cobaltstrike_offensive_tool_keyword = /pycobalt\./ nocase ascii wide
$string1856_cobaltstrike_offensive_tool_keyword = "pycobalt/aggressor" nocase ascii wide
$string1857_cobaltstrike_offensive_tool_keyword = "pycobalt_debug_on" nocase ascii wide
$string1858_cobaltstrike_offensive_tool_keyword = "pycobalt_path" nocase ascii wide
$string1859_cobaltstrike_offensive_tool_keyword = "pycobalt_python" nocase ascii wide
$string1860_cobaltstrike_offensive_tool_keyword = "pycobalt_timeout" nocase ascii wide
$string1861_cobaltstrike_offensive_tool_keyword = "pyMalleableC2" nocase ascii wide
$string1862_cobaltstrike_offensive_tool_keyword = "pystinger_for_darkshadow" nocase ascii wide
$string1863_cobaltstrike_offensive_tool_keyword = "python scshell" nocase ascii wide
$string1864_cobaltstrike_offensive_tool_keyword = /python2\?\?\/generator\.py/ nocase ascii wide
$string1865_cobaltstrike_offensive_tool_keyword = /python2\?\?\/PyLoader\.py/ nocase ascii wide
$string1866_cobaltstrike_offensive_tool_keyword = "python3 scshell" nocase ascii wide
$string1867_cobaltstrike_offensive_tool_keyword = /python3\?\?\/generator\.py/ nocase ascii wide
$string1868_cobaltstrike_offensive_tool_keyword = /python3\?\?\/PyLoader\.py/ nocase ascii wide
$string1869_cobaltstrike_offensive_tool_keyword = "QUAPCInjectAsSystem" nocase ascii wide
$string1870_cobaltstrike_offensive_tool_keyword = "QUAPCInjectElevated" nocase ascii wide
$string1871_cobaltstrike_offensive_tool_keyword = "QUAPCInjectFakecmd" nocase ascii wide
$string1872_cobaltstrike_offensive_tool_keyword = "QUAPCInjectFakecmd" nocase ascii wide
$string1873_cobaltstrike_offensive_tool_keyword = "QUAPCInjectWithoutPid" nocase ascii wide
$string1874_cobaltstrike_offensive_tool_keyword = /quser\.x64\.o/ nocase ascii wide
$string1875_cobaltstrike_offensive_tool_keyword = /quser\.x86\.o/ nocase ascii wide
$string1876_cobaltstrike_offensive_tool_keyword = "QXh4OEF4eDhBeHg4QXh4OA==" nocase ascii wide
$string1877_cobaltstrike_offensive_tool_keyword = "RAI/ase_docker" nocase ascii wide
$string1878_cobaltstrike_offensive_tool_keyword = /rai\-attack\-servers\./ nocase ascii wide
$string1879_cobaltstrike_offensive_tool_keyword = "rai-redirector-dns" nocase ascii wide
$string1880_cobaltstrike_offensive_tool_keyword = "rai-redirector-http" nocase ascii wide
$string1881_cobaltstrike_offensive_tool_keyword = "RalfHacker/Kerbeus-BOF" nocase ascii wide
$string1882_cobaltstrike_offensive_tool_keyword = "random_c2_profile" nocase ascii wide
$string1883_cobaltstrike_offensive_tool_keyword = /random_c2profile\./ nocase ascii wide
$string1884_cobaltstrike_offensive_tool_keyword = /random_user_agent\.params/ nocase ascii wide
$string1885_cobaltstrike_offensive_tool_keyword = /random_user_agent\.user_agent/ nocase ascii wide
$string1886_cobaltstrike_offensive_tool_keyword = "rasta-mouse/PPEnum" nocase ascii wide
$string1887_cobaltstrike_offensive_tool_keyword = "rasta-mouse/TikiTorch" nocase ascii wide
$string1888_cobaltstrike_offensive_tool_keyword = /rdi_net_user\.cpp/ nocase ascii wide
$string1889_cobaltstrike_offensive_tool_keyword = /rdphijack\.x64/ nocase ascii wide
$string1890_cobaltstrike_offensive_tool_keyword = /rdphijack\.x86/ nocase ascii wide
$string1891_cobaltstrike_offensive_tool_keyword = "RDPHijack-BOF" nocase ascii wide
$string1892_cobaltstrike_offensive_tool_keyword = /RdpThief\./ nocase ascii wide
$string1893_cobaltstrike_offensive_tool_keyword = "read_cs_teamserver" nocase ascii wide
$string1894_cobaltstrike_offensive_tool_keyword = /Recon\-AD\-.{0,100}\.dll/ nocase ascii wide
$string1895_cobaltstrike_offensive_tool_keyword = /Recon\-AD\-.{0,100}\.sln/ nocase ascii wide
$string1896_cobaltstrike_offensive_tool_keyword = /Recon\-AD\-.{0,100}\.vcxproj/ nocase ascii wide
$string1897_cobaltstrike_offensive_tool_keyword = "Recon-AD-AllLocalGroups" nocase ascii wide
$string1898_cobaltstrike_offensive_tool_keyword = "Recon-AD-Domain" nocase ascii wide
$string1899_cobaltstrike_offensive_tool_keyword = "Recon-AD-LocalGroups" nocase ascii wide
$string1900_cobaltstrike_offensive_tool_keyword = "Recon-AD-SPNs" nocase ascii wide
$string1901_cobaltstrike_offensive_tool_keyword = /Recon\-AD\-Users\./ nocase ascii wide
$string1902_cobaltstrike_offensive_tool_keyword = "redelk_backend_name_c2" nocase ascii wide
$string1903_cobaltstrike_offensive_tool_keyword = "redelk_backend_name_decoy" nocase ascii wide
$string1904_cobaltstrike_offensive_tool_keyword = /Red\-Team\-Infrastructure\-Wiki\./ nocase ascii wide
$string1905_cobaltstrike_offensive_tool_keyword = /RedWarden\.py/ nocase ascii wide
$string1906_cobaltstrike_offensive_tool_keyword = /RedWarden\.test/ nocase ascii wide
$string1907_cobaltstrike_offensive_tool_keyword = /redwarden_access\.log/ nocase ascii wide
$string1908_cobaltstrike_offensive_tool_keyword = /redwarden_redirector\.log/ nocase ascii wide
$string1909_cobaltstrike_offensive_tool_keyword = /reflective_dll\.dll/ nocase ascii wide
$string1910_cobaltstrike_offensive_tool_keyword = /reflective_dll\.x64\.dll/ nocase ascii wide
$string1911_cobaltstrike_offensive_tool_keyword = /ReflectiveDll\.x64\.dll/ nocase ascii wide
$string1912_cobaltstrike_offensive_tool_keyword = /ReflectiveDll\.x86\.dll/ nocase ascii wide
$string1913_cobaltstrike_offensive_tool_keyword = "Reflective-HackBrowserData" nocase ascii wide
$string1914_cobaltstrike_offensive_tool_keyword = /Remote\/lastpass\/lastpass\.x86\./ nocase ascii wide
$string1915_cobaltstrike_offensive_tool_keyword = "Remote/setuserpass/" nocase ascii wide
$string1916_cobaltstrike_offensive_tool_keyword = "Remote/shspawnas" nocase ascii wide
$string1917_cobaltstrike_offensive_tool_keyword = "Remote/suspendresume/" nocase ascii wide
$string1918_cobaltstrike_offensive_tool_keyword = /remote\-exec\s.{0,100}jump\s/ nocase ascii wide
$string1919_cobaltstrike_offensive_tool_keyword = /remotereg\.cna/ nocase ascii wide
$string1920_cobaltstrike_offensive_tool_keyword = "replace_key_iv_shellcode" nocase ascii wide
$string1921_cobaltstrike_offensive_tool_keyword = "RiccardoAncarani/BOFs" nocase ascii wide
$string1922_cobaltstrike_offensive_tool_keyword = "RiccardoAncarani/LiquidSnake" nocase ascii wide
$string1923_cobaltstrike_offensive_tool_keyword = "RiccardoAncarani/TaskShell" nocase ascii wide
$string1924_cobaltstrike_offensive_tool_keyword = "rkervella/CarbonMonoxide" nocase ascii wide
$string1925_cobaltstrike_offensive_tool_keyword = "rookuu/BOFs/" nocase ascii wide
$string1926_cobaltstrike_offensive_tool_keyword = /rpcattack\.py/ nocase ascii wide
$string1927_cobaltstrike_offensive_tool_keyword = /rpcrelayclient\.py/ nocase ascii wide
$string1928_cobaltstrike_offensive_tool_keyword = "rsmudge/ElevateKit" nocase ascii wide
$string1929_cobaltstrike_offensive_tool_keyword = "runasadmin uac-cmstplua" nocase ascii wide
$string1930_cobaltstrike_offensive_tool_keyword = "runasadmin uac-token-duplication" nocase ascii wide
$string1931_cobaltstrike_offensive_tool_keyword = /RunOF\.exe\s\-/ nocase ascii wide
$string1932_cobaltstrike_offensive_tool_keyword = /RunOF\.Internals/ nocase ascii wide
$string1933_cobaltstrike_offensive_tool_keyword = /rustbof\.cna/ nocase ascii wide
$string1934_cobaltstrike_offensive_tool_keyword = "rvrsh3ll/BOF_Collection" nocase ascii wide
$string1935_cobaltstrike_offensive_tool_keyword = "rxwx/cs-rdll-ipc-example" nocase ascii wide
$string1936_cobaltstrike_offensive_tool_keyword = /s4u\.x64\.c/ nocase ascii wide
$string1937_cobaltstrike_offensive_tool_keyword = /s4u\.x64\.o/ nocase ascii wide
$string1938_cobaltstrike_offensive_tool_keyword = /SafetyKatz\.exe/ nocase ascii wide
$string1939_cobaltstrike_offensive_tool_keyword = /SamAdduser\.exe/ nocase ascii wide
$string1940_cobaltstrike_offensive_tool_keyword = "samr_##" nocase ascii wide
$string1941_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}\s\-encryptionmode\s/ nocase ascii wide
$string1942_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}\s\-Evasion/ nocase ascii wide
$string1943_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}\s\-Exec/ nocase ascii wide
$string1944_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}\s\-injection/ nocase ascii wide
$string1945_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}\s\-Loader\s.{0,100}\s/ nocase ascii wide
$string1946_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}\s\-noamsi/ nocase ascii wide
$string1947_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}\s\-noetw/ nocase ascii wide
$string1948_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}\s\-obfu/ nocase ascii wide
$string1949_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}_darwin_amd64/
$string1950_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}_windows_amd64\.exe/ nocase ascii wide
$string1951_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}KnownDLL/ nocase ascii wide
$string1952_cobaltstrike_offensive_tool_keyword = /ScareCrow.{0,100}ProcessInjection/ nocase ascii wide
$string1953_cobaltstrike_offensive_tool_keyword = /ScareCrow\.cna/ nocase ascii wide
$string1954_cobaltstrike_offensive_tool_keyword = "ScareCrow/Cryptor" nocase ascii wide
$string1955_cobaltstrike_offensive_tool_keyword = "ScareCrow/limelighter" nocase ascii wide
$string1956_cobaltstrike_offensive_tool_keyword = "ScareCrow/Loader" nocase ascii wide
$string1957_cobaltstrike_offensive_tool_keyword = "ScareCrow/Utils" nocase ascii wide
$string1958_cobaltstrike_offensive_tool_keyword = /schshell\.cna/ nocase ascii wide
$string1959_cobaltstrike_offensive_tool_keyword = "schtask_callback" nocase ascii wide
$string1960_cobaltstrike_offensive_tool_keyword = "schtasks_elevator" nocase ascii wide
$string1961_cobaltstrike_offensive_tool_keyword = "schtasks_exploit " nocase ascii wide
$string1962_cobaltstrike_offensive_tool_keyword = /ScRunBase32\.exe/ nocase ascii wide
$string1963_cobaltstrike_offensive_tool_keyword = /ScRunBase32\.py/ nocase ascii wide
$string1964_cobaltstrike_offensive_tool_keyword = /ScRunBase64\.exe/ nocase ascii wide
$string1965_cobaltstrike_offensive_tool_keyword = /ScRunBase64\.py/ nocase ascii wide
$string1966_cobaltstrike_offensive_tool_keyword = /scshell.{0,100}XblAuthManager/ nocase ascii wide
$string1967_cobaltstrike_offensive_tool_keyword = /SCShell\.exe/ nocase ascii wide
$string1968_cobaltstrike_offensive_tool_keyword = /scshell\.py/ nocase ascii wide
$string1969_cobaltstrike_offensive_tool_keyword = /scshellbof\.c/ nocase ascii wide
$string1970_cobaltstrike_offensive_tool_keyword = /scshellbof\.o/ nocase ascii wide
$string1971_cobaltstrike_offensive_tool_keyword = "scshellbofx64" nocase ascii wide
$string1972_cobaltstrike_offensive_tool_keyword = "searchsploit_rc" nocase ascii wide
$string1973_cobaltstrike_offensive_tool_keyword = /Seatbelt\.exe/ nocase ascii wide
$string1974_cobaltstrike_offensive_tool_keyword = "sec-inject " nocase ascii wide
$string1975_cobaltstrike_offensive_tool_keyword = /secinject\.cna/ nocase ascii wide
$string1976_cobaltstrike_offensive_tool_keyword = /secinject\.git/ nocase ascii wide
$string1977_cobaltstrike_offensive_tool_keyword = /secinject\.x64/ nocase ascii wide
$string1978_cobaltstrike_offensive_tool_keyword = /secinject\.x86/ nocase ascii wide
$string1979_cobaltstrike_offensive_tool_keyword = "secinject/src" nocase ascii wide
$string1980_cobaltstrike_offensive_tool_keyword = /secretsdump\..{0,100}\.pyc/ nocase ascii wide
$string1981_cobaltstrike_offensive_tool_keyword = /secretsdump\.py/ nocase ascii wide
$string1982_cobaltstrike_offensive_tool_keyword = "sec-shinject " nocase ascii wide
$string1983_cobaltstrike_offensive_tool_keyword = /self_delete\.x64\.o/ nocase ascii wide
$string1984_cobaltstrike_offensive_tool_keyword = "Self_Deletion_BOF" nocase ascii wide
$string1985_cobaltstrike_offensive_tool_keyword = "send_shellcode_via_pipe" nocase ascii wide
$string1986_cobaltstrike_offensive_tool_keyword = "send_shellcode_via_pipe" nocase ascii wide
$string1987_cobaltstrike_offensive_tool_keyword = /serverscan\.linux\.elf/
$string1988_cobaltstrike_offensive_tool_keyword = /serverscan\.linux\.so/
$string1989_cobaltstrike_offensive_tool_keyword = /serverScan\.win\.cna/ nocase ascii wide
$string1990_cobaltstrike_offensive_tool_keyword = /serverscan_386\.exe/ nocase ascii wide
$string1991_cobaltstrike_offensive_tool_keyword = /ServerScan_Air_.{0,100}\.exe/ nocase ascii wide
$string1992_cobaltstrike_offensive_tool_keyword = /ServerScan_Air_.{0,100}_amd64/ nocase ascii wide
$string1993_cobaltstrike_offensive_tool_keyword = /ServerScan_Air_.{0,100}_i386/ nocase ascii wide
$string1994_cobaltstrike_offensive_tool_keyword = /serverscan_air\-probes\.exe/ nocase ascii wide
$string1995_cobaltstrike_offensive_tool_keyword = /serverscan_amd64\.exe/ nocase ascii wide
$string1996_cobaltstrike_offensive_tool_keyword = /ServerScan_Pro_.{0,100}\.exe/ nocase ascii wide
$string1997_cobaltstrike_offensive_tool_keyword = /ServerScan_Pro_.{0,100}_amd64/ nocase ascii wide
$string1998_cobaltstrike_offensive_tool_keyword = /ServerScan_Pro_.{0,100}_i386/ nocase ascii wide
$string1999_cobaltstrike_offensive_tool_keyword = "serverscan64 " nocase ascii wide
$string2000_cobaltstrike_offensive_tool_keyword = /serverscan64\s.{0,100}tcp/ nocase ascii wide
$string2001_cobaltstrike_offensive_tool_keyword = "serverscan86 " nocase ascii wide
$string2002_cobaltstrike_offensive_tool_keyword = /servicemove.{0,100}hid\.dll/ nocase ascii wide
$string2003_cobaltstrike_offensive_tool_keyword = "set hosts_stage" nocase ascii wide
$string2004_cobaltstrike_offensive_tool_keyword = "set keylogger" nocase ascii wide
$string2005_cobaltstrike_offensive_tool_keyword = "set obfuscate " nocase ascii wide
$string2006_cobaltstrike_offensive_tool_keyword = "set pipename " nocase ascii wide
$string2007_cobaltstrike_offensive_tool_keyword = "set smartinject" nocase ascii wide
$string2008_cobaltstrike_offensive_tool_keyword = "set userwx" nocase ascii wide
$string2009_cobaltstrike_offensive_tool_keyword = "setc_webshell" nocase ascii wide
$string2010_cobaltstrike_offensive_tool_keyword = "setLoaderFlagZero" nocase ascii wide
$string2011_cobaltstrike_offensive_tool_keyword = /setthreadcontext\.x64/ nocase ascii wide
$string2012_cobaltstrike_offensive_tool_keyword = /setthreadcontext\.x86/ nocase ascii wide
$string2013_cobaltstrike_offensive_tool_keyword = "setup_obfuscate_xor_key" nocase ascii wide
$string2014_cobaltstrike_offensive_tool_keyword = "setup_reflective_loader" nocase ascii wide
$string2015_cobaltstrike_offensive_tool_keyword = "seventeenman/CallBackDump" nocase ascii wide
$string2016_cobaltstrike_offensive_tool_keyword = /ShadowUser\/scvhost\.exe/ nocase ascii wide
$string2017_cobaltstrike_offensive_tool_keyword = /SharpCalendar\.exe/ nocase ascii wide
$string2018_cobaltstrike_offensive_tool_keyword = /SharpCat\.exe/ nocase ascii wide
$string2019_cobaltstrike_offensive_tool_keyword = /sharpcompile.{0,100}\.exe/ nocase ascii wide
$string2020_cobaltstrike_offensive_tool_keyword = "sharpCompileHandler" nocase ascii wide
$string2021_cobaltstrike_offensive_tool_keyword = "SharpCompileServer" nocase ascii wide
$string2022_cobaltstrike_offensive_tool_keyword = /SharpCompileServer\.exe/ nocase ascii wide
$string2023_cobaltstrike_offensive_tool_keyword = /SharpCradle.{0,100}logonpasswords/ nocase ascii wide
$string2024_cobaltstrike_offensive_tool_keyword = /SharpCradle\.exe/ nocase ascii wide
$string2025_cobaltstrike_offensive_tool_keyword = "SharpEventLoader" nocase ascii wide
$string2026_cobaltstrike_offensive_tool_keyword = "SharpEventPersist" nocase ascii wide
$string2027_cobaltstrike_offensive_tool_keyword = "SharpExcelibur" nocase ascii wide
$string2028_cobaltstrike_offensive_tool_keyword = "sharp-exec " nocase ascii wide
$string2029_cobaltstrike_offensive_tool_keyword = "sharp-fexec " nocase ascii wide
$string2030_cobaltstrike_offensive_tool_keyword = /SharpGen\.dll/ nocase ascii wide
$string2031_cobaltstrike_offensive_tool_keyword = /sharpgen\.enable_cache/ nocase ascii wide
$string2032_cobaltstrike_offensive_tool_keyword = /sharpgen\.py/ nocase ascii wide
$string2033_cobaltstrike_offensive_tool_keyword = /sharpgen\.set_location/ nocase ascii wide
$string2034_cobaltstrike_offensive_tool_keyword = "Sharp-HackBrowserData" nocase ascii wide
$string2035_cobaltstrike_offensive_tool_keyword = /SharpHound\.cna/ nocase ascii wide
$string2036_cobaltstrike_offensive_tool_keyword = /SharpHound\.exe/ nocase ascii wide
$string2037_cobaltstrike_offensive_tool_keyword = /SharpHound\.ps1/ nocase ascii wide
$string2038_cobaltstrike_offensive_tool_keyword = /Sharphound2\./ nocase ascii wide
$string2039_cobaltstrike_offensive_tool_keyword = "Sharphound-Aggressor" nocase ascii wide
$string2040_cobaltstrike_offensive_tool_keyword = "SharpSCShell" nocase ascii wide
$string2041_cobaltstrike_offensive_tool_keyword = "SharpSploitConsole_x" nocase ascii wide
$string2042_cobaltstrike_offensive_tool_keyword = /SharpStay\.exe/ nocase ascii wide
$string2043_cobaltstrike_offensive_tool_keyword = /SharpSword\.exe/ nocase ascii wide
$string2044_cobaltstrike_offensive_tool_keyword = "SharpZeroLogon" nocase ascii wide
$string2045_cobaltstrike_offensive_tool_keyword = /SharpZippo\.exe/ nocase ascii wide
$string2046_cobaltstrike_offensive_tool_keyword = /shell\.exe\s\-s\spayload\.txt/ nocase ascii wide
$string2047_cobaltstrike_offensive_tool_keyword = /Shellcode_encryption\.exe/ nocase ascii wide
$string2048_cobaltstrike_offensive_tool_keyword = /shellcode_generator\./ nocase ascii wide
$string2049_cobaltstrike_offensive_tool_keyword = /shellcode_generator_help\.html/ nocase ascii wide
$string2050_cobaltstrike_offensive_tool_keyword = /ShellCode_Loader\.py/ nocase ascii wide
$string2051_cobaltstrike_offensive_tool_keyword = /shellcode20\.exe/ nocase ascii wide
$string2052_cobaltstrike_offensive_tool_keyword = /shellcode30\.exe/ nocase ascii wide
$string2053_cobaltstrike_offensive_tool_keyword = /shellcode35\.exe/ nocase ascii wide
$string2054_cobaltstrike_offensive_tool_keyword = /shellcode40\.exe/ nocase ascii wide
$string2055_cobaltstrike_offensive_tool_keyword = "shspawn x64 " nocase ascii wide
$string2056_cobaltstrike_offensive_tool_keyword = "shspawn x86 " nocase ascii wide
$string2057_cobaltstrike_offensive_tool_keyword = /SigFlip\.exe\s\-/ nocase ascii wide
$string2058_cobaltstrike_offensive_tool_keyword = /SigFlip\.WinTrustData/ nocase ascii wide
$string2059_cobaltstrike_offensive_tool_keyword = /SigInject\s.{0,100}\.dll/ nocase ascii wide
$string2060_cobaltstrike_offensive_tool_keyword = /Sigloader\s.{0,100}\.dll/ nocase ascii wide
$string2061_cobaltstrike_offensive_tool_keyword = /SigLoader\/sigloader\.c/ nocase ascii wide
$string2062_cobaltstrike_offensive_tool_keyword = /sigwhatever\.exe/ nocase ascii wide
$string2063_cobaltstrike_offensive_tool_keyword = "Silent Lsass Dump" nocase ascii wide
$string2064_cobaltstrike_offensive_tool_keyword = "SilentCleanupWinDirBOF" nocase ascii wide
$string2065_cobaltstrike_offensive_tool_keyword = "silentLsassDump" nocase ascii wide
$string2066_cobaltstrike_offensive_tool_keyword = "-Situational-Awareness-BOF" nocase ascii wide
$string2067_cobaltstrike_offensive_tool_keyword = /sleep_python_bridge\.sleepy/ nocase ascii wide
$string2068_cobaltstrike_offensive_tool_keyword = /sleep_python_bridge\.striker/ nocase ascii wide
$string2069_cobaltstrike_offensive_tool_keyword = /sleepmask\.x64\.o/ nocase ascii wide
$string2070_cobaltstrike_offensive_tool_keyword = /sleepmask\.x86\.o/ nocase ascii wide
$string2071_cobaltstrike_offensive_tool_keyword = /sleepmask_pivot\.x64\.o/ nocase ascii wide
$string2072_cobaltstrike_offensive_tool_keyword = /sleepmask_pivot\.x86\.o/ nocase ascii wide
$string2073_cobaltstrike_offensive_tool_keyword = "smb_pipename_stager" nocase ascii wide
$string2074_cobaltstrike_offensive_tool_keyword = /smbattack\.py/ nocase ascii wide
$string2075_cobaltstrike_offensive_tool_keyword = /smbrelayclient\.py/ nocase ascii wide
$string2076_cobaltstrike_offensive_tool_keyword = /smbrelayserver\./ nocase ascii wide
$string2077_cobaltstrike_offensive_tool_keyword = /smtprelayclient\.py/ nocase ascii wide
$string2078_cobaltstrike_offensive_tool_keyword = "socky whoami" nocase ascii wide
$string2079_cobaltstrike_offensive_tool_keyword = /SourcePoint.{0,100}Loader\.go/ nocase ascii wide
$string2080_cobaltstrike_offensive_tool_keyword = /source\-teamserver\.sh/ nocase ascii wide
$string2081_cobaltstrike_offensive_tool_keyword = "spawn/runshellcode" nocase ascii wide
$string2082_cobaltstrike_offensive_tool_keyword = /SpawnTheThing\(/ nocase ascii wide
$string2083_cobaltstrike_offensive_tool_keyword = /spawnto\s.{0,100}\.exe/ nocase ascii wide
$string2084_cobaltstrike_offensive_tool_keyword = "'spawnto_x64'" nocase ascii wide
$string2085_cobaltstrike_offensive_tool_keyword = "'spawnto_x86'" nocase ascii wide
$string2086_cobaltstrike_offensive_tool_keyword = "spoolss_##" nocase ascii wide
$string2087_cobaltstrike_offensive_tool_keyword = "spoolsystem inject" nocase ascii wide
$string2088_cobaltstrike_offensive_tool_keyword = "spoolsystem spawn" nocase ascii wide
$string2089_cobaltstrike_offensive_tool_keyword = /spoolsystem\.cna/ nocase ascii wide
$string2090_cobaltstrike_offensive_tool_keyword = /SpoolTrigger\.x64\.dl/ nocase ascii wide
$string2091_cobaltstrike_offensive_tool_keyword = /SpoolTrigger\.x64\.dll/ nocase ascii wide
$string2092_cobaltstrike_offensive_tool_keyword = /SpoolTrigger\.x86\.dl/ nocase ascii wide
$string2093_cobaltstrike_offensive_tool_keyword = /SpoolTrigger\.x86\.dll/ nocase ascii wide
$string2094_cobaltstrike_offensive_tool_keyword = /SpoolTrigger\\SpoolTrigger\./ nocase ascii wide
$string2095_cobaltstrike_offensive_tool_keyword = "Spray-AD " nocase ascii wide
$string2096_cobaltstrike_offensive_tool_keyword = /Spray\-AD\.cna/ nocase ascii wide
$string2097_cobaltstrike_offensive_tool_keyword = /Spray\-AD\.dll/ nocase ascii wide
$string2098_cobaltstrike_offensive_tool_keyword = /Spray\-AD\.exe/ nocase ascii wide
$string2099_cobaltstrike_offensive_tool_keyword = /Spray\-AD\.sln/ nocase ascii wide
$string2100_cobaltstrike_offensive_tool_keyword = /Spray\-AD\\Spray\-AD/ nocase ascii wide
$string2101_cobaltstrike_offensive_tool_keyword = "src/Remote/chromeKey/" nocase ascii wide
$string2102_cobaltstrike_offensive_tool_keyword = "src/Remote/lastpass/" nocase ascii wide
$string2103_cobaltstrike_offensive_tool_keyword = "src/Remote/sc_config/" nocase ascii wide
$string2104_cobaltstrike_offensive_tool_keyword = "src/Remote/sc_create/" nocase ascii wide
$string2105_cobaltstrike_offensive_tool_keyword = "src/Remote/sc_delete/" nocase ascii wide
$string2106_cobaltstrike_offensive_tool_keyword = "src/Remote/sc_start/" nocase ascii wide
$string2107_cobaltstrike_offensive_tool_keyword = "Src/Spray-AD" nocase ascii wide
$string2108_cobaltstrike_offensive_tool_keyword = /src\/zerologon\.c/ nocase ascii wide
$string2109_cobaltstrike_offensive_tool_keyword = /src\\unhook\.c/ nocase ascii wide
$string2110_cobaltstrike_offensive_tool_keyword = "srvsvc_##" nocase ascii wide
$string2111_cobaltstrike_offensive_tool_keyword = "SspiUacBypass" nocase ascii wide
$string2112_cobaltstrike_offensive_tool_keyword = "SspiUacBypassBOF" nocase ascii wide
$string2113_cobaltstrike_offensive_tool_keyword = /stage\.obfuscate/ nocase ascii wide
$string2114_cobaltstrike_offensive_tool_keyword = "stage_smartinject" nocase ascii wide
$string2115_cobaltstrike_offensive_tool_keyword = "stage_transform_x64_prepend" nocase ascii wide
$string2116_cobaltstrike_offensive_tool_keyword = "stage_transform_x64_strrep1" nocase ascii wide
$string2117_cobaltstrike_offensive_tool_keyword = "stage_transform_x86_prepend" nocase ascii wide
$string2118_cobaltstrike_offensive_tool_keyword = "stage_transform_x86_strrep1" nocase ascii wide
$string2119_cobaltstrike_offensive_tool_keyword = "stageless payload" nocase ascii wide
$string2120_cobaltstrike_offensive_tool_keyword = "stager_bind_pipe" nocase ascii wide
$string2121_cobaltstrike_offensive_tool_keyword = "stager_bind_pipe" nocase ascii wide
$string2122_cobaltstrike_offensive_tool_keyword = "stager_bind_tcp" nocase ascii wide
$string2123_cobaltstrike_offensive_tool_keyword = "stager_bind_tcp" nocase ascii wide
$string2124_cobaltstrike_offensive_tool_keyword = "start stinger " nocase ascii wide
$string2125_cobaltstrike_offensive_tool_keyword = "Starting PoolParty attack against process id:" nocase ascii wide
$string2126_cobaltstrike_offensive_tool_keyword = /StartProcessFake\(/ nocase ascii wide
$string2127_cobaltstrike_offensive_tool_keyword = "static_syscalls_apc_spawn " nocase ascii wide
$string2128_cobaltstrike_offensive_tool_keyword = "static_syscalls_apc_spawn" nocase ascii wide
$string2129_cobaltstrike_offensive_tool_keyword = "static_syscalls_dump" nocase ascii wide
$string2130_cobaltstrike_offensive_tool_keyword = /StayKit\.cna/ nocase ascii wide
$string2131_cobaltstrike_offensive_tool_keyword = /StayKit\.exe/ nocase ascii wide
$string2132_cobaltstrike_offensive_tool_keyword = /StayKit\.git/ nocase ascii wide
$string2133_cobaltstrike_offensive_tool_keyword = /steal_token\(/ nocase ascii wide
$string2134_cobaltstrike_offensive_tool_keyword = "steal_token_access_mask" nocase ascii wide
$string2135_cobaltstrike_offensive_tool_keyword = "stinger_client -" nocase ascii wide
$string2136_cobaltstrike_offensive_tool_keyword = /stinger_client\.py/ nocase ascii wide
$string2137_cobaltstrike_offensive_tool_keyword = /stinger_server\.exe/ nocase ascii wide
$string2138_cobaltstrike_offensive_tool_keyword = /strip_bof\.ps1/ nocase ascii wide
$string2139_cobaltstrike_offensive_tool_keyword = "strip-bof -Path " nocase ascii wide
$string2140_cobaltstrike_offensive_tool_keyword = /sudo\s\.\/teamserver\s/
$string2141_cobaltstrike_offensive_tool_keyword = /suspendresume\.x64\./ nocase ascii wide
$string2142_cobaltstrike_offensive_tool_keyword = /suspendresume\.x86\./ nocase ascii wide
$string2143_cobaltstrike_offensive_tool_keyword = "SW2_GetSyscallNumber" nocase ascii wide
$string2144_cobaltstrike_offensive_tool_keyword = "SW2_HashSyscall" nocase ascii wide
$string2145_cobaltstrike_offensive_tool_keyword = "SW2_PopulateSyscallList" nocase ascii wide
$string2146_cobaltstrike_offensive_tool_keyword = "SW2_RVA2VA" nocase ascii wide
$string2147_cobaltstrike_offensive_tool_keyword = /SwampThing\.exe/ nocase ascii wide
$string2148_cobaltstrike_offensive_tool_keyword = /SweetPotato\.cna/ nocase ascii wide
$string2149_cobaltstrike_offensive_tool_keyword = /SweetPotato\.csproj/ nocase ascii wide
$string2150_cobaltstrike_offensive_tool_keyword = /SweetPotato\.exe/ nocase ascii wide
$string2151_cobaltstrike_offensive_tool_keyword = /SweetPotato\.ImpersonationToken/ nocase ascii wide
$string2152_cobaltstrike_offensive_tool_keyword = /SweetPotato\.sln/ nocase ascii wide
$string2153_cobaltstrike_offensive_tool_keyword = "syscall_disable_priv " nocase ascii wide
$string2154_cobaltstrike_offensive_tool_keyword = "syscall_enable_priv " nocase ascii wide
$string2155_cobaltstrike_offensive_tool_keyword = /syscalls\.asm/ nocase ascii wide
$string2156_cobaltstrike_offensive_tool_keyword = /syscalls_dump\./ nocase ascii wide
$string2157_cobaltstrike_offensive_tool_keyword = "syscalls_inject " nocase ascii wide
$string2158_cobaltstrike_offensive_tool_keyword = /syscalls_inject\./ nocase ascii wide
$string2159_cobaltstrike_offensive_tool_keyword = "syscalls_shinject " nocase ascii wide
$string2160_cobaltstrike_offensive_tool_keyword = "syscalls_shspawn " nocase ascii wide
$string2161_cobaltstrike_offensive_tool_keyword = "syscalls_spawn " nocase ascii wide
$string2162_cobaltstrike_offensive_tool_keyword = /syscalls_spawn\./ nocase ascii wide
$string2163_cobaltstrike_offensive_tool_keyword = /syscallsapcspawn\.x64/ nocase ascii wide
$string2164_cobaltstrike_offensive_tool_keyword = /syscalls\-asm\.h/ nocase ascii wide
$string2165_cobaltstrike_offensive_tool_keyword = /syscallsdump\.x64/ nocase ascii wide
$string2166_cobaltstrike_offensive_tool_keyword = /syscallsinject\.x64/ nocase ascii wide
$string2167_cobaltstrike_offensive_tool_keyword = /syscallsspawn\.x64/ nocase ascii wide
$string2168_cobaltstrike_offensive_tool_keyword = /systemctl\senable\steamserver\.service/ nocase ascii wide
$string2169_cobaltstrike_offensive_tool_keyword = /systemctl\sstart\steamserver\.service/ nocase ascii wide
$string2170_cobaltstrike_offensive_tool_keyword = /systemctl\sstatus\steamserver\.service/ nocase ascii wide
$string2171_cobaltstrike_offensive_tool_keyword = /SysWhispers\.git\s/ nocase ascii wide
$string2172_cobaltstrike_offensive_tool_keyword = /syswhispers\.py/ nocase ascii wide
$string2173_cobaltstrike_offensive_tool_keyword = /syswhispers\.py/ nocase ascii wide
$string2174_cobaltstrike_offensive_tool_keyword = "SysWhispers2" nocase ascii wide
$string2175_cobaltstrike_offensive_tool_keyword = /TailorScan\.exe\s/ nocase ascii wide
$string2176_cobaltstrike_offensive_tool_keyword = "TailorScan_darwin"
$string2177_cobaltstrike_offensive_tool_keyword = "TailorScan_freebsd" nocase ascii wide
$string2178_cobaltstrike_offensive_tool_keyword = "TailorScan_linux_"
$string2179_cobaltstrike_offensive_tool_keyword = "TailorScan_netbsd_" nocase ascii wide
$string2180_cobaltstrike_offensive_tool_keyword = "TailorScan_openbsd_" nocase ascii wide
$string2181_cobaltstrike_offensive_tool_keyword = /TailorScan_windows_.{0,100}\.exe/ nocase ascii wide
$string2182_cobaltstrike_offensive_tool_keyword = /TaskShell\.exe\s.{0,100}\s\-b\s.{0,100}\.exe/ nocase ascii wide
$string2183_cobaltstrike_offensive_tool_keyword = /TaskShell\.exe\s.{0,100}\s\-s\s.{0,100}SYSTEM/ nocase ascii wide
$string2184_cobaltstrike_offensive_tool_keyword = /teamserver\s.{0,100}\sc2\-profiles\// nocase ascii wide
$string2185_cobaltstrike_offensive_tool_keyword = /teamserver.{0,100}\sno_evasion\.profile/ nocase ascii wide
$string2186_cobaltstrike_offensive_tool_keyword = /TeamServer\.prop/ nocase ascii wide
$string2187_cobaltstrike_offensive_tool_keyword = /Temp\\dumpert/ nocase ascii wide
$string2188_cobaltstrike_offensive_tool_keyword = /test_invoke_bof\.x64\.o/ nocase ascii wide
$string2189_cobaltstrike_offensive_tool_keyword = "tgtdelegation " nocase ascii wide
$string2190_cobaltstrike_offensive_tool_keyword = /tgtdelegation\.cna/ nocase ascii wide
$string2191_cobaltstrike_offensive_tool_keyword = /tgtdelegation\.x64/ nocase ascii wide
$string2192_cobaltstrike_offensive_tool_keyword = /tgtdelegation\.x86/ nocase ascii wide
$string2193_cobaltstrike_offensive_tool_keyword = /tgtParse\.py\s/ nocase ascii wide
$string2194_cobaltstrike_offensive_tool_keyword = "third_party/SharpGen" nocase ascii wide
$string2195_cobaltstrike_offensive_tool_keyword = /third\-party.{0,100}winvnc.{0,100}\.dll/ nocase ascii wide
$string2196_cobaltstrike_offensive_tool_keyword = /threatexpress.{0,100}malleable/ nocase ascii wide
$string2197_cobaltstrike_offensive_tool_keyword = "threatexpress/cs2modrewrite" nocase ascii wide
$string2198_cobaltstrike_offensive_tool_keyword = /ticketConverter\.py\s.{0,100}\.ccache\s/ nocase ascii wide
$string2199_cobaltstrike_offensive_tool_keyword = "tijme/kernel-mii" nocase ascii wide
$string2200_cobaltstrike_offensive_tool_keyword = /TikiLoader.{0,100}Hollower/ nocase ascii wide
$string2201_cobaltstrike_offensive_tool_keyword = /TikiLoader\./ nocase ascii wide
$string2202_cobaltstrike_offensive_tool_keyword = /TikiLoader\./ nocase ascii wide
$string2203_cobaltstrike_offensive_tool_keyword = /TikiLoader\.dll/ nocase ascii wide
$string2204_cobaltstrike_offensive_tool_keyword = /TikiLoader\.dll/ nocase ascii wide
$string2205_cobaltstrike_offensive_tool_keyword = /TikiLoader\.Injector/ nocase ascii wide
$string2206_cobaltstrike_offensive_tool_keyword = /TikiLoader\\TikiLoader/ nocase ascii wide
$string2207_cobaltstrike_offensive_tool_keyword = /TikiSpawn\.dll/ nocase ascii wide
$string2208_cobaltstrike_offensive_tool_keyword = /TikiSpawn\.exe/ nocase ascii wide
$string2209_cobaltstrike_offensive_tool_keyword = /TikiSpawn\.ps1/ nocase ascii wide
$string2210_cobaltstrike_offensive_tool_keyword = "TikiSpawnAs" nocase ascii wide
$string2211_cobaltstrike_offensive_tool_keyword = "TikiSpawnAsAdmin" nocase ascii wide
$string2212_cobaltstrike_offensive_tool_keyword = "TikiSpawnElevated" nocase ascii wide
$string2213_cobaltstrike_offensive_tool_keyword = "TikiSpawnWOppid" nocase ascii wide
$string2214_cobaltstrike_offensive_tool_keyword = "TikiSpawnWppid" nocase ascii wide
$string2215_cobaltstrike_offensive_tool_keyword = /TikiTorch\.exe/ nocase ascii wide
$string2216_cobaltstrike_offensive_tool_keyword = /TikiVader\./ nocase ascii wide
$string2217_cobaltstrike_offensive_tool_keyword = "timwhitez/Doge-Loader" nocase ascii wide
$string2218_cobaltstrike_offensive_tool_keyword = /Tmprovider\.dll/ nocase ascii wide
$string2219_cobaltstrike_offensive_tool_keyword = /toggle_privileges\.cna/ nocase ascii wide
$string2220_cobaltstrike_offensive_tool_keyword = /toggle_privileges_bof\./ nocase ascii wide
$string2221_cobaltstrike_offensive_tool_keyword = "Toggle_Token_Privileges_BOF" nocase ascii wide
$string2222_cobaltstrike_offensive_tool_keyword = "ToggleWDigest" nocase ascii wide
$string2223_cobaltstrike_offensive_tool_keyword = "TokenStripBOF/src" nocase ascii wide
$string2224_cobaltstrike_offensive_tool_keyword = "token-vault steal" nocase ascii wide
$string2225_cobaltstrike_offensive_tool_keyword = /token\-vault\.cna/ nocase ascii wide
$string2226_cobaltstrike_offensive_tool_keyword = /token\-vault\.x64\.o/ nocase ascii wide
$string2227_cobaltstrike_offensive_tool_keyword = /token\-vault\.x86\.o/ nocase ascii wide
$string2228_cobaltstrike_offensive_tool_keyword = "trainr3kt/MemReader_BoF" nocase ascii wide
$string2229_cobaltstrike_offensive_tool_keyword = "trainr3kt/Readfile_BoF" nocase ascii wide
$string2230_cobaltstrike_offensive_tool_keyword = "TrustedPathDLLHijack" nocase ascii wide
$string2231_cobaltstrike_offensive_tool_keyword = "TrustedPath-UACBypass-BOF" nocase ascii wide
$string2232_cobaltstrike_offensive_tool_keyword = "Tycx2ry/SweetPotato" nocase ascii wide
$string2233_cobaltstrike_offensive_tool_keyword = "Tylous/SourcePoint" nocase ascii wide
$string2234_cobaltstrike_offensive_tool_keyword = "UACBypass-BOF" nocase ascii wide
$string2235_cobaltstrike_offensive_tool_keyword = "uac-schtasks " nocase ascii wide
$string2236_cobaltstrike_offensive_tool_keyword = "uac-schtasks" nocase ascii wide
$string2237_cobaltstrike_offensive_tool_keyword = "uac-silentcleanup" nocase ascii wide
$string2238_cobaltstrike_offensive_tool_keyword = "uac-token-duplication" nocase ascii wide
$string2239_cobaltstrike_offensive_tool_keyword = /uhttpsharp\./ nocase ascii wide
$string2240_cobaltstrike_offensive_tool_keyword = "uknowsec/TailorScan" nocase ascii wide
$string2241_cobaltstrike_offensive_tool_keyword = "UMJjAiNUUtvNww0lBj9tzWegwphuIn6hNP9eeIDfOrcHJ3nozYFPT-Jl7WsmbmjZnQXUesoJkcJkpdYEdqgQFE6QZgjWVsLSSDonL28DYDVJ" nocase ascii wide
$string2242_cobaltstrike_offensive_tool_keyword = "Un1k0d3r/SCShell" nocase ascii wide
$string2243_cobaltstrike_offensive_tool_keyword = /ursnif_IcedID\.profile/ nocase ascii wide
$string2244_cobaltstrike_offensive_tool_keyword = "Visual-Studio-BOF-template" nocase ascii wide
$string2245_cobaltstrike_offensive_tool_keyword = /vssenum\.x64\./ nocase ascii wide
$string2246_cobaltstrike_offensive_tool_keyword = /vssenum\.x86\./ nocase ascii wide
$string2247_cobaltstrike_offensive_tool_keyword = "vysecurity/ANGRYPUPPY" nocase ascii wide
$string2248_cobaltstrike_offensive_tool_keyword = /wcfrelayserver\.py/ nocase ascii wide
$string2249_cobaltstrike_offensive_tool_keyword = "wdigest!g_fParameter_UseLogonCredential" nocase ascii wide
$string2250_cobaltstrike_offensive_tool_keyword = "wdigest!g_IsCredGuardEnabled" nocase ascii wide
$string2251_cobaltstrike_offensive_tool_keyword = /whereami\.cna/ nocase ascii wide
$string2252_cobaltstrike_offensive_tool_keyword = /whereami\.x64/ nocase ascii wide
$string2253_cobaltstrike_offensive_tool_keyword = "WhoamiGetTokenInfo" nocase ascii wide
$string2254_cobaltstrike_offensive_tool_keyword = /wifidump\.cna/ nocase ascii wide
$string2255_cobaltstrike_offensive_tool_keyword = "windows/beacon_smb/" nocase ascii wide
$string2256_cobaltstrike_offensive_tool_keyword = /windows\-exploit\-suggester\./ nocase ascii wide
$string2257_cobaltstrike_offensive_tool_keyword = "winrmdll " nocase ascii wide
$string2258_cobaltstrike_offensive_tool_keyword = /winrmdll\./ nocase ascii wide
$string2259_cobaltstrike_offensive_tool_keyword = "Winsocky-main" nocase ascii wide
$string2260_cobaltstrike_offensive_tool_keyword = "WKL-Sec/HiddenDesktop" nocase ascii wide
$string2261_cobaltstrike_offensive_tool_keyword = "WKL-Sec/Winsocky" nocase ascii wide
$string2262_cobaltstrike_offensive_tool_keyword = "wkssvc_##" nocase ascii wide
$string2263_cobaltstrike_offensive_tool_keyword = /Wmi_Persistence\.ps1/ nocase ascii wide
$string2264_cobaltstrike_offensive_tool_keyword = /wmi\-event\-lateral\-movement\./ nocase ascii wide
$string2265_cobaltstrike_offensive_tool_keyword = /WMI\-EventSub\.cpp/ nocase ascii wide
$string2266_cobaltstrike_offensive_tool_keyword = /wmi\-lateral\-movement\./ nocase ascii wide
$string2267_cobaltstrike_offensive_tool_keyword = /WMI\-ProcessCreate\.cpp/ nocase ascii wide
$string2268_cobaltstrike_offensive_tool_keyword = "write_cs_teamserver" nocase ascii wide
$string2269_cobaltstrike_offensive_tool_keyword = "WriteAndExecuteShellcode" nocase ascii wide
$string2270_cobaltstrike_offensive_tool_keyword = "WritePayloadDllTransacted" nocase ascii wide
$string2271_cobaltstrike_offensive_tool_keyword = "wscript_elevator" nocase ascii wide
$string2272_cobaltstrike_offensive_tool_keyword = "wts_enum_remote_processes" nocase ascii wide
$string2273_cobaltstrike_offensive_tool_keyword = "wumb0/rust_bof" nocase ascii wide
$string2274_cobaltstrike_offensive_tool_keyword = "xforcered/CredBandit" nocase ascii wide
$string2275_cobaltstrike_offensive_tool_keyword = "xforcered/Detect-Hooks" nocase ascii wide
$string2276_cobaltstrike_offensive_tool_keyword = /xor\.exe\s.{0,100}\.txt/ nocase ascii wide
$string2277_cobaltstrike_offensive_tool_keyword = "xor_payload" nocase ascii wide
$string2278_cobaltstrike_offensive_tool_keyword = /xpipe\s\\\\/ nocase ascii wide
$string2279_cobaltstrike_offensive_tool_keyword = /xpipe.{0,100}lsass/ nocase ascii wide
$string2280_cobaltstrike_offensive_tool_keyword = /xpipe\.cna/ nocase ascii wide
$string2281_cobaltstrike_offensive_tool_keyword = /YDHCUI\/csload\.net/ nocase ascii wide
$string2282_cobaltstrike_offensive_tool_keyword = "YDHCUI/manjusaka" nocase ascii wide
$string2283_cobaltstrike_offensive_tool_keyword = "youcantpatchthis" nocase ascii wide
$string2284_cobaltstrike_offensive_tool_keyword = /ysoserial\.exe/ nocase ascii wide
$string2285_cobaltstrike_offensive_tool_keyword = "YwBhAGwAYwA=" nocase ascii wide
$string2286_cobaltstrike_offensive_tool_keyword = /zerologon\.x64/ nocase ascii wide
$string2287_cobaltstrike_offensive_tool_keyword = /zerologon\.x86/ nocase ascii wide
$string2288_cobaltstrike_offensive_tool_keyword = "ZeroLogon-BOF" nocase ascii wide
$string2289_cobaltstrike_offensive_tool_keyword = "zha0gongz1" nocase ascii wide
$string2290_cobaltstrike_offensive_tool_keyword = "zha0gongz1/DesertFox" nocase ascii wide
$string2291_cobaltstrike_offensive_tool_keyword = "ziiiiizzzb" nocase ascii wide
$string2292_cobaltstrike_offensive_tool_keyword = "ziiiiizzzib" nocase ascii wide
$string2293_cobaltstrike_offensive_tool_keyword = /\\\\demoagent_11/ nocase ascii wide
$string2294_cobaltstrike_offensive_tool_keyword = /\\\\demoagent_22/ nocase ascii wide
$string2295_cobaltstrike_offensive_tool_keyword = /\\\\DserNamePipe/ nocase ascii wide
$string2296_cobaltstrike_offensive_tool_keyword = /\\\\f4c3/ nocase ascii wide
$string2297_cobaltstrike_offensive_tool_keyword = /\\\\f53f/ nocase ascii wide
$string2298_cobaltstrike_offensive_tool_keyword = /\\\\fullduplex_/ nocase ascii wide
$string2299_cobaltstrike_offensive_tool_keyword = /\\\\interprocess_/ nocase ascii wide
$string2300_cobaltstrike_offensive_tool_keyword = /\\\\mojo_/ nocase ascii wide
$string2301_cobaltstrike_offensive_tool_keyword = /\\\\msagent_/ nocase ascii wide
$string2302_cobaltstrike_offensive_tool_keyword = /\\\\MsFteWds/ nocase ascii wide
$string2303_cobaltstrike_offensive_tool_keyword = /\\\\MSSE\-/ nocase ascii wide
$string2304_cobaltstrike_offensive_tool_keyword = /\\\\mypipe\-/ nocase ascii wide
$string2305_cobaltstrike_offensive_tool_keyword = /\\\\PGMessagePipe/ nocase ascii wide
$string2306_cobaltstrike_offensive_tool_keyword = /\\\\postex_/ nocase ascii wide
$string2307_cobaltstrike_offensive_tool_keyword = /\\\\postex_ssh_/ nocase ascii wide
$string2308_cobaltstrike_offensive_tool_keyword = /\\\\SearchTextHarvester/ nocase ascii wide
$string2309_cobaltstrike_offensive_tool_keyword = /\\\\UIA_PIPE/ nocase ascii wide
$string2310_cobaltstrike_offensive_tool_keyword = /\\\\Winsock2\\CatalogChangeListener\-/ nocase ascii wide
$string2311_cobaltstrike_offensive_tool_keyword = /\\Ladon\s.{0,100}\.exe/ nocase ascii wide
$string2312_cobaltstrike_offensive_tool_keyword = "detect-hooks" nocase ascii wide
$string2313_cobaltstrike_offensive_tool_keyword = /doc\.1a\..{0,100}\\\./ nocase ascii wide
$string2314_cobaltstrike_offensive_tool_keyword = /doc\.4a\..{0,100}\\\./ nocase ascii wide
$string2315_cobaltstrike_offensive_tool_keyword = /doc\.bc\..{0,100}\\\./ nocase ascii wide
$string2316_cobaltstrike_offensive_tool_keyword = /doc\.md\..{0,100}\\\./ nocase ascii wide
$string2317_cobaltstrike_offensive_tool_keyword = /doc\.po\..{0,100}\\\./ nocase ascii wide
$string2318_cobaltstrike_offensive_tool_keyword = /doc\.tx\..{0,100}\\\./ nocase ascii wide
$string2319_cobaltstrike_offensive_tool_keyword = "dumpwifi " nocase ascii wide
$string2320_cobaltstrike_offensive_tool_keyword = "etw stop" nocase ascii wide
$string2321_cobaltstrike_offensive_tool_keyword = "fw_walk display" nocase ascii wide
$string2322_cobaltstrike_offensive_tool_keyword = "fw_walk status" nocase ascii wide
$string2323_cobaltstrike_offensive_tool_keyword = "fw_walk total" nocase ascii wide
$string2324_cobaltstrike_offensive_tool_keyword = "get-spns " nocase ascii wide
$string2325_cobaltstrike_offensive_tool_keyword = /Ladon\sMac\s.{0,100}\s/ nocase ascii wide
$string2326_cobaltstrike_offensive_tool_keyword = "LdapSignCheck " nocase ascii wide
$string2327_cobaltstrike_offensive_tool_keyword = /load\s.{0,100}\.cna/ nocase ascii wide
$string2328_cobaltstrike_offensive_tool_keyword = "make_token " nocase ascii wide
$string2329_cobaltstrike_offensive_tool_keyword = "needle_sift " nocase ascii wide
$string2330_cobaltstrike_offensive_tool_keyword = /SigFlip\s.{0,100}\.exe/ nocase ascii wide
$metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
$metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
$metadata_regex_php = /<\?php/ nocase ascii
$metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
$metadata_regex_script = /<script\b/ nocase ascii
$metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
$metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
$metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
$metadata_regex_shebang = /^#!\// nocase ascii
condition:
((filesize < 20MB and (
uint16(0) == 0x5a4d or uint16(0) == 0x457f or uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or uint32(0) == 0x504B0304 or uint32(0) == 0xCAFEBABE or uint32(0) == 0x4D534346 or uint32(0) == 0xD0CF11E0 or uint16(0) == 0x2321 or uint16(0) == 0x3c3f )) and 2 of ($string*)) or
(filesize < 2MB and
(
2 of ($string*) and
for any of ($metadata_regex_*) : ( @ <= 20000 )
))
}