diff --git "a/tokenizer.json" "b/tokenizer.json" new file mode 100644--- /dev/null +++ "b/tokenizer.json" @@ -0,0 +1,25181 @@ +{ + "version": "1.0", + "truncation": null, + "padding": null, + "added_tokens": [ + { + "id": 0, + "content": "<|endoftext|>", + "single_word": false, + "lstrip": false, + "rstrip": false, + "normalized": true, + "special": true + } + ], + "normalizer": null, + "pre_tokenizer": { + "type": "ByteLevel", + "add_prefix_space": false, + "trim_offsets": true, + "use_regex": true + }, + "post_processor": { + "type": "ByteLevel", + "add_prefix_space": true, + "trim_offsets": false, + "use_regex": true + }, + "decoder": { + "type": "ByteLevel", + "add_prefix_space": true, + "trim_offsets": true, + "use_regex": true + }, + "model": { + "type": "BPE", + "dropout": null, + "unk_token": null, + "continuing_subword_prefix": "", + "end_of_word_suffix": "", + "fuse_unk": false, + "byte_fallback": false, + "vocab": { + "<|endoftext|>": 0, + "!": 1, + "\"": 2, + "#": 3, + "$": 4, + "%": 5, + "&": 6, + "'": 7, + "(": 8, + ")": 9, + "*": 10, + "+": 11, + ",": 12, + "-": 13, + ".": 14, + "/": 15, + "0": 16, + "1": 17, + "2": 18, + "3": 19, + "4": 20, + "5": 21, + "6": 22, + "7": 23, + "8": 24, + "9": 25, + ":": 26, + ";": 27, + "<": 28, + "=": 29, + ">": 30, + "?": 31, + "@": 32, + "A": 33, + "B": 34, + "C": 35, + "D": 36, + "E": 37, + "F": 38, + "G": 39, + "H": 40, + "I": 41, + "J": 42, + "K": 43, + "L": 44, + "M": 45, + "N": 46, + "O": 47, + "P": 48, + "Q": 49, + "R": 50, + "S": 51, + "T": 52, + "U": 53, + "V": 54, + "W": 55, + "X": 56, + "Y": 57, + "Z": 58, + "[": 59, + "\\": 60, + "]": 61, + "^": 62, + "_": 63, + "`": 64, + "a": 65, + "b": 66, + "c": 67, + "d": 68, + "e": 69, + "f": 70, + "g": 71, + "h": 72, + "i": 73, + "j": 74, + "k": 75, + "l": 76, + "m": 77, + "n": 78, + "o": 79, + "p": 80, + "q": 81, + "r": 82, + "s": 83, + "t": 84, + "u": 85, + "v": 86, + "w": 87, + "x": 88, + "y": 89, + "z": 90, + "{": 91, + "|": 92, + "}": 93, + "~": 94, + "¡": 95, + "¢": 96, + "£": 97, + "¤": 98, + "¥": 99, + "¦": 100, + "§": 101, + "¨": 102, + "©": 103, + "ª": 104, + "«": 105, + "¬": 106, + "®": 107, + "¯": 108, + "°": 109, + "±": 110, + "²": 111, + "³": 112, + "´": 113, + "µ": 114, + "¶": 115, + "·": 116, + "¸": 117, + "¹": 118, + "º": 119, + "»": 120, + "¼": 121, + "½": 122, + "¾": 123, + "¿": 124, + "À": 125, + "Á": 126, + "Â": 127, + "Ã": 128, + "Ä": 129, + "Å": 130, + "Æ": 131, + "Ç": 132, + "È": 133, + "É": 134, + "Ê": 135, + "Ë": 136, + "Ì": 137, + "Í": 138, + "Î": 139, + "Ï": 140, + "Ð": 141, + "Ñ": 142, + "Ò": 143, + "Ó": 144, + "Ô": 145, + "Õ": 146, + "Ö": 147, + "×": 148, + "Ø": 149, + "Ù": 150, + "Ú": 151, + "Û": 152, + "Ü": 153, + "Ý": 154, + "Þ": 155, + "ß": 156, + "à": 157, + "á": 158, + "â": 159, + "ã": 160, + "ä": 161, + "å": 162, + "æ": 163, + "ç": 164, + "è": 165, + "é": 166, + "ê": 167, + "ë": 168, + "ì": 169, + "í": 170, + "î": 171, + "ï": 172, + "ð": 173, + "ñ": 174, + "ò": 175, + "ó": 176, + "ô": 177, + "õ": 178, + "ö": 179, + "÷": 180, + "ø": 181, + "ù": 182, + "ú": 183, + "û": 184, + "ü": 185, + "ý": 186, + "þ": 187, + "ÿ": 188, + "Ā": 189, + "ā": 190, + "Ă": 191, + "ă": 192, + "Ą": 193, + "ą": 194, + "Ć": 195, + "ć": 196, + "Ĉ": 197, + "ĉ": 198, + "Ċ": 199, + "ċ": 200, + "Č": 201, + "č": 202, + "Ď": 203, + "ď": 204, + "Đ": 205, + "đ": 206, + "Ē": 207, + "ē": 208, + "Ĕ": 209, + "ĕ": 210, + "Ė": 211, + "ė": 212, + "Ę": 213, + "ę": 214, + "Ě": 215, + "ě": 216, + "Ĝ": 217, + "ĝ": 218, + "Ğ": 219, + "ğ": 220, + "Ġ": 221, + "ġ": 222, + "Ģ": 223, + "ģ": 224, + "Ĥ": 225, + "ĥ": 226, + "Ħ": 227, + "ħ": 228, + "Ĩ": 229, + "ĩ": 230, + "Ī": 231, + "ī": 232, + "Ĭ": 233, + "ĭ": 234, + "Į": 235, + "į": 236, + "İ": 237, + "ı": 238, + "IJ": 239, + "ij": 240, + "Ĵ": 241, + "ĵ": 242, + "Ķ": 243, + "ķ": 244, + "ĸ": 245, + "Ĺ": 246, + "ĺ": 247, + "Ļ": 248, + "ļ": 249, + "Ľ": 250, + "ľ": 251, + "Ŀ": 252, + "ŀ": 253, + "Ł": 254, + "ł": 255, + "Ń": 256, + "er": 257, + "Ġ-": 258, + "in": 259, + "re": 260, + "te": 261, + "on": 262, + "Ġ\"": 263, + "#{": 264, + "at": 265, + "le": 266, + "ro": 267, + "st": 268, + "Ġ/": 269, + "ic": 270, + "et": 271, + "ec": 272, + "or": 273, + "me": 274, + "ĠĠ": 275, + "nt": 276, + "al": 277, + "ut": 278, + "ss": 279, + "om": 280, + "Ġ$": 281, + "ile": 282, + "Ġ#{": 283, + "ath": 284, + "ame": 285, + "ex": 286, + "ion": 287, + "tem": 288, + "ar": 289, + "ser": 290, + "ce": 291, + "ow": 292, + "en": 293, + "file": 294, + "Ġ=": 295, + "&&": 296, + "ur": 297, + "ad": 298, + "de": 299, + "it": 300, + "lo": 301, + "an": 302, + "}\"": 303, + "ol": 304, + "of": 305, + "ll": 306, + "Path": 307, + "Pro": 308, + "ing": 309, + "name": 310, + "ass": 311, + "ho": 312, + "Win": 313, + "ys": 314, + "ct": 315, + "ri": 316, + "oft": 317, + "se": 318, + ";$": 319, + "dow": 320, + "exe": 321, + "user": 322, + "ew": 323, + "Ġ\"#{": 324, + "he": 325, + "ystem": 326, + "Ġt": 327, + "path": 328, + "put": 329, + "Ġc": 330, + "00": 331, + "Name": 332, + "ect": 333, + "Ġ|": 334, + "es": 335, + "ord": 336, + "ac": 337, + "dows": 338, + "St": 339, + "Con": 340, + "RE": 341, + "In": 342, + "Windows": 343, + "HK": 344, + "ert": 345, + "pt": 346, + "ue": 347, + "ps": 348, + "echo": 349, + "word": 350, + "reg": 351, + "ject": 352, + "\";": 353, + "Ġ'": 354, + "co": 355, + "soft": 356, + "am": 357, + "der": 358, + "Item": 359, + "com": 360, + "art": 361, + ":\\": 362, + "icro": 363, + "ĠĠĠ": 364, + "icrosoft": 365, + "Ex": 366, + "assword": 367, + "if": 368, + "Microsoft": 369, + "omic": 370, + "con": 371, + "bject": 372, + "out": 373, + "un": 374, + "ate": 375, + "ation": 376, + "and": 377, + "il": 378, + "System": 379, + "vic": 380, + "sc": 381, + "ist": 382, + "ke": 383, + "Ġ(": 384, + "Ġ>": 385, + "to": 386, + "ve": 387, + "ain": 388, + "is": 389, + "ub": 390, + "Get": 391, + "Re": 392, + "yp": 393, + "are": 394, + "cess": 395, + "as": 396, + "ch": 397, + "ers": 398, + "At": 399, + "};": 400, + "Ġs": 401, + "To": 402, + ");": 403, + "do": 404, + "New": 405, + "mo": 406, + "Ġf": 407, + "ag": 408, + "red": 409, + "output": 410, + "mp": 411, + "ab": 412, + "Ġ{": 413, + "vice": 414, + "Atomic": 415, + "py": 416, + "File": 417, + "rent": 418, + "urrent": 419, + "ra": 420, + "ter": 421, + "all": 422, + "alue": 423, + "older": 424, + "Set": 425, + "password": 426, + "ype": 427, + "add": 428, + "up": 429, + "ript": 430, + "pl": 431, + "tent": 432, + "ir": 433, + "LM": 434, + "Object": 435, + "ring": 436, + "load": 437, + "32": 438, + "ort": 439, + "ot": 440, + "HKLM": 441, + "Current": 442, + "pro": 443, + "For": 444, + "User": 445, + "ht": 446, + "pert": 447, + "omain": 448, + "Ser": 449, + "Ġ\"$": 450, + "able": 451, + "ware": 452, + "net": 453, + "mand": 454, + "ĠD": 455, + "env": 456, + "Propert": 457, + "log": 458, + "ip": 459, + "ĠĠĠĠ": 460, + "id": 461, + "new": 462, + "Cre": 463, + "nti": 464, + "Sec": 465, + "ure": 466, + "Sh": 467, + "ull": 468, + "REG": 469, + "Value": 470, + "vo": 471, + "rite": 472, + "Property": 473, + "ith": 474, + "Type": 475, + "Soft": 476, + "Ġadd": 477, + ":/": 478, + "Ġ1": 479, + "em": 480, + "ly": 481, + "Software": 482, + "su": 483, + "}&&": 484, + "Ġ--": 485, + "ction": 486, + "htt": 487, + ").": 488, + "://": 489, + "64": 490, + "Ġthe": 491, + "ersion": 492, + "Te": 493, + "ity": 494, + "Invo": 495, + "Out": 496, + "::": 497, + "https": 498, + "Ġb": 499, + "ĠREG": 500, + "content": 501, + "Lo": 502, + "ost": 503, + "Version": 504, + "cur": 505, + "denti": 506, + "dential": 507, + "ver": 508, + "xt": 509, + "hell": 510, + "Force": 511, + "Invoke": 512, + "Write": 513, + "cl": 514, + "olic": 515, + "Th": 516, + "ap": 517, + "Ġ[": 518, + "ment": 519, + "script": 520, + "Folder": 521, + "ire": 522, + "cal": 523, + "domain": 524, + "ST": 525, + "ies": 526, + "sFolder": 527, + "Start": 528, + "ul": 529, + "Com": 530, + "OR": 531, + "Polic": 532, + "ay": 533, + "AtomicsFolder": 534, + "bin": 535, + "CurrentVersion": 536, + "Host": 537, + "get": 538, + "gith": 539, + "github": 540, + "15": 541, + "EM": 542, + "unt": 543, + "raw": 544, + "ode": 545, + "PathTo": 546, + "PathToAtomicsFolder": 547, + "AD": 548, + "]::": 549, + "du": 550, + "service": 551, + "10": 552, + "CU": 553, + "qu": 554, + "ata": 555, + "emb": 556, + "En": 557, + "rc": 558, + "Ġw": 559, + "ory": 560, + "String": 561, + "12": 562, + "Ad": 563, + "OF": 564, + "th": 565, + "Net": 566, + "sh": 567, + "usercontent": 568, + "age": 569, + "githubusercontent": 570, + "Inst": 571, + "NT": 572, + "system": 573, + "md": 574, + "Cont": 575, + "ef": 576, + "urity": 577, + "ItemProperty": 578, + "Credential": 579, + "op": 580, + "test": 581, + "Ġ>>": 582, + "Process": 583, + "($": 584, + "ine": 585, + "exec": 586, + "ORD": 587, + "ent": 588, + "ls": 589, + "ry": 590, + "sSh": 591, + "Ġ0": 592, + "Ġin": 593, + "im": 594, + "sudo": 595, + "ER": 596, + "WORD": 597, + "embly": 598, + "ARE": 599, + "TW": 600, + "ase": 601, + "txt": 602, + "Ġ%": 603, + "Policies": 604, + "SOF": 605, + "eb": 606, + "TWARE": 607, + "SOFTWARE": 608, + "ĠC": 609, + "etc": 610, + "ĠNew": 611, + "Ap": 612, + "ore": 613, + "%\\": 614, + "Security": 615, + "DWORD": 616, + "ig": 617, + ";;": 618, + "`\"": 619, + "ary": 620, + "Contro": 621, + "('": 622, + "Man": 623, + "Ġ{;": 624, + "Ass": 625, + "ime": 626, + "Ġ;": 627, + "..": 628, + "Ġd": 629, + "count": 630, + "port": 631, + "command": 632, + "Install": 633, + "ind": 634, + "Control": 635, + "us": 636, + "rep": 637, + "el": 638, + "min": 639, + "ĠWrite": 640, + "ayload": 641, + "dll": 642, + "rin": 643, + "start": 644, + "ower": 645, + "Assembly": 646, + "col": 647, + "object": 648, + "ID": 649, + "Ac": 650, + "SER": 651, + "Ġ2": 652, + "Test": 653, + "Password": 654, + "ĠĠĠĠĠĠĠ": 655, + "roup": 656, + ")\"": 657, + "HI": 658, + "cmd": 659, + "USER": 660, + "ted": 661, + "/#{": 662, + "ive": 663, + "cred": 664, + "host": 665, + "Sc": 666, + "}'": 667, + "ĠGet": 668, + "tocol": 669, + "Service": 670, + "Ar": 671, + "ms": 672, + "Ġto": 673, + "code": 674, + "}\\": 675, + "ĠI": 676, + "Ġg": 677, + "local": 678, + "Ġth": 679, + "Ġa": 680, + "ĠOut": 681, + "ext": 682, + "Dis": 683, + "nload": 684, + "null": 685, + "}\";": 686, + "ack": 687, + "pyth": 688, + "python": 689, + "Power": 690, + "so": 691, + "Ġecho": 692, + "wn": 693, + "Ġ&&": 694, + "Protocol": 695, + "63": 696, + "Cl": 697, + "ror": 698, + "ctory": 699, + "username": 700, + "\"#{": 701, + "Ġex": 702, + "ication": 703, + "HKCU": 704, + "Shell": 705, + "run": 706, + "tmp": 707, + "Ġp": 708, + "atomic": 709, + "irectory": 710, + "Arg": 711, + "mote": 712, + "11": 713, + "Az": 714, + "ient": 715, + "sp": 716, + "Er": 717, + "ĠSystem": 718, + "temp": 719, + "Error": 720, + "Action": 721, + "reate": 722, + "EY": 723, + "folder": 724, + "ma": 725, + "nal": 726, + "arget": 727, + "dule": 728, + "ssion": 729, + "ach": 730, + "copy": 731, + "Users": 732, + "quer": 733, + "ument": 734, + "Ġn": 735, + "Ġ($": 736, + "ult": 737, + "36": 738, + "set": 739, + "Ġ]": 740, + "Pwn": 741, + "ru": 742, + "string": 743, + "WinPwn": 744, + "HKEY": 745, + "Add": 746, + "src": 747, + "ĠP": 748, + "und": 749, + "Command": 750, + "eq": 751, + "fig": 752, + "istry": 753, + "EX": 754, + "cat": 755, + "Ġ#": 756, + "mport": 757, + "EMP": 758, + "Se": 759, + "TEMP": 760, + "ender": 761, + "ask": 762, + "SecurityProtocol": 763, + "Run": 764, + "ud": 765, + "ild": 766, + "key": 767, + "Aut": 768, + "Ch": 769, + "PS": 770, + "os": 771, + "Ġ};": 772, + "ace": 773, + "ck": 774, + "web": 775, + "ĠDef": 776, + "..\\": 777, + "bo": 778, + "gr": 779, + "vert": 780, + "Log": 781, + "Text": 782, + "\\..\\": 783, + "rom": 784, + "Convert": 785, + "App": 786, + "))": 787, + "Id": 788, + "ault": 789, + "Ġpassword": 790, + "Installer": 791, + "Par": 792, + "target": 793, + "remote": 794, + "download": 795, + "ption": 796, + "Ġthen": 797, + "_.": 798, + "dec": 799, + "dir": 800, + "ed": 801, + "nect": 802, + "wd": 803, + "input": 804, + "ash": 805, + "ternal": 806, + "IL": 807, + "Payload": 808, + "oin": 809, + "Ġuser": 810, + "External": 811, + "Ġfi": 812, + "Azure": 813, + "\";$": 814, + "='": 815, + "As": 816, + "Time": 817, + "Ġre": 818, + "filename": 819, + "app": 820, + "gram": 821, + "Payloads": 822, + "ExternalPayloads": 823, + "');": 824, + "AT": 825, + "ME": 826, + "SY": 827, + "0000": 828, + "process": 829, + "else": 830, + "88": 831, + "Ġst": 832, + "ctive": 833, + "vices": 834, + "plication": 835, + "Server": 836, + "ErrorAction": 837, + "(\"": 838, + "Data": 839, + "cation": 840, + "for": 841, + "pass": 842, + "Ġ+": 843, + "Ġ@": 844, + "ĠHKLM": 845, + "registry": 846, + "Ġ'#{": 847, + "Exp": 848, + "client": 849, + ":#{": 850, + "List": 851, + "Ro": 852, + "um": 853, + "Secure": 854, + "HIST": 855, + "query": 856, + "Ġ];": 857, + "InstallerAssembly": 858, + "ep": 859, + "prin": 860, + "Ġ.": 861, + "Ġm": 862, + "url": 863, + "CUR": 864, + "coded": 865, + "Class": 866, + "Argument": 867, + "';": 868, + "cip": 869, + "hic": 870, + "iex": 871, + "que": 872, + "vm": 873, + "Ġnet": 874, + "ĠNT": 875, + "account": 876, + "CurrentControl": 877, + "CurrentControlSet": 878, + "Mo": 879, + "end": 880, + "Content": 881, + "move": 882, + ");$": 883, + "Use": 884, + "ĠT": 885, + "Ġif": 886, + "Ġis": 887, + "Ġ$(": 888, + "Services": 889, + "STEM": 890, + "ĠDefender": 891, + "AzureAD": 892, + "SYSTEM": 893, + "SecureString": 894, + "cipal": 895, + "CO": 896, + "be": 897, + "Ġfile": 898, + "ice": 899, + "Ġcreate": 900, + "RENT": 901, + "CURRENT": 902, + "=#{": 903, + "list": 904, + "atch": 905, + "ster": 906, + "Exec": 907, + "Output": 908, + "=\"": 909, + "Directory": 910, + "Word": 911, + "ib": 912, + "ns": 913, + "value": 914, + "inter": 915, + "puter": 916, + "mod": 917, + "ager": 918, + "Manager": 919, + "Script": 920, + "webclient": 921, + "downloadstring": 922, + "ILE": 923, + "hich": 924, + "group": 925, + "ute": 926, + "Ġde": 927, + "ination": 928, + "stination": 929, + "dev": 930, + "ance": 931, + "ilter": 932, + "agement": 933, + "execut": 934, + "Management": 935, + "Not": 936, + "ff": 937, + "gn": 938, + "opy": 939, + "ual": 940, + "}/#{": 941, + "Ġ}": 942, + "ĠConvert": 943, + "ream": 944, + "003": 945, + "systemd": 946, + "Account": 947, + "master": 948, + "55": 949, + "Domain": 950, + "SZ": 951, + "\\#{": 952, + "cp": 953, + "sub": 954, + "ws": 955, + "Ġ\\": 956, + "Ġof": 957, + "ĠRe": 958, + "Connect": 959, + "open": 960, + "73": 961, + "CL": 962, + "Code": 963, + "IEX": 964, + "Null": 965, + "var": 966, + "etho": 967, + "server": 968, + "admin": 969, + "Ġsh": 970, + "Create": 971, + "Access": 972, + "ethod": 973, + "Def": 974, + "cert": 975, + "vi": 976, + "ĠA": 977, + "urce": 978, + "Exce": 979, + "FilePath": 980, + "oint": 981, + "quest": 982, + "On": 983, + "ge": 984, + "sec": 985, + "vb": 986, + "win": 987, + "Ġ*": 988, + "ork": 989, + "arch": 990, + "old": 991, + "Program": 992, + "154": 993, + "Disable": 994, + "sole": 995, + "FILE": 996, + "cr": 997, + "fo": 998, + "her": 999, + "orer": 1000, + "cont": 1001, + "Application": 1002, + "57": 1003, + "ED": 1004, + "Web": 1005, + "ail": 1006, + "active": 1007, + "mac": 1008, + "lete": 1009, + "encoded": 1010, + "plorer": 1011, + "ServiceP": 1012, + "ĠIgn": 1013, + "\")": 1014, + "$(": 1015, + "De": 1016, + "Line": 1017, + "Pl": 1018, + "Vi": 1019, + "ell": 1020, + "non": 1021, + "Ġse": 1022, + "omation": 1023, + "owers": 1024, + "logon": 1025, + "Ġexit": 1026, + "Ġnot": 1027, + "ĠConvertTo": 1028, + "ĠIgnore": 1029, + "owershell": 1030, + "();": 1031, + "16": 1032, + "EN": 1033, + "Int": 1034, + "ĠM": 1035, + "Ġelse": 1036, + "root": 1037, + "ings": 1038, + "Automation": 1039, + "decode": 1040, + "ArgumentList": 1041, + "Fo": 1042, + "NE": 1043, + "Res": 1044, + "Sp": 1045, + "aut": 1046, + "ne": 1047, + "sing": 1048, + "work": 1049, + "yte": 1050, + "Ġart": 1051, + "ected": 1052, + "ctl": 1053, + "ainText": 1054, + "play": 1055, + "Local": 1056, + "qui": 1057, + "Enable": 1058, + "AsPl": 1059, + "macro": 1060, + "AsPlainText": 1061, + "92": 1062, + "AC": 1063, + "Col": 1064, + "Ke": 1065, + "SID": 1066, + "bash": 1067, + "data": 1068, + "ml": 1069, + "payload": 1070, + "wall": 1071, + "console": 1072, + "121": 1073, + "26": 1074, + "86": 1075, + "Bas": 1076, + "Des": 1077, + "mi": 1078, + "time": 1079, + "{;": 1080, + "}.": 1081, + "Ġl": 1082, + "team": 1083, + "leep": 1084, + "icPar": 1085, + "Ġ$_.": 1086, + "001": 1087, + "Explorer": 1088, + "istory": 1089, + "Location": 1090, + "binary": 1091, + "PSCredential": 1092, + "UseBas": 1093, + "icParsing": 1094, + "UseBasicParsing": 1095, + "Filter": 1096, + "LO": 1097, + "WR": 1098, + "\\\"": 1099, + "clo": 1100, + "date": 1101, + "no": 1102, + "type": 1103, + "ress": 1104, + "text": 1105, + "lease": 1106, + "str": 1107, + "PropertyType": 1108, + "638": 1109, + "CommandLine": 1110, + "interactive": 1111, + "()": 1112, + "215": 1113, + "5638": 1114, + "Bo": 1115, + "cbe": 1116, + "dce": 1117, + "iz": 1118, + "per": 1119, + "round": 1120, + "aca": 1121, + "reground": 1122, + "Ġsu": 1123, + "irewall": 1124, + "repo": 1125, + "Ġgrep": 1126, + "3688": 1127, + "ointManager": 1128, + "5773": 1129, + "ServicePointManager": 1130, + "noninteractive": 1131, + "21563": 1132, + "dcee": 1133, + "368821563": 1134, + "\"&&": 1135, + "')": 1136, + "Copy": 1137, + "Do": 1138, + "NA": 1139, + "Tls": 1140, + "bu": 1141, + "import": 1142, + "powershell": 1143, + "sys": 1144, + "}\",": 1145, + "Ġcon": 1146, + "top": 1147, + "vent": 1148, + "Team": 1149, + "duct": 1150, + "Admin": 1151, + "99": 1152, + "AL": 1153, + "AP": 1154, + "PD": 1155, + "SI": 1156, + "cd": 1157, + "tr": 1158, + "Ġ5": 1159, + "Ġh": 1160, + "Ġstart": 1161, + "one": 1162, + "ific": 1163, + "Remove": 1164, + "AtomicTest": 1165, + "rincipal": 1166, + "PowerShell": 1167, + "SecurityProtocolType": 1168, + "print": 1169, + "ibr": 1170, + "Foreground": 1171, + "Color": 1172, + "\",": 1173, + "Cert": 1174, + "No": 1175, + "ok": 1176, + "sid": 1177, + "which": 1178, + "zip": 1179, + "ĠSet": 1180, + "Ġrun": 1181, + "Ġquery": 1182, + "lect": 1183, + "}\";$": 1184, + "002": 1185, + "ĠData": 1186, + "Child": 1187, + "Module": 1188, + "COD": 1189, + "View": 1190, + "ForegroundColor": 1191, + "Un": 1192, + "pad": 1193, + "tp": 1194, + "wm": 1195, + "Ġnew": 1196, + "alse": 1197, + "scription": 1198, + "ENCOD": 1199, + "consoleoutput": 1200, + "ibrary": 1201, + "ENCODED": 1202, + "([": 1203, + "Act": 1204, + "Method": 1205, + "line": 1206, + "nul": 1207, + "tings": 1208, + "Ġand": 1209, + "Ġoutput": 1210, + "Ġ`\"": 1211, + "Ġpython": 1212, + "ilent": 1213, + "config": 1214, + "credFile": 1215, + "atomics": 1216, + "HISTFILE": 1217, + "Inter": 1218, + "wmic": 1219, + "=$(": 1220, + "\\$": 1221, + "ple": 1222, + "Ġtest": 1223, + "util": 1224, + "ssh": 1225, + "Winlogon": 1226, + "Ġ||": 1227, + "Ġfrom": 1228, + "Ġ\"$(": 1229, + "1036": 1230, + "',": 1231, + "Cred": 1232, + "Group": 1233, + "Mal": 1234, + "af": 1235, + "ak": 1236, + "fer": 1237, + "ĠS": 1238, + "redential": 1239, + "ick": 1240, + "Stop": 1241, + "isable": 1242, + "doc": 1243, + "Ġfor": 1244, + "FileName": 1245, + "Doc": 1246, + "NAME": 1247, + "AR": 1248, + "IN": 1249, + "Off": 1250, + "Task": 1251, + "Up": 1252, + "can": 1253, + "ill": 1254, + "ld": 1255, + "sv": 1256, + "tra": 1257, + "vir": 1258, + "ĠW": 1259, + "tection": 1260, + "atus": 1261, + "lock": 1262, + "Ġcom": 1263, + "redcan": 1264, + "Temp": 1265, + "Expected": 1266, + "olden": 1267, + "quired": 1268, + "LOC": 1269, + "ificate": 1270, + "Actual": 1271, + "redcanary": 1272, + "04": 1273, + "19": 1274, + "Rec": 1275, + "ber": 1276, + "bat": 1277, + "base": 1278, + "li": 1279, + "init": 1280, + "tepad": 1281, + "ond": 1282, + "ator": 1283, + "arp": 1284, + "Ġset": 1285, + "proc": 1286, + "TypeName": 1287, + "Policy": 1288, + "ATA": 1289, + "Key": 1290, + "APPD": 1291, + "APPDATA": 1292, + "13": 1293, + ":\"": 1294, + ";;$": 1295, + ";};": 1296, + "IG": 1297, + "Library": 1298, + "RO": 1299, + "UL": 1300, + "aws": 1301, + "dc": 1302, + "mk": 1303, + "sa": 1304, + "uname": 1305, + "ĠInvoke": 1306, + "Ġget": 1307, + "Ġ\"\"": 1308, + "Ġ\"/": 1309, + "rome": 1310, + "exit": 1311, + "Ġbase": 1312, + "curl": 1313, + "USERNAME": 1314, + "udit": 1315, + "CLSID": 1316, + "vbs": 1317, + "here": 1318, + "auth": 1319, + "ytes": 1320, + "playName": 1321, + "redcanaryco": 1322, + ";#": 1323, + ">&": 1324, + "Full": 1325, + "Import": 1326, + "Sleep": 1327, + "]\"": 1328, + "grep": 1329, + "rm": 1330, + "~/": 1331, + "ĠY": 1332, + "ĠFor": 1333, + "Ġlog": 1334, + "Ġ~/": 1335, + "inue": 1336, + "att": 1337, + "def": 1338, + "ample": 1339, + "Request": 1340, + "Files": 1341, + "achine": 1342, + "Session": 1343, + "Destination": 1344, + "cloud": 1345, + "Ġsudo": 1346, + "ChildItem": 1347, + ":$": 1348, + "aun": 1349, + "bit": 1350, + "create": 1351, + "dy": 1352, + "false": 1353, + "history": 1354, + "ning": 1355, + "og": 1356, + "rCode": 1357, + "uid": 1358, + "wr": 1359, + "Ġ3": 1360, + "errCode": 1361, + "reen": 1362, + "tens": 1363, + "ĠĠĠĠĠ": 1364, + "Protection": 1365, + "Ġcat": 1366, + "ify": 1367, + "module": 1368, + "105": 1369, + "Args": 1370, + "space": 1371, + "icket": 1372, + "aunch": 1373, + "tension": 1374, + "Dir": 1375, + "Ru": 1376, + "fil": 1377, + "ken": 1378, + "ound": 1379, + "pw": 1380, + "ĠHKCU": 1381, + "Ġ\"*": 1382, + "role": 1383, + "hel": 1384, + "heet": 1385, + "ubl": 1386, + "Red": 1387, + "Ġfind": 1388, + "ĠĠĠĠĠĠĠĠĠĠĠ": 1389, + "Computer": 1390, + "execute": 1391, + "oreach": 1392, + "startup": 1393, + "source": 1394, + "Classes": 1395, + "Default": 1396, + "vider": 1397, + "Excel": 1398, + "cron": 1399, + "WebRequest": 1400, + "LOCAL": 1401, + "01": 1402, + ";&&": 1403, + "Dow": 1404, + "EL": 1405, + "NUL": 1406, + "ave": 1407, + "db": 1408, + "ding": 1409, + "item": 1410, + "nc": 1411, + "ob": 1412, + "ph": 1413, + "rv": 1414, + "sheet": 1415, + "use": 1416, + "Ġ,": 1417, + "Ġdo": 1418, + "Ġls": 1419, + "ading": 1420, + "Ġch": 1421, + "ache": 1422, + "Stream": 1423, + "computer": 1424, + "andom": 1425, + "ObjectId": 1426, + "Role": 1427, + "windows": 1428, + "ilently": 1429, + "$_.": 1430, + ".\";": 1431, + "40": 1432, + "Cell": 1433, + "Event": 1434, + "Find": 1435, + "From": 1436, + "Pre": 1437, + "Principal": 1438, + "The": 1439, + "ait": 1440, + "find": 1441, + "ktop": 1442, + "mal": 1443, + "ng": 1444, + "not": 1445, + "uf": 1446, + "ust": 1447, + "wind": 1448, + "ink": 1449, + "ten": 1450, + "arg": 1451, + "ari": 1452, + "own": 1453, + "ence": 1454, + "dent": 1455, + "destination": 1456, + "off": 1457, + "Provider": 1458, + "Ġcredential": 1459, + "Reg": 1460, + "class": 1461, + "Comp": 1462, + "AppData": 1463, + "Param": 1464, + "registryPath": 1465, + "mkdir": 1466, + "Download": 1467, + "Cells": 1468, + "windir": 1469, + ")&&": 1470, + "20": 1471, + "All": 1472, + "Cim": 1473, + "DC": 1474, + "IT": 1475, + "NO": 1476, + "Ut": 1477, + "\\|": 1478, + "js": 1479, + "mer": 1480, + "pwd": 1481, + "shell": 1482, + "ĠWin": 1483, + "rive": 1484, + "Consu": 1485, + "Sharp": 1486, + "Ġbe": 1487, + "calc": 1488, + "imum": 1489, + "usr": 1490, + "rule": 1491, + "Login": 1492, + "ATH": 1493, + "Root": 1494, + "InstallerAssemblyFileName": 1495, + "InstallerAssemblyDir": 1496, + "MalDoc": 1497, + "Office": 1498, + "Ġcommand": 1499, + "ExpectedOutput": 1500, + "ActualOutput": 1501, + "ublic": 1502, + "Util": 1503, + "Consumer": 1504, + "Go": 1505, + "IP": 1506, + "Qu": 1507, + "ax": 1508, + "cate": 1509, + "ccess": 1510, + "dsc": 1511, + "ev": 1512, + "ource": 1513, + "uild": 1514, + "Ġen": 1515, + "Ġpro": 1516, + "inst": 1517, + "ssl": 1518, + "assembly": 1519, + "riv": 1520, + "006": 1521, + "coding": 1522, + "ages": 1523, + "plist": 1524, + "Instance": 1525, + ";;#": 1526, + "InstallUtil": 1527, + "msi": 1528, + "executable": 1529, + "Exception": 1530, + "contain": 1531, + "*\"": 1532, + "46": 1533, + "Each": 1534, + "HT": 1535, + "Im": 1536, + "IWR": 1537, + "Ident": 1538, + "Mp": 1539, + "MAC": 1540, + "Sub": 1541, + "audit": 1542, + "cript": 1543, + "golden": 1544, + "lt": 1545, + "lag": 1546, + "mon": 1547, + "man": 1548, + "pen": 1549, + "pid": 1550, + "si": 1551, + "task": 1552, + "})": 1553, + "};$": 1554, + "Ġ&": 1555, + "ĠO": 1556, + "ĠSe": 1557, + "exfil": 1558, + "delete": 1559, + "Ġcurrent": 1560, + "Config": 1561, + "region": 1562, + "Startup": 1563, + "dump": 1564, + ")\";$": 1565, + "HINE": 1566, + "DisplayName": 1567, + "rundll": 1568, + "subscription": 1569, + "ize": 1570, + "ference": 1571, + "args": 1572, + "MACHINE": 1573, + "56": 1574, + ">/": 1575, + "Mode": 1576, + "OM": 1577, + "Vari": 1578, + "ast": 1579, + "io": 1580, + "iwr": 1581, + "mat": 1582, + "ool": 1583, + "tual": 1584, + "uch": 1585, + "write": 1586, + "ĠH": 1587, + "Ġad": 1588, + "Ġexecut": 1589, + "Ġ\"=": 1590, + "Ġ\"[": 1591, + "ard": 1592, + "Product": 1593, + "search": 1594, + "istr": 1595, + "vel": 1596, + "Real": 1597, + "Read": 1598, + "asquer": 1599, + "Short": 1600, + "End": 1601, + "Encoding": 1602, + "Ġwith": 1603, + "Network": 1604, + "share": 1605, + "Sche": 1606, + "}\\#{": 1607, + "Execute": 1608, + "Ġdelete": 1609, + "ellow": 1610, + "Resource": 1611, + "Desktop": 1612, + "Ġconfig": 1613, + "ĠYellow": 1614, + "ogle": 1615, + "hello": 1616, + "*.": 1617, + ".;": 1618, + "30": 1619, + "37": 1620, + "An": 1621, + "Dll": 1622, + "IO": 1623, + "Ver": 1624, + "face": 1625, + "foreach": 1626, + "kat": 1627, + "pam": 1628, + "Ġk": 1629, + "ĠFiles": 1630, + "ree": 1631, + "onment": 1632, + "Ġ\"\\": 1633, + "let": 1634, + "row": 1635, + "stream": 1636, + "adow": 1637, + "004": 1638, + "\";;": 1639, + "ification": 1640, + "arent": 1641, + "dock": 1642, + "Ġfound": 1643, + "AtomicRed": 1644, + "profile": 1645, + "1055": 1646, + "1204": 1647, + "imi": 1648, + "creds": 1649, + "ĠOutput": 1650, + "Client": 1651, + "box": 1652, + "force": 1653, + "principal": 1654, + "Enabled": 1655, + "Certificate": 1656, + "Ġcommands": 1657, + "Image": 1658, + "cription": 1659, + "ĠSelect": 1660, + "Ġexecution": 1661, + "istrator": 1662, + "katz": 1663, + "docker": 1664, + "AtomicRedTeam": 1665, + "22": 1666, + "@#{": 1667, + "Ag": 1668, + "HO": 1669, + "Memb": 1670, + "ND": 1671, + "PID": 1672, + "SC": 1673, + "SD": 1674, + "Tr": 1675, + "VM": 1676, + "ant": 1677, + "cm": 1678, + "full": 1679, + "masquer": 1680, + "sy": 1681, + "who": 1682, + "xml": 1683, + "ĠStart": 1684, + "read": 1685, + "onse": 1686, + "Ġ\"%": 1687, + "orage": 1688, + "Ġ$($": 1689, + "export": 1690, + "enu": 1691, + "loit": 1692, + "ctor": 1693, + "Ġcatch": 1694, + "005": 1695, + "ami": 1696, + "Token": 1697, + "netsh": 1698, + "clu": 1699, + "clsid": 1700, + "duled": 1701, + "Ġno": 1702, + "passwd": 1703, + "secure": 1704, + "1546": 1705, + "1547": 1706, + "ness": 1707, + "macrocode": 1708, + "ART": 1709, + "dscl": 1710, + "masquerading": 1711, + "\").": 1712, + "Base": 1713, + "Bytes": 1714, + "Le": 1715, + "Min": 1716, + "Vir": 1717, + "ZX": 1718, + "fter": 1719, + "ite": 1720, + "la": 1721, + "ler": 1722, + "tim": 1723, + "ump": 1724, + "val": 1725, + "Ġit": 1726, + "Ġhttps": 1727, + "ĠAD": 1728, + "Ġroot": 1729, + "rect": 1730, + "eck": 1731, + "orrect": 1732, + "exp": 1733, + "ans": 1734, + "ItemType": 1735, + "SystemRoot": 1736, + "Remote": 1737, + "Ġso": 1738, + "Ġsp": 1739, + "Ġwhich": 1740, + "Continue": 1741, + "('#{": 1742, + "rust": 1743, + "Search": 1744, + "Chrome": 1745, + "Ġ\\\\#{": 1746, + "Ġsession": 1747, + "mission": 1748, + "notepad": 1749, + "','": 1750, + "Ġfindstr": 1751, + "Preference": 1752, + "office": 1753, + "Ġcredentials": 1754, + "Google": 1755, + "Scheduled": 1756, + "imikatz": 1757, + "(\"#{": 1758, + "44": 1759, + ";}": 1760, + "MEM": 1761, + "ZE": 1762, + "[$": 1763, + "back": 1764, + "ca": 1765, + "df": 1766, + "jse": 1767, + "Ġout": 1768, + "Ġlocal": 1769, + "erber": 1770, + "mess": 1771, + "Ġ${": 1772, + "files": 1773, + "uration": 1774, + "ded": 1775, + "Ġcmd": 1776, + "conf": 1777, + "ish": 1778, + "place": 1779, + "irst": 1780, + "156": 1781, + "Envir": 1782, + "Ġwe": 1783, + "ign": 1784, + "Ġexp": 1785, + "Address": 1786, + "bose": 1787, + "Ġstop": 1788, + "DirectoryServices": 1789, + "openssl": 1790, + "Description": 1791, + "SIZE": 1792, + "Recur": 1793, + "install": 1794, + "whoami": 1795, + "Environment": 1796, + "\"}": 1797, + ".\\": 1798, + "/*": 1799, + "/&&": 1800, + "09": 1801, + "27": 1802, + "29": 1803, + "Build": 1804, + "Fe": 1805, + "Open": 1806, + "PR": 1807, + "Per": 1808, + "Pack": 1809, + "PWord": 1810, + "Ter": 1811, + "aem": 1812, + "action": 1813, + "den": 1814, + "dInvoke": 1815, + "directory": 1816, + "ftp": 1817, + "gg": 1818, + "gory": 1819, + "ia": 1820, + "lApp": 1821, + "ping": 1822, + "ume": 1823, + "}:#{": 1824, + "ĠF": 1825, + "ĠG": 1826, + "ĠU": 1827, + "Ġe": 1828, + "Ġx": 1829, + "Ġon": 1830, + "Ġname": 1831, + "Ġas": 1832, + "ĠUser": 1833, + "ĠHKEY": 1834, + "ĠProtection": 1835, + "release": 1836, + "ature": 1837, + "stat": 1838, + "arness": 1839, + "&&#": 1840, + "ang": 1841, + "rib": 1842, + "sent": 1843, + "users": 1844, + "Ref": 1845, + "ypass": 1846, + "Ġ{}": 1847, + "Ġ{$_.": 1848, + "ray": 1849, + "raph": 1850, + "plit": 1851, + "program": 1852, + "product": 1853, + "Properties": 1854, + "idden": 1855, + "aper": 1856, + "sudoers": 1857, + "`\")\";$": 1858, + "TestArgs": 1859, + "Ġgroup": 1860, + "ĠPlease": 1861, + "ptional": 1862, + "append": 1863, + "Expand": 1864, + "Programs": 1865, + "ĠMenu": 1866, + "Administrator": 1867, + "FullPath": 1868, + "Rule": 1869, + "ufw": 1870, + "ccessfull": 1871, + "InstallUtilAssembly": 1872, + "Identity": 1873, + "Model": 1874, + "AndInvoke": 1875, + "ĠOutputAssembly": 1876, + "Member": 1877, + "officeProduct": 1878, + "ScheduledTask": 1879, + "Recurse": 1880, + "BuildAndInvoke": 1881, + "PROF": 1882, + "aemon": 1883, + "ccessfully": 1884, + "BuildAndInvokeInstallUtilAssembly": 1885, + "--": 1886, + "BA": 1887, + "Firewall": 1888, + "Maf": 1889, + "Public": 1890, + "Random": 1891, + "Xml": 1892, + "act": 1893, + "hand": 1894, + "iam": 1895, + "mm": 1896, + "mimikatz": 1897, + "ount": 1898, + "rer": 1899, + "rcl": 1900, + "vc": 1901, + "ĠString": 1902, + "Ġvalue": 1903, + "led": 1904, + "level": 1905, + "extension": 1906, + "lose": 1907, + "regsv": 1908, + "comp": 1909, + "unction": 1910, + "scht": 1911, + "ypted": 1912, + "chmod": 1913, + "hta": 1914, + "ĠDirectory": 1915, + "ĠDWord": 1916, + "Second": 1917, + "Ġwin": 1918, + "rypt": 1919, + "PowerSp": 1920, + "PowerView": 1921, + "ĠPack": 1922, + "asks": 1923, + "cket": 1924, + "appdata": 1925, + "registryValue": 1926, + "HISTIG": 1927, + "Ġ.\\": 1928, + "anced": 1929, + "ĠRed": 1930, + "crypted": 1931, + "fox": 1932, + "stratus": 1933, + "true": 1934, + "PowerShellMaf": 1935, + "\",\"": 1936, + "like": 1937, + "attrib": 1938, + "default": 1939, + "ilentlyContinue": 1940, + "Paramet": 1941, + "NORE": 1942, + "category": 1943, + "container": 1944, + "Variable": 1945, + "HOME": 1946, + "Virtual": 1947, + "rclone": 1948, + "schtasks": 1949, + "PowerSploit": 1950, + "HISTIGNORE": 1951, + "PowerShellMafia": 1952, + "\");": 1953, + "'t": 1954, + "((": 1955, + "./": 1956, + "21": 1957, + "94": 1958, + ":\"#{": 1959, + ";#{": 1960, + "Active": 1961, + "ET": 1962, + "GV": 1963, + "IC": 1964, + "My": 1965, + "Save": 1966, + "War": 1967, + "\\{": 1968, + "ake": 1969, + "bi": 1970, + "di": 1971, + "drive": 1972, + "gt": 1973, + "gal": 1974, + "node": 1975, + "ored": 1976, + "paper": 1977, + "vf": 1978, + "ĠB": 1979, + "Ġun": 1980, + "ĠAtomic": 1981, + "Ġtemp": 1982, + "Ġprocess": 1983, + "Ġadmin": 1984, + "ĠEnable": 1985, + "ĠNo": 1986, + "inal": 1987, + "reak": 1988, + "teul": 1989, + "iled": 1990, + "ark": 1991, + "debu": 1992, + "ange": 1993, + "}\")": 1994, + "olume": 1995, + "Ġtry": 1996, + "acce": 1997, + "access": 1998, + "pty": 1999, + "software": 2000, + "Ġsystem": 2001, + "terms": 2002, + "irm": 2003, + "newPassword": 2004, + "newCred": 2005, + "sult": 2006, + "OutFile": 2007, + "irefox": 2008, + "1555": 2009, + "Encoded": 2010, + "minal": 2011, + "Screen": 2012, + "PowerSharp": 2013, + "Ġprer": 2014, + "spool": 2015, + "mail": 2016, + "setuid": 2017, + "Ġrequest": 2018, + "Ġrequired": 2019, + "Ġstored": 2020, + "InstallerAssemblyFullPath": 2021, + "Arguments": 2022, + "Ġshow": 2023, + "contro": 2024, + "NET": 2025, + "Internet": 2026, + "Minimum": 2027, + "ĠADD": 2028, + "Feature": 2029, + "Terminal": 2030, + "regsvr": 2031, + "termsrv": 2032, + "$_": 2033, + "));": 2034, + ",$": 2035, + "80": 2036, + "89": 2037, + ";\"": 2038, + "FS": 2039, + "FWR": 2040, + "Hel": 2041, + "Join": 2042, + "Launch": 2043, + "ML": 2044, + "Mail": 2045, + "Max": 2046, + "QB": 2047, + "SP": 2048, + "disable": 2049, + "fd": 2050, + "gine": 2051, + "iv": 2052, + "kip": 2053, + "ni": 2054, + "pu": 2055, + "pteul": 2056, + "wc": 2057, + "xs": 2058, + "xy": 2059, + "yan": 2060, + "{$": 2061, + "Ġ<": 2062, + "ĠL": 2063, + "Ġj": 2064, + "Ġare": 2065, + "Ġlist": 2066, + "ĠCreate": 2067, + "ĠGroup": 2068, + "Ġatt": 2069, + "Ġuse": 2070, + "ins": 2071, + "lection": 2072, + "leng": 2073, + "exce": 2074, + "example": 2075, + "aram": 2076, + "lob": 2077, + "look": 2078, + "Ġcan": 2079, + "Ġcode": 2080, + "pture": 2081, + "\";;$": 2082, + "ifi": 2083, + "ilver": 2084, + "ked": 2085, + "isplay": 2086, + "Ġsub": 2087, + "update": 2088, + "plink": 2089, + "api": 2090, + "application": 2091, + "systemctl": 2092, + "enter": 2093, + ";;;": 2094, + "Auto": 2095, + "body": 2096, + "Logon": 2097, + "Ġ@{": 2098, + "COM": 2099, + "ĠRemove": 2100, + "Connection": 2101, + "Once": 2102, + "Online": 2103, + "security": 2104, + "Ġsed": 2105, + "Viewer": 2106, + "Update": 2107, + "svc": 2108, + "trail": 2109, + "Recon": 2110, + "ĠForEach": 2111, + "bits": 2112, + "ELN": 2113, + "ITELN": 2114, + "Agent": 2115, + "gger": 2116, + "debug": 2117, + "accepteul": 2118, + "FWRITELN": 2119, + "Ġattack": 2120, + "length": 2121, + "accepteula": 2122, + "\"))": 2123, + "().": 2124, + ".\"": 2125, + "011": 2126, + "34": 2127, + "BSD": 2128, + "Cut": 2129, + "EC": 2130, + "FE": 2131, + "Free": 2132, + "Firefox": 2133, + "MD": 2134, + "NP": 2135, + "OL": 2136, + "Oper": 2137, + "Pword": 2138, + "Su": 2139, + "Uri": 2140, + "WS": 2141, + "WScript": 2142, + "cscript": 2143, + "cted": 2144, + "dd": 2145, + "dap": 2146, + "filter": 2147, + "firm": 2148, + "gcloud": 2149, + "ial": 2150, + "iss": 2151, + "lm": 2152, + "od": 2153, + "our": 2154, + "optional": 2155, + "rb": 2156, + "wb": 2157, + "}@#{": 2158, + "ĠV": 2159, + "Ġal": 2160, + "ĠTest": 2161, + "Ġkey": 2162, + "ĠServer": 2163, + "ĠJoin": 2164, + "ery": 2165, + "resh": 2166, + "result": 2167, + "tected": 2168, + "onate": 2169, + "only": 2170, + "Ġ\"(": 2171, + "stop": 2172, + "mem": 2173, + "enc": 2174, + "del": 2175, + "Profile": 2176, + "userprincipal": 2177, + "Ġcl": 2178, + "Ġcp": 2179, + "Ġcut": 2180, + "Namespace": 2181, + "Store": 2182, + "unk": 2183, + "ated": 2184, + "mount": 2185, + "Ġfirewall": 2186, + "allow": 2187, + "Settings": 2188, + "ĠDisable": 2189, + "ĠĠĠĠĠĠĠĠĠĠĠĠĠĠĠ": 2190, + "ntime": 2191, + "ComObject": 2192, + "Ġwhere": 2193, + "AdFind": 2194, + "objectcategory": 2195, + "ĠIS": 2196, + "Ġpass": 2197, + "1137": 2198, + "settings": 2199, + "ĠDefault": 2200, + "Ġ@{;": 2201, + "interface": 2202, + "Ġdef": 2203, + "Notice": 2204, + "ailure": 2205, + "quiet": 2206, + "}.#{": 2207, + "close": 2208, + "Box": 2209, + "syslog": 2210, + "Creds": 2211, + "ĠSilentlyContinue": 2212, + ";};;$": 2213, + "Ġ~/.": 2214, + "Query": 2215, + "evil": 2216, + "MpPreference": 2217, + "Configuration": 2218, + "Ġadvf": 2219, + "ShortCut": 2220, + "NetworkCredential": 2221, + "Verbose": 2222, + "rowser": 2223, + "Legal": 2224, + "erberos": 2225, + "Warning": 2226, + "FreeBSD": 2227, + "userprincipalname": 2228, + "Ġadvfirewall": 2229, + "LegalNotice": 2230, + ")'": 2231, + ")(": 2232, + "++": 2233, + "02": 2234, + "1105": 2235, + "72": 2236, + ";%": 2237, + "AB": 2238, + "AS": 2239, + "Bin": 2240, + "Block": 2241, + "GET": 2242, + "IF": 2243, + "Ms": 2244, + "SE": 2245, + "SV": 2246, + "Tri": 2247, + "UT": 2248, + "WD": 2249, + "Wall": 2250, + "Wmi": 2251, + "_).": 2252, + "aW": 2253, + "ays": 2254, + "ascript": 2255, + "dge": 2256, + "fi": 2257, + "flag": 2258, + "map": 2259, + "nk": 2260, + "priv": 2261, + "parent": 2262, + "ponse": 2263, + "rd": 2264, + "rame": 2265, + "rac": 2266, + "sleep": 2267, + "size": 2268, + "split": 2269, + "tcp": 2270, + "tgt": 2271, + "uac": 2272, + "ups": 2273, + "xll": 2274, + "zer": 2275, + "},": 2276, + "Ġ!": 2277, + "Ġte": 2278, + "Ġ;$": 2279, + "ĠEx": 2280, + "Ġservice": 2281, + "ĠService": 2282, + "Ġopen": 2283, + "ĠCommandLine": 2284, + "erro": 2285, + "Ġ->": 2286, + "inf": 2287, + "Ġ\"#": 2288, + "roups": 2289, + "org": 2290, + "alled": 2291, + "encode": 2292, + "urge": 2293, + "itor": 2294, + "itch": 2295, + "ller": 2296, + "Window": 2297, + "session": 2298, + "Ġtype": 2299, + "Ġcall": 2300, + "Ġcorrect": 2301, + "0001": 2302, + "Info": 2303, + "\";}": 2304, + "\";};": 2305, + "Extension": 2306, + "touch": 2307, + "Ġsilently": 2308, + "Ġskip": 2309, + "raction": 2310, + "tern": 2311, + "address": 2312, + "propert": 2313, + "proxy": 2314, + "Ġbin": 2315, + "Ġbash": 2316, + "Load": 2317, + "ADSI": 2318, + "Ġwas": 2319, + "ĠCyan": 2320, + "starting": 2321, + "}',": 2322, + "ĠIP": 2323, + "Ġaws": 2324, + "Ġexist": 2325, + "1119": 2326, + "ClassName": 2327, + "Ġcreated": 2328, + "Notification": 2329, + "view": 2330, + "continue": 2331, + "WebClient": 2332, + "Response": 2333, + "macroCode": 2334, + "timeout": 2335, + "ization": 2336, + "\"&&./": 2337, + "ĠSettings": 2338, + "ustom": 2339, + "classes": 2340, + "json": 2341, + "Ġnobody": 2342, + "timer": 2343, + "valid": 2344, + "backup": 2345, + "ĠPackages": 2346, + "Parameters": 2347, + "ramework": 2348, + "erroraction": 2349, + "Ġsilentlycontinue": 2350, + "\":": 2351, + "(`\"": 2352, + "();$": 2353, + "**": 2354, + "319": 2355, + "54": 2356, + "=$": 2357, + "AU": 2358, + "AAD": 2359, + "After": 2360, + "By": 2361, + "Date": 2362, + "Framework": 2363, + "Ht": 2364, + "II": 2365, + "KC": 2366, + "LL": 2367, + "Lsa": 2368, + "MS": 2369, + "Me": 2370, + "OT": 2371, + "Ph": 2372, + "PRO": 2373, + "RL": 2374, + "Spy": 2375, + "Send": 2376, + "TR": 2377, + "Tec": 2378, + "Wait": 2379, + "ZW": 2380, + "\\\\": 2381, + "].": 2382, + "apture": 2383, + "cut": 2384, + "event": 2385, + "go": 2386, + "ging": 2387, + "hv": 2388, + "hile": 2389, + "krb": 2390, + "low": 2391, + "mpt": 2392, + "mup": 2393, + "machine": 2394, + "pip": 2395, + "random": 2396, + "sk": 2397, + "tn": 2398, + "ts": 2399, + "try": 2400, + "vss": 2401, + "xd": 2402, + "}:": 2403, + "}{": 2404, + "Ġpath": 2405, + "Ġ00": 2406, + "Ġid": 2407, + "ĠNet": 2408, + "ĠSecurity": 2409, + "ĠShell": 2410, + "Ġeq": 2411, + "ĠAs": 2412, + "Ġaccount": 2413, + "ĠAzureAD": 2414, + "Ġmod": 2415, + "ĠTeam": 2416, + "Ġ99": 2417, + "Ġssh": 2418, + "ĠStop": 2419, + "Ġiam": 2420, + "invo": 2421, + "Ġ\"\\$": 2422, + "lear": 2423, + "storage": 2424, + "icio": 2425, + "etter": 2426, + "etonate": 2427, + "ution": 2428, + "armup": 2429, + "encrypted": 2430, + "filepath": 2431, + "dest": 2432, + "down": 2433, + "Ġticket": 2434, + "Context": 2435, + "Consent": 2436, + "Confirm": 2437, + "Ġ'#": 2438, + "Ġ'$": 2439, + "connect": 2440, + "screen": 2441, + "keys": 2442, + "Ġ([": 2443, + "isten": 2444, + "chunk": 2445, + "project": 2446, + "ĠDis": 2447, + "ĠDWORD": 2448, + "login": 2449, + "empty": 2450, + "http": 2451, + "://#{": 2452, + "START": 2453, + "Env": 2454, + "Ġwait": 2455, + "ports": 2456, + "porting": 2457, + "}';": 2458, + "Ġtouch": 2459, + "localappdata": 2460, + "rute": 2461, + "00000001": 2462, + "format": 2463, + "umb": 2464, + "NotAfter": 2465, + "subnet": 2466, + "Defender": 2467, + "oldvalue": 2468, + "ProgramData": 2469, + "1543": 2470, + "EDAC": 2471, + "Ġselect": 2472, + "1613": 2473, + "Body": 2474, + "build": 2475, + "document": 2476, + "FullName": 2477, + "Runtime": 2478, + "Downloads": 2479, + "Substring": 2480, + "tasklist": 2481, + "ĠHi": 2482, + "sync": 2483, + "Ġlocalgroup": 2484, + "message": 2485, + "1562": 2486, + "Administrators": 2487, + "Maximum": 2488, + "FEEDAC": 2489, + "NPPS": 2490, + "Opera": 2491, + "Successfully": 2492, + "Wallpaper": 2493, + "property": 2494, + "Http": 2495, + "Tech": 2496, + "krbtgt": 2497, + "icious": 2498, + "FEEDACDC": 2499, + "\"'": 2500, + "\");$": 2501, + "'\"": 2502, + "08": 2503, + "246": 2504, + "256": 2505, + "389": 2506, + ";.": 2507, + ";[": 2508, + "?{": 2509, + "AA": 2510, + "AG": 2511, + "AH": 2512, + "Anti": 2513, + "CN": 2514, + "COR": 2515, + "Close": 2516, + "DE": 2517, + "Dns": 2518, + "Machine": 2519, + "OS": 2520, + "Parent": 2521, + "Saf": 2522, + "Volume": 2523, + "Zip": 2524, + "[]": 2525, + "__": 2526, + "av": 2527, + "aw": 2528, + "az": 2529, + "aption": 2530, + "avi": 2531, + "bl": 2532, + "cache": 2533, + "gp": 2534, + "havi": 2535, + "ie": 2536, + "kub": 2537, + "lnk": 2538, + "ou": 2539, + "pY": 2540, + "pre": 2541, + "pas": 2542, + "pack": 2543, + "qli": 2544, + "rf": 2545, + "rle": 2546, + "rsa": 2547, + "sw": 2548, + "sam": 2549, + "silver": 2550, + "tt": 2551, + "ting": 2552, + "ticket": 2553, + "vanced": 2554, + "}`\"": 2555, + "Ġ6": 2556, + "Ġ`": 2557, + "ĠName": 2558, + "Ġdomain": 2559, + "Ġexec": 2560, + "ĠLog": 2561, + "Ġapp": 2562, + "Ġregistry": 2563, + "ĠComp": 2564, + "Ġrule": 2565, + "Ġempty": 2566, + "required": 2567, + "replace": 2568, + "tector": 2569, + "onitor": 2570, + "Ġ\"`": 2571, + "lean": 2572, + "store": 2573, + "stru": 2574, + "ormal": 2575, + "exclu": 2576, + "aries": 2577, + "ads": 2578, + "ition": 2579, + "Ġcert": 2580, + "000": 2581, + "\";.\\": 2582, + "aming": 2583, + "common": 2584, + "keep": 2585, + "Ġ(-": 2586, + "GetNetworkCredential": 2587, + "change": 2588, + "Ġfunction": 2589, + "ForEach": 2590, + "Userinit": 2591, + "netonly": 2592, + "Ġbreak": 2593, + "very": 2594, + "ulate": 2595, + "1564": 2596, + "ADSearch": 2597, + "Ġwill": 2598, + "Ġwarmup": 2599, + "Advanced": 2600, + "ĠCh": 2601, + "ĠCOM": 2602, + "...\";": 2603, + "Ġdid": 2604, + "Ġdetonate": 2605, + ")\"&&": 2606, + "cmdlet": 2607, + "mshta": 2608, + "ĠImport": 2609, + "Ġthat": 2610, + "Ġexport": 2611, + "Addins": 2612, + "RunOnce": 2613, + "board": 2614, + "edge": 2615, + "Ġ@\";": 2616, + "Roaming": 2617, + "umer": 2618, + "Ġ./": 2619, + "Ġmachine": 2620, + "Ġmust": 2621, + "Ġmiss": 2622, + "ĠTicket": 2623, + "Execution": 2624, + "Scripts": 2625, + "Ġ};$": 2626, + "AccountPassword": 2627, + "Ġ\\\"": 2628, + "certutil": 2629, + "window": 2630, + "macroFile": 2631, + "Book": 2632, + "Interop": 2633, + "akdi": 2634, + "Document": 2635, + "ING": 2636, + "ĠWhere": 2637, + "unamepass": 2638, + "1059": 2639, + "aunchctl": 2640, + "obj": 2641, + "Ġchang": 2642, + "malicious": 2643, + "Providers": 2644, + "Registry": 2645, + "Quit": 2646, + "Ġproject": 2647, + "ExpandProperty": 2648, + "PROFIL": 2649, + "Seconds": 2650, + "EncodedCommand": 2651, + ";\"@": 2652, + "ournal": 2653, + "member": 2654, + "Trigger": 2655, + "rdrle": 2656, + "zero": 2657, + "Ġtee": 2658, + "Ġskipping": 2659, + "havior": 2660, + "qlite": 2661, + "structor": 2662, + "excluded": 2663, + "cmdlets": 2664, + "edgePath": 2665, + "Ġmissing": 2666, + "akdiag": 2667, + "rdrleakdiag": 2668, + "\"$": 2669, + "\":\"": 2670, + "&`\"": 2671, + "';$": 2672, + "').": 2673, + "){": 2674, + ")\";": 2675, + "*:": 2676, + "-]": 2677, + "14": 2678, + "35": 2679, + "47": 2680, + "50": 2681, + "83": 2682, + "91": 2683, + "96": 2684, + ":;": 2685, + "=/": 2686, + "=`": 2687, + "AM": 2688, + "AND": 2689, + "CH": 2690, + "CP": 2691, + "Cmd": 2692, + "Count": 2693, + "DP": 2694, + "Drive": 2695, + "Edge": 2696, + "First": 2697, + "GP": 2698, + "Hand": 2699, + "IST": 2700, + "IME": 2701, + "Letter": 2702, + "MP": 2703, + "Port": 2704, + "Post": 2705, + "Pos": 2706, + "RT": 2707, + "Sm": 2708, + "Trust": 2709, + "WM": 2710, + "\\`\"": 2711, + "]{": 2712, + "`&&": 2713, + "bG": 2714, + "bd": 2715, + "cs": 2716, + "credential": 2717, + "dG": 2718, + "ds": 2719, + "dis": 2720, + "dns": 2721, + "fish": 2722, + "gue": 2723, + "ged": 2724, + "harness": 2725, + "job": 2726, + "kill": 2727, + "late": 2728, + "method": 2729, + "mark": 2730, + "nl": 2731, + "oes": 2732, + "pb": 2733, + "pf": 2734, + "pac": 2735, + "polic": 2736, + "power": 2737, + "point": 2738, + "param": 2739, + "pod": 2740, + "send": 2741, + "sqlite": 2742, + "version": 2743, + "vbox": 2744, + "ww": 2745, + "watch": 2746, + "xls": 2747, + "yes": 2748, + "ync": 2749, + "zL": 2750, + "Ġu": 2751, + "Ġreg": 2752, + "ĠMicrosoft": 2753, + "ĠInvo": 2754, + "ĠProcess": 2755, + "ĠEX": 2756, + "Ġos": 2757, + "ĠInstaller": 2758, + "Ġvb": 2759, + "ĠOffice": 2760, + "Ġassembly": 2761, + "resp": 2762, + "onent": 2763, + "utdown": 2764, + "eng": 2765, + "ener": 2766, + "ense": 2767, + "enable": 2768, + "adsi": 2769, + "detector": 2770, + "anel": 2771, + "ollow": 2772, + "namespace": 2773, + "river": 2774, + "hent": 2775, + "Ġcopy": 2776, + "007": 2777, + "ectl": 2778, + "Constructor": 2779, + "Input": 2780, + ":\\*.": 2781, + "iffer": 2782, + "ister": 2783, + "istore": 2784, + "token": 2785, + "chm": 2786, + "chown": 2787, + "Att": 2788, + "Ġsec": 2789, + "Ġsame": 2790, + "ToConsumer": 2791, + "mode": 2792, + "Ġfailure": 2793, + "Ġ{};": 2794, + "AtomicUser": 2795, + "FileSystem": 2796, + "rap": 2797, + "passwords": 2798, + "newValue": 2799, + "newvalue": 2800, + "Creation": 2801, + "Share": 2802, + "Ġby": 2803, + "Thumb": 2804, + "Comms": 2805, + "ADFS": 2806, + "107": 2807, + "Engine": 2808, + "1222": 2809, + "then": 2810, + "shadow": 2811, + "Installed": 2812, + "lsa": 2813, + "lsass": 2814, + "Ġdiffer": 2815, + "HIS": 2816, + "hostname": 2817, + "Scan": 2818, + "Arch": 2819, + "Ġthrow": 2820, + "Ġafter": 2821, + "}\";;$": 2822, + "Protocols": 2823, + "Ġpurge": 2824, + "catch": 2825, + "RunServices": 2826, + "Authent": 2827, + "Check": 2828, + "AppId": 2829, + "edit": 2830, + "Ġret": 2831, + "MENT": 2832, + "888": 2833, + "cationMethod": 2834, + "Ġmatch": 2835, + "Ġmethod": 2836, + "ĠTHIS": 2837, + "beat": 2838, + "=\"$": 2839, + "Ġdetected": 2840, + "executor": 2841, + "Notify": 2842, + "ffer": 2843, + "AccountName": 2844, + "wshell": 2845, + "CLC": 2846, + "vari": 2847, + "decoded": 2848, + "Spray": 2849, + "LocalMachine": 2850, + "Ġldap": 2851, + "Ġlaunchctl": 2852, + "FilterToConsumer": 2853, + "buffer": 2854, + "Ġhas": 2855, + "Ġhistory": 2856, + "Ġharness": 2857, + "ChildPath": 2858, + "Unistore": 2859, + "Maldoc": 2860, + "ldap": 2861, + "PolicyRef": 2862, + "cloudwatch": 2863, + "ExcelReg": 2864, + "RoleMember": 2865, + "DownloadString": 2866, + "rules": 2867, + "Ġenable": 2868, + "*\"};": 2869, + "HTML": 2870, + "searcher": 2871, + "ResourceAccess": 2872, + "30319": 2873, + "ION": 2874, + "22888": 2875, + "True": 2876, + "Trans": 2877, + "clude": 2878, + "Ġspec": 2879, + "dfb": 2880, + "Ġexpected": 2881, + "298": 2882, + "Ġxxd": 2883, + "ĠOutputAssemblyDirectory": 2884, + "ĠOutputAssemblyFileName": 2885, + "registryValueName": 2886, + "Ġunload": 2887, + "ĠGroupPolicyRef": 2888, + "excelApp": 2889, + "reshTime": 2890, + "Ġpasswd": 2891, + "Ġdefault": 2892, + "uacme": 2893, + "ĠbinPath": 2894, + "AADInt": 2895, + "NPPSpy": 2896, + "kubectl": 2897, + "leanup": 2898, + "ĠCOMMENT": 2899, + ";\"@;}": 2900, + "Handler": 2901, + "\\`\"&": 2902, + "guest": 2903, + "packed": 2904, + "ĠInvocationMethod": 2905, + "response": 2906, + "onents": 2907, + "adsisearcher": 2908, + "Thumbprint": 2909, + "Ġdifferent": 2910, + "ExcelRegPath": 2911, + "HTMLApplication": 2912, + "ĠGroupPolicyRefreshTime": 2913, + "!(": 2914, + "!/": 2915, + "';;": 2916, + ")[": 2917, + ")\\": 2918, + "*\\": 2919, + ",#{": 2920, + "/$": 2921, + "012": 2922, + "53": 2923, + "90": 2924, + ";&": 2925, + ";@": 2926, + "Audit": 2927, + "Be": 2928, + "Bypass": 2929, + "Custom": 2930, + "Dump": 2931, + "Ent": 2932, + "FOR": 2933, + "Graph": 2934, + "HE": 2935, + "Hound": 2936, + "Kerberos": 2937, + "LD": 2938, + "Lower": 2939, + "Leng": 2940, + "Monitor": 2941, + "Non": 2942, + "Old": 2943, + "Orac": 2944, + "Pass": 2945, + "RY": 2946, + "RDP": 2947, + "SH": 2948, + "Silent": 2949, + "Sign": 2950, + "Tcp": 2951, + "UN": 2952, + "VE": 2953, + "You": 2954, + "Za": 2955, + "\\\";": 2956, + "\\*.": 2957, + "]).": 2958, + "_';": 2959, + "aes": 2960, + "awn": 2961, + "bot": 2962, + "bytes": 2963, + "ci": 2964, + "cte": 2965, + "cab": 2966, + "correct": 2967, + "dmp": 2968, + "equ": 2969, + "eus": 2970, + "fs": 2971, + "guid": 2972, + "hh": 2973, + "hash": 2974, + "kir": 2975, + "link": 2976, + "mc": 2977, + "ook": 2978, + "pe": 2979, + "rue": 2980, + "tal": 2981, + "uff": 2982, + "vis": 2983, + "with": 2984, + "xl": 2985, + "xlApp": 2986, + "Ġ4": 2987, + "Ġ:": 2988, + "ĠR": 2989, + "Ġr": 2990, + "Ġps": 2991, + "Ġsc": 2992, + "ĠPathToAtomicsFolder": 2993, + "ĠManager": 2994, + "ĠAccount": 2995, + "Ġ86": 2996, + "Ġimport": 2997, + "Ġhere": 2998, + "Ġupdate": 2999, + "Ġobj": 3000, + "inject": 3001, + "info": 3002, + "ression": 3003, + "remove": 3004, + "rets": 3005, + "ong": 3006, + "leg": 3007, + "ets": 3008, + "orun": 3009, + "ntlm": 3010, + "alc": 3011, + "alcon": 3012, + "ename": 3013, + "&&/": 3014, + "urn": 3015, + "urer": 3016, + "any": 3017, + "named": 3018, + "Ġcount": 3019, + "Storage": 3020, + "Inproc": 3021, + "Exit": 3022, + "Extra": 3023, + "Example": 3024, + "Exchange": 3025, + "conn": 3026, + "ility": 3027, + "total": 3028, + "iso": 3029, + "isite": 3030, + "ubeus": 3031, + "Release": 3032, + "Reporting": 3033, + "chrome": 3034, + "check": 3035, + "Ġsys": 3036, + "Ġsave": 3037, + "ToLower": 3038, + "doh": 3039, + "dot": 3040, + "NewPassword": 3041, + "Ġfirst": 3042, + "redteam": 3043, + "Forms": 3044, + "UserName": 3045, + "ables": 3046, + "ipboard": 3047, + "Ġbuild": 3048, + "cli": 3049, + "Thread": 3050, + "ADUser": 3051, + "ADAccountPassword": 3052, + "106": 3053, + "1027": 3054, + "123": 3055, + "agent": 3056, + "Credentials": 3057, + "testdir": 3058, + "ProcessExit": 3059, + "ryption": 3060, + "Ġint": 3061, + "Ġincorrect": 3062, + "ĠCert": 3063, + "`\"\";$": 3064, + "...": 3065, + "Ġdir": 3066, + "Ġdisable": 3067, + "Ġdisplay": 3068, + "rint": 3069, + "collection": 3070, + "objectClass": 3071, + "USERPROF": 3072, + "Ġgoes": 3073, + "Ġthis": 3074, + "Disk": 3075, + "ErrorCode": 3076, + "ĠPanel": 3077, + "EXE": 3078, + "osk": 3079, + "osascript": 3080, + "Ġ};};": 3081, + "ConvertTo": 3082, + "));$": 3083, + "Ġuseradd": 3084, + "Ġstore": 3085, + "Ġstream": 3086, + "(\"{": 3087, + "Ġ];&&": 3088, + "Mod": 3089, + "Ġfiles": 3090, + "ĠConvertFrom": 3091, + "subdomain": 3092, + "Ġ\\;": 3093, + "Ġ\\;&&": 3094, + "Ġshare": 3095, + "Ġshadow": 3096, + "CreateObject": 3097, + "CreateProcess": 3098, + "Definit": 3099, + "ĠART": 3100, + "ServicePrincipal": 3101, + "Device": 3102, + "logonserver": 3103, + "Result": 3104, + "Spec": 3105, + "auto": 3106, + "permission": 3107, + "bucket": 3108, + "TeamViewer": 3109, + "ĠSetup": 3110, + "Ġrunning": 3111, + "MethodName": 3112, + "HISTFILESIZE": 3113, + "Internal": 3114, + "docx": 3115, + "Tasks": 3116, + "ldif": 3117, + "ROOT": 3118, + "Ġlogs": 3119, + "defense": 3120, + "cloudtrail": 3121, + "1053": 3122, + "spaceend": 3123, + "Ġlsass": 3124, + "PrincipalName": 3125, + "ufact": 3126, + "Register": 3127, + "CimMethod": 3128, + "CimSession": 3129, + "CimInstance": 3130, + "rives": 3131, + "contains": 3132, + "HTA": 3133, + "Shortcut": 3134, + "letter": 3135, + "SCII": 3136, + "Ġnotepad": 3137, + "ZXN": 3138, + "expand": 3139, + "cale": 3140, + "messages": 3141, + "Permission": 3142, + "handler": 3143, + "mmy": 3144, + "VirtualBox": 3145, + "}\"){;": 3146, + "Ġsystemctl": 3147, + "PowerSharpPack": 3148, + "PowerSharpBin": 3149, + "Ġprereq": 3150, + "Ġprerequ": 3151, + "termsrvDll": 3152, + "Help": 3153, + "lookup": 3154, + "ified": 3155, + "svchost": 3156, + "bitsadmin": 3157, + "Msol": 3158, + "WmiObject": 3159, + "Extensions": 3160, + "Notifications": 3161, + "invocation": 3162, + "Techni": 3163, + "DnsName": 3164, + "ĠComponents": 3165, + "Ġchanged": 3166, + "Archive": 3167, + "Ġspecify": 3168, + "Behavior": 3169, + "Length": 3170, + "OldPassword": 3171, + "Oracle": 3172, + "SilentProcessExit": 3173, + "_';;$": 3174, + "ctet": 3175, + "kirbi": 3176, + "withspaceend": 3177, + "InprocServer": 3178, + "testdirwithspaceend": 3179, + "USERPROFILE": 3180, + "Definition": 3181, + "ufacturer": 3182, + "PowerSharpBinaries": 3183, + "Ġprerequisite": 3184, + "),": 3185, + ")).": 3186, + "/'": 3187, + "/.": 3188, + "1003": 3189, + "655": 3190, + "81": 3191, + ":_).": 3192, + "=\"#{": 3193, + "?\\": 3194, + "@('": 3195, + "Al": 3196, + "Acl": 3197, + "ACL": 3198, + "AIN": 3199, + "BI": 3200, + "Back": 3201, + "Bvc": 3202, + "CE": 3203, + "Clear": 3204, + "Caption": 3205, + "DB": 3206, + "Daemon": 3207, + "False": 3208, + "Flag": 3209, + "GR": 3210, + "Guid": 3211, + "Gener": 3212, + "IH": 3213, + "If": 3214, + "Mat": 3215, + "Mar": 3216, + "NS": 3217, + "Nl": 3218, + "Normal": 3219, + "OST": 3220, + "Octet": 3221, + "Pat": 3222, + "Part": 3223, + "Raw": 3224, + "Sw": 3225, + "Sys": 3226, + "Sco": 3227, + "Size": 3228, + "Sync": 3229, + "Target": 3230, + "TCP": 3231, + "UA": 3232, + "With": 3233, + "WPD": 3234, + "Zone": 3235, + "\\;": 3236, + "blob": 3237, + "brute": 3238, + "cb": 3239, + "che": 3240, + "csc": 3241, + "dmi": 3242, + "eed": 3243, + "fa": 3244, + "from": 3245, + "gistry": 3246, + "hc": 3247, + "hk": 3248, + "hive": 3249, + "hanced": 3250, + "iB": 3251, + "ipt": 3252, + "ium": 3253, + "jack": 3254, + "ker": 3255, + "kit": 3256, + "library": 3257, + "launch": 3258, + "mb": 3259, + "my": 3260, + "microsoft": 3261, + "msc": 3262, + "match": 3263, + "oStream": 3264, + "pol": 3265, + "ric": 3266, + "sor": 3267, + "tb": 3268, + "trun": 3269, + "tree": 3270, + "ux": 3271, + "uard": 3272, + "we": 3273, + "war": 3274, + "wll": 3275, + "wmi": 3276, + "yB": 3277, + "}/": 3278, + "Ġ8": 3279, + "ĠE": 3280, + "ĠPath": 3281, + "ĠWindows": 3282, + "Ġ);": 3283, + "Ġserver": 3284, + "ĠAdmin": 3285, + "ĠUn": 3286, + "Ġrm": 3287, + "ĠVariable": 3288, + "Ġschtasks": 3289, + "Ġapplication": 3290, + "ĠAuto": 3291, + "Ġ?{": 3292, + "Ġzero": 3293, + "inets": 3294, + "reat": 3295, + "resource": 3296, + "tell": 3297, + "tech": 3298, + "ont": 3299, + "ater": 3300, + "atic": 3301, + "leted": 3302, + "sta": 3303, + "stor": 3304, + "stuff": 3305, + "orig": 3306, + "Ġ$_": 3307, + "services": 3308, + "}\"};": 3309, + "}\");": 3310, + "Pathto": 3311, + "Prog": 3312, + "Project": 3313, + "Prompt": 3314, + "home": 3315, + "rim": 3316, + "useradd": 3317, + "userpass": 3318, + "userprofile": 3319, + "hed": 3320, + "Ġtime": 3321, + "Ġtcp": 3322, + "Ġtrue": 3323, + "Status": 3324, + "Include": 3325, + "psexec": 3326, + "covery": 3327, + "amAccountName": 3328, + "victim": 3329, + "scr": 3330, + "Ġ>/": 3331, + "ished": 3332, + "GetType": 3333, + "Remo": 3334, + "Restart": 3335, + "asion": 3336, + "ToBase": 3337, + "mpire": 3338, + "netstat": 3339, + "ĠDC": 3340, + "logs": 3341, + "loghost": 3342, + "ipAdd": 3343, + "Show": 3344, + "Ġ10": 3345, + "Ġbatch": 3346, + "Ġbypass": 3347, + "This": 3348, + "Thru": 3349, + "Ġ[-]": 3350, + "ires": 3351, + "StartUp": 3352, + "dummy": 3353, + "Enhanced": 3354, + "shal": 3355, + "shark": 3356, + "NTRO": 3357, + "Ġinto": 3358, + "img": 3359, + "image": 3360, + "ĠCopy": 3361, + "Controller": 3362, + "Manufacturer": 3363, + "Ġ;{;": 3364, + "Ġdsc": 3365, + "Ġdata": 3366, + "Ġdone": 3367, + "usion": 3368, + "credstuff": 3369, + "Clipboard": 3370, + "runas": 3371, + "Ġpw": 3372, + "Ġper": 3373, + "1115": 3374, + "1140": 3375, + "spawn": 3376, + "argetInstance": 3377, + "sethc": 3378, + "ĠPrincipal": 3379, + "Ġ};}": 3380, + "boot": 3381, + "romium": 3382, + "Ġpasswords": 3383, + "ptions": 3384, + "decmd": 3385, + "TimeProviders": 3386, + "apple": 3387, + "appcmd": 3388, + "SYSV": 3389, + "HISTCO": 3390, + "HISTSIZE": 3391, + "ĠTargetInstance": 3392, + "AzureADUser": 3393, + "AzureADServicePrincipal": 3394, + "modify": 3395, + "Ġ\\\\": 3396, + "ĠRegistry": 3397, + "certificate": 3398, + "Ġ*.": 3399, + "aily": 3400, + "Space": 3401, + "Boot": 3402, + "Ġsuccessfully": 3403, + "Ġconnect": 3404, + "Ġhidden": 3405, + "printf": 3406, + "Ġ`\"$": 3407, + "GroupMember": 3408, + "virus": 3409, + "virtual": 3410, + "ĠWScript": 3411, + "lockout": 3412, + "Template": 3413, + "batstartup": 3414, + "onds": 3415, + "procexp": 3416, + ":\"([": 3417, + "vbsstartup": 3418, + "]\"$_": 3419, + "ĠFormat": 3420, + "Ġ\"***": 3421, + "Ġchmod": 3422, + "EventConsumer": 3423, + "Compat": 3424, + "ParamVari": 3425, + "Allow": 3426, + "ATHHTMLApplication": 3427, + "IPC": 3428, + "evasion": 3429, + "sslStream": 3430, + "Identifi": 3431, + "taskkill": 3432, + "OMAIN": 3433, + "Resources": 3434, + "Ġklist": 3435, + "Level": 3436, + "jsestartup": 3437, + "ignore": 3438, + "Perf": 3439, + "activ": 3440, + "handle": 3441, + "Virtualization": 3442, + "Ġtempadmin": 3443, + "Ġrequests": 3444, + "LaunchDaemon": 3445, + "xsl": 3446, + "COMObject": 3447, + "Connections": 3448, + "ĠVBA": 3449, + "LegalNoticeText": 3450, + "LegalNoticeCaption": 3451, + "KCd": 3452, + "randomBytes": 3453, + "Ġ9999": 3454, + "ĠHide": 3455, + "krbtgtSID": 3456, + "Safe": 3457, + "tty": 3458, + "Ġcertificate": 3459, + "umerate": 3460, + "InteropServices": 3461, + "PROFILER": 3462, + "policy": 3463, + "podman": 3464, + "zLn": 3465, + "ĠEXIST": 3466, + "InputObject": 3467, + "Authentication": 3468, + "variation": 3469, + "Monitoring": 3470, + "PassThru": 3471, + "legate": 3472, + "oruns": 3473, + "ExchangeOnline": 3474, + "ReleaseComObject": 3475, + "HTAFilePath": 3476, + "Matche": 3477, + "Marshal": 3478, + "Pattern": 3479, + "Scope": 3480, + "WPDT": 3481, + "iptables": 3482, + "Ġ?{$_.": 3483, + "inetsrv": 3484, + "PathtoAtomicsFolder": 3485, + "ipAddr": 3486, + "NTROL": 3487, + "credstuffuserpass": 3488, + "SYSVOL": 3489, + "HISTCONTROL": 3490, + "]\"$_\").": 3491, + "ParamVariation": 3492, + "Identifier": 3493, + "LaunchDaemons": 3494, + "Matches": 3495, + "!]": 3496, + "\"%": 3497, + "(-": 3498, + "(#{": 3499, + "(\\\"": 3500, + "+/": 3501, + ",\"": 3502, + "/\"$": 3503, + "23": 3504, + "24": 3505, + "59": 3506, + "97": 3507, + ":%": 3508, + ";\"#{": 3509, + "=*": 3510, + ">>": 3511, + "AN": 3512, + "AZ": 3513, + "Bind": 3514, + "Browser": 3515, + "CF": 3516, + "CR": 3517, + "Cm": 3518, + "Cap": 3519, + "Cook": 3520, + "DLL": 3521, + "DCLC": 3522, + "DOMAIN": 3523, + "ES": 3524, + "EST": 3525, + "Empire": 3526, + "Fa": 3527, + "GA": 3528, + "He": 3529, + "History": 3530, + "IServer": 3531, + "Jy": 3532, + "KS": 3533, + "LE": 3534, + "Lin": 3535, + "Last": 3536, + "MT": 3537, + "Mu": 3538, + "Map": 3539, + "MFilePath": 3540, + "OP": 3541, + "PY": 3542, + "Ps": 3543, + "Print": 3544, + "RC": 3545, + "RI": 3546, + "SA": 3547, + "So": 3548, + "SamAccountName": 3549, + "TP": 3550, + "Table": 3551, + "TMP": 3552, + "URL": 3553, + "VB": 3554, + "Val": 3555, + "VER": 3556, + "VIServer": 3557, + "WO": 3558, + "]$": 3559, + "]'": 3560, + "aad": 3561, + "ause": 3562, + "bk": 3563, + "bas": 3564, + "byte": 3565, + "cu": 3566, + "cyp": 3567, + "current": 3568, + "cap": 3569, + "da": 3570, + "dom": 3571, + "done": 3572, + "driver": 3573, + "fname": 3574, + "function": 3575, + "falcon": 3576, + "hZ": 3577, + "hru": 3578, + "iWindow": 3579, + "kK": 3580, + "kerberos": 3581, + "lY": 3582, + "lu": 3583, + "lim": 3584, + "lib": 3585, + "mV": 3586, + "mt": 3587, + "mut": 3588, + "nings": 3589, + "nobjectClass": 3590, + "over": 3591, + "oast": 3592, + "pi": 3593, + "post": 3594, + "public": 3595, + "ppid": 3596, + "pdf": 3597, + "sn": 3598, + "son": 3599, + "sample": 3600, + "tar": 3601, + "vsc": 3602, + "vable": 3603, + "wait": 3604, + "ways": 3605, + "zd": 3606, + "zill": 3607, + "}#{": 3608, + "}};": 3609, + "}))": 3610, + "Ġ)": 3611, + "Ġ7": 3612, + "Ġ^": 3613, + "Ġy": 3614, + "Ġlo": 3615, + "ĠFile": 3616, + "Ġunt": 3617, + "Ġms": 3618, + "Ġatomic": 3619, + "ĠAdd": 3620, + "ĠWord": 3621, + "ĠConnect": 3622, + "ĠNUL": 3623, + "ĠEnvironment": 3624, + "Ġaccess": 3625, + "Ġ_).": 3626, + "Ġview": 3627, + "Ġkeys": 3628, + "Ġ__": 3629, + "req": 3630, + "recur": 3631, + "reading": 3632, + "reboot": 3633, + "Ġ\"{": 3634, + "rok": 3635, + "status": 3636, + "sthru": 3637, + "oriz": 3638, + "ntax": 3639, + "utl": 3640, + "ssage": 3641, + "explorer": 3642, + "cent": 3643, + "engine": 3644, + "Ġ==": 3645, + "aduser": 3646, + "deo": 3647, + "des": 3648, + "desk": 3649, + "itle": 3650, + "locale": 3651, + "}\"'": 3652, + "}\".": 3653, + "}\";;": 3654, + "Profiles": 3655, + "rig": 3656, + "select": 3657, + "usermod": 3658, + "head": 3659, + "heel": 3660, + "Ġtask": 3661, + "puters": 3662, + "Ġcache": 3663, + "Ġcleanup": 3664, + "Ġcalc": 3665, + "Console": 3666, + "WindowsPowerShell": 3667, + "WindowsUpdate": 3668, + "ptt": 3669, + "\";#": 3670, + "\";&": 3671, + "\";;#": 3672, + "Ġ'%": 3673, + "Ġ''": 3674, + "Ġ'(": 3675, + "Ġ'*": 3676, + ":\\\\": 3677, + "Export": 3678, + "ations": 3679, + "SystemRe": 3680, + "isting": 3681, + "Ġ(!(": 3682, + "toconsole": 3683, + "GetString": 3684, + "Required": 3685, + "child": 3686, + "chromium": 3687, + "ersisten": 3688, + "Ġsim": 3689, + "ToLoad": 3690, + ");{": 3691, + ");;$": 3692, + "agne": 3693, + "outputfile": 3694, + "ract": 3695, + "iry": 3696, + "other": 3697, + "CurrentUser": 3698, + "prop": 3699, + "props": 3700, + "logfile": 3701, + "logtoconsole": 3702, + "idump": 3703, + "Shadow": 3704, + "REGION": 3705, + "Ġ12": 3706, + "Ġbytes": 3707, + "verbose": 3708, + "irection": 3709, + "domaincontro": 3710, + "ADInternal": 3711, + "101": 3712, + "1046": 3713, + "ques": 3714, + "Ġwheel": 3715, + "NetEvent": 3716, + "shutdown": 3717, + "systemroot": 3718, + "Ġinst": 3719, + "Ġinter": 3720, + "ĠCapture": 3721, + "igh": 3722, + "ight": 3723, + "`\",": 3724, + "`\"`": 3725, + "Ġdon": 3726, + "Ġdaily": 3727, + "using": 3728, + "AssemblyName": 3729, + "PasswordProfile": 3730, + "ServiceDll": 3731, + "Ġtoo": 3732, + "Ġgolden": 3733, + "localhost": 3734, + "Ġaut": 3735, + "extract": 3736, + "Ġpf": 3737, + "Ġparam": 3738, + "1110": 3739, + "AzAccount": 3740, + "spec": 3741, + "max": 3742, + "Logging": 3743, + "Ġread": 3744, + "ATOM": 3745, + "umber": 3746, + "vmware": 3747, + "Move": 3748, + "AzureADApplication": 3749, + "DirectorySearch": 3750, + "ScriptEngine": 3751, + "CreateInstance": 3752, + "Defend": 3753, + "ĠAND": 3754, + "ĠAWS": 3755, + "ĠAADInternal": 3756, + "One": 3757, + "Only": 3758, + "secedit": 3759, + "vba": 3760, + "archive": 3761, + "found": 3762, + "hertext": 3763, + "Delegate": 3764, + "Video": 3765, + "1612": 3766, + "1609": 3767, + "ĠMS": 3768, + "autoruns": 3769, + "working": 3770, + "LocalUser": 3771, + "Keys": 3772, + "Ġlong": 3773, + "()'": 3774, + "());": 3775, + "())\"&&": 3776, + "')|": 3777, + "NARY": 3778, + "trans": 3779, + "CertStore": 3780, + "NoRestart": 3781, + "Unit": 3782, + "tpServer": 3783, + "ARGET": 3784, + "trap": 3785, + "LOCR": 3786, + "IGZ": 3787, + "authoriz": 3788, + "DestinationPath": 3789, + "helper": 3790, + "ComputerName": 3791, + "Defaults": 3792, + "LOCALAPPDATA": 3793, + "ELL": 3794, + "Ġlsmod": 3795, + "acheutil": 3796, + "FindOne": 3797, + "FromBase": 3798, + "owner": 3799, + "Compiled": 3800, + "ĠWinDefend": 3801, + "ATHCompiled": 3802, + "evt": 3803, + "Ġencrypted": 3804, + "instance": 3805, + "auditpol": 3806, + "manip": 3807, + "ĠOpen": 3808, + "exfilpath": 3809, + "Ġadded": 3810, + "Realtime": 3811, + "NetworkProvider": 3812, + "Ġ\"\\\\": 3813, + "ImagePath": 3814, + "syntax": 3815, + "Preferences": 3816, + "erberoast": 3817, + "Ġexpiry": 3818, + "Package": 3819, + "ĠGolden": 3820, + "PropertiesToLoad": 3821, + "----": 3822, + "GVu": 3823, + "driveLetter": 3824, + "ĠByte": 3825, + "control": 3826, + "FeatureName": 3827, + "Hello": 3828, + "ĠLast": 3829, + "Ġjust": 3830, + "Ġjournal": 3831, + "Ġused": 3832, + "lobal": 3833, + "ECT": 3834, + "FirefoxCreds": 3835, + "encryption": 3836, + "Ġclass": 3837, + "flags": 3838, + "Ġ!=": 3839, + "ĠExport": 3840, + "WindowSt": 3841, + "}','": 3842, + "Message": 3843, + "Phant": 3844, + "Phish": 3845, + "SendKeys": 3846, + "pipe": 3847, + "pipes": 3848, + "ĠDisplayName": 3849, + "pYyB": 3850, + "passthru": 3851, + "requiredGraph": 3852, + "ExecutionPolicy": 3853, + "Bookmark": 3854, + "CHMFilePath": 3855, + "GPO": 3856, + "`&&$": 3857, + "raphic": 3858, + "newValueName": 3859, + "Ġreturn": 3860, + "Transport": 3861, + "Signed": 3862, + "fsutil": 3863, + "namedpipes": 3864, + "Extract": 3865, + "dotnet": 3866, + "1069": 3867, + "DiskImage": 3868, + "Techniques": 3869, + "BINARY": 3870, + "Switch": 3871, + "ZoneMap": 3872, + "hklm": 3873, + "ĠAdmins": 3874, + "original": 3875, + "Ġ$_;": 3876, + "GetTypeFrom": 3877, + "aadApplication": 3878, + "basename": 3879, + "cyphertext": 3880, + "falcond": 3881, + "iWindowPos": 3882, + "zilla": 3883, + "Ġuntil": 3884, + "SystemRestore": 3885, + "childitem": 3886, + "ersistence": 3887, + "domaincontroller": 3888, + "ATOMIC": 3889, + "DirectorySearcher": 3890, + "ĠAADInternals": 3891, + "DelegateExecute": 3892, + "CertStoreLocation": 3893, + "ARGETPID": 3894, + "authorized": 3895, + "ATHCompiledHelp": 3896, + "FirefoxCredsLocation": 3897, + "requiredGraphAccess": 3898, + "Bookmarks": 3899, + "\"]": 3900, + "\"')": 3901, + "%;": 3902, + "'re": 3903, + "'&&": 3904, + "())": 3905, + "(([": 3906, + ".$": 3907, + "/%": 3908, + "17": 3909, + "1000": 3910, + "254": 3911, + "39": 3912, + "49": 3913, + "52": 3914, + "509": 3915, + "60": 3916, + "62": 3917, + "601": 3918, + "77": 3919, + "78": 3920, + ":#": 3921, + ":(": 3922, + "Aa": 3923, + "AID": 3924, + "ASCII": 3925, + "BC": 3926, + "BE": 3927, + "BU": 3928, + "Blo": 3929, + "Center": 3930, + "DS": 3931, + "Dat": 3932, + "Dword": 3933, + "Days": 3934, + "Ev": 3935, + "FA": 3936, + "Fin": 3937, + "GI": 3938, + "Groups": 3939, + "HH": 3940, + "HJ": 3941, + "Hash": 3942, + "Hidden": 3943, + "Ii": 3944, + "KEY": 3945, + "Ldap": 3946, + "MC": 3947, + "Mac": 3948, + "Mill": 3949, + "MAND": 3950, + "Mcs": 3951, + "Node": 3952, + "Number": 3953, + "ON": 3954, + "Of": 3955, + "Ow": 3956, + "Optional": 3957, + "Orig": 3958, + "PV": 3959, + "PX": 3960, + "Pip": 3961, + "Pwd": 3962, + "Powershell": 3963, + "PUT": 3964, + "PAND": 3965, + "QL": 3966, + "QU": 3967, + "Qg": 3968, + "RU": 3969, + "RV": 3970, + "Rt": 3971, + "Rubeus": 3972, + "RAID": 3973, + "SK": 3974, + "SU": 3975, + "Sup": 3976, + "Sim": 3977, + "Sel": 3978, + "SEL": 3979, + "Split": 3980, + "TN": 3981, + "TS": 3982, + "Ten": 3983, + "TARGETPID": 3984, + "Ug": 3985, + "Ul": 3986, + "Us": 3987, + "VID": 3988, + "VBA": 3989, + "WI": 3990, + "Wow": 3991, + "Wire": 3992, + "Work": 3993, + "XJ": 3994, + "XN": 3995, + "ZG": 3996, + "[^": 3997, + "\\/": 3998, + "];$": 3999, + "]($": 4000, + "]*\\": 4001, + "]:\"([": 4002, + "bb": 4003, + "bc": 4004, + "bn": 4005, + "browser": 4006, + "cC": 4007, + "cv": 4008, + "cus": 4009, + "csv": 4010, + "dC": 4011, + "dn": 4012, + "dTime": 4013, + "fake": 4014, + "fSigned": 4015, + "ga": 4016, + "gra": 4017, + "graph": 4018, + "hing": 4019, + "hup": 4020, + "hings": 4021, + "hidden": 4022, + "ique": 4023, + "jsc": 4024, + "journal": 4025, + "kext": 4026, + "kld": 4027, + "lxll": 4028, + "listen": 4029, + "myp": 4030, + "mPwd": 4031, + "nn": 4032, + "nected": 4033, + "ove": 4034, + "oot": 4035, + "oul": 4036, + "pZ": 4037, + "pk": 4038, + "por": 4039, + "pri": 4040, + "pgrep": 4041, + "pool": 4042, + "qwin": 4043, + "qbot": 4044, + "rt": 4045, + "sb": 4046, + "sx": 4047, + "sen": 4048, + "sdb": 4049, + "slookup": 4050, + "trust": 4051, + "uc": 4052, + "ues": 4053, + "udo": 4054, + "uage": 4055, + "uinit": 4056, + "venv": 4057, + "wL": 4058, + "wer": 4059, + "wscript": 4060, + "wevt": 4061, + "yle": 4062, + "zZX": 4063, + "zCm": 4064, + "{\"": 4065, + "}:$": 4066, + "Ġq": 4067, + "Ġan": 4068, + "ĠIn": 4069, + "ĠAt": 4070, + "Ġab": 4071, + "Ġall": 4072, + "Ġenv": 4073, + "Ġscript": 4074, + "ĠInstall": 4075, + "Ġusername": 4076, + "Ġstring": 4077, + "Ġurl": 4078, + "ĠUse": 4079, + "ĠAtomicTest": 4080, + "ĠKey": 4081, + "Ġrole": 4082, + "ĠEL": 4083, + "ĠEnd": 4084, + "ĠEnabled": 4085, + "Ġans": 4086, + "ĠAdministrator": 4087, + "Ġapi": 4088, + "ĠUpdate": 4089, + "ĠQuery": 4090, + "Ġjson": 4091, + "Ġvalid": 4092, + "Ġhttp": 4093, + "ĠAdministrators": 4094, + "ĠZip": 4095, + "ĠExecution": 4096, + "Ġvis": 4097, + "ĠSYSVOL": 4098, + "Ġother": 4099, + "erase": 4100, + "error": 4101, + "ini": 4102, + "res": 4103, + "reload": 4104, + "reset": 4105, + "request": 4106, + "reference": 4107, + "Ġ\".": 4108, + "attr": 4109, + "Ġ/#{": 4110, + "ical": 4111, + "icac": 4112, + "eter": 4113, + "ethings": 4114, + "eces": 4115, + "econds": 4116, + "ors": 4117, + "mega": 4118, + "ntds": 4119, + "alt": 4120, + "ality": 4121, + "alth": 4122, + "tempt": 4123, + "fileName": 4124, + "fileContent": 4125, + "fileExtensions": 4126, + "Ġ=[": 4127, + "uri": 4128, + "ade": 4129, + "adump": 4130, + "description": 4131, + "iter": 4132, + "itter": 4133, + "loud": 4134, + "location": 4135, + "anization": 4136, + "}\"\"": 4137, + "}\"/": 4138, + "Protected": 4139, + "WinWord": 4140, + "sed": 4141, + "Ġcapture": 4142, + "Ġcbd": 4143, + "009": 4144, + "NameSpace": 4145, + "ection": 4146, + "esx": 4147, + "Init": 4148, + "WindowsFirewall": 4149, + "WindowsOptional": 4150, + "cook": 4151, + "derSpec": 4152, + "comMs": 4153, + "artScreen": 4154, + "ifname": 4155, + "outfile": 4156, + "ational": 4157, + "ily": 4158, + "SystemUp": 4159, + "scsi": 4160, + "Ġ('": 4161, + "Ġ(;": 4162, + "aintext": 4163, + "iseconds": 4164, + "GetBytes": 4165, + "chain": 4166, + "erson": 4167, + "};#{": 4168, + "Ġshell": 4169, + ");#": 4170, + "Ġfull": 4171, + "Ġflag": 4172, + "Ġfake": 4173, + "outputZip": 4174, + "abl": 4175, + "abase": 4176, + "ability": 4177, + "ally": 4178, + "allth": 4179, + "Setup": 4180, + "adds": 4181, + "plaintext": 4182, + "ObjectGuid": 4183, + "Format": 4184, + "UserAgent": 4185, + "UserPrincipalName": 4186, + "html": 4187, + "ableAssembly": 4188, + "network": 4189, + "ĠDe": 4190, + "ĠDomain": 4191, + "ĠDim": 4192, + "ĠĠĠĠĠĠĠĠĠ": 4193, + "SoftRAID": 4194, + "Ġaddress": 4195, + "emond": 4196, + "}&&$": 4197, + "6432": 4198, + "Outlook": 4199, + "Ġbs": 4200, + "Ġback": 4201, + "Ġbyte": 4202, + "Ġblock": 4203, + "Ġbrute": 4204, + "clip": 4205, + "clusion": 4206, + "Ġ[!]": 4207, + "ments": 4208, + "STOP": 4209, + "uln": 4210, + "157": 4211, + "1572": 4212, + "servicePrincipal": 4213, + "1086": 4214, + "quality": 4215, + "Ġwrite": 4216, + "Ġwhile": 4217, + "120": 4218, + "127": 4219, + "AdmPwd": 4220, + "thing": 4221, + "thresh": 4222, + "NetFirewall": 4223, + "ageLocation": 4224, + "ProcessUn": 4225, + "entry": 4226, + "lset": 4227, + "lsadump": 4228, + "ĠClose": 4229, + "ĠCenter": 4230, + "etcap": 4231, + "%\\#{": 4232, + "Ġ;#": 4233, + "Ġdec": 4234, + "index": 4235, + ")\"))": 4236, + "cmdkey": 4237, + "credz": 4238, + "credNotAfter": 4239, + "}';$": 4240, + "}'\";": 4241, + "msbuild": 4242, + "ĠIN": 4243, + "Ġgroups": 4244, + "localgroup": 4245, + "Ġaction": 4246, + "extrac": 4247, + "Disallow": 4248, + "Disconnect": 4249, + "PowerP": 4250, + "Ġ&&#": 4251, + "ProtocolDefaults": 4252, + "Ġpublic": 4253, + "AzRole": 4254, + "ĠSystemd": 4255, + "Ġnslookup": 4256, + "ulti": 4257, + "AddDays": 4258, + "ĠPOST": 4259, + "EXPAND": 4260, + "keyValue": 4261, + "Auth": 4262, + "Ġ};;": 4263, + "book": 4264, + "LogMe": 4265, + "wdApp": 4266, + "Ġusermod": 4267, + "Ġreal": 4268, + "Ġstate": 4269, + "Ġstatus": 4270, + "Ġstatic": 4271, + "form": 4272, + "Ġ@(\"": 4273, + "registryKey": 4274, + "Exploit": 4275, + "CURIT": 4276, + "accounts": 4277, + "Mount": 4278, + "Mozilla": 4279, + "endor": 4280, + "Contents": 4281, + "UsedTime": 4282, + "AzureADDirectory": 4283, + "ExecStart": 4284, + "ScriptBlock": 4285, + "gnition": 4286, + "AccountManagement": 4287, + "DomainName": 4288, + "Ġoff": 4289, + "ĠRequired": 4290, + "Accessib": 4291, + "AccessManager": 4292, + "AccessRule": 4293, + "certNotAfter": 4294, + "ĠAll": 4295, + "second": 4296, + "secrets": 4297, + "Ġ***": 4298, + "DisableAnti": 4299, + "FILES": 4300, + "Applications": 4301, + "encodedData": 4302, + "ViableAssembly": 4303, + "1610": 4304, + "ĠMIME": 4305, + "rootkit": 4306, + "Focus": 4307, + "NEW": 4308, + "Spring": 4309, + "LocalAdmin": 4310, + "Keep": 4311, + "times": 4312, + "timest": 4313, + "}.\";": 4314, + "Ġline": 4315, + "teamview": 4316, + "ExplorerSync": 4317, + "FilterArgs": 4318, + "\\\"\"": 4319, + "\\\");": 4320, + "nohup": 4321, + "CommandLineParamet": 4322, + "CommandLineSwitch": 4323, + "perl": 4324, + "Ġsuccess": 4325, + "SIGI": 4326, + "Ġ500": 4327, + "ificParent": 4328, + "PowerShellCommandLineParamet": 4329, + "Uninstall": 4330, + "Ġ`\"#{": 4331, + "docPath": 4332, + "Offset": 4333, + "IGF": 4334, + "ROM": 4335, + "ULT": 4336, + "Ġ\"\"\"": 4337, + "Ġlogin": 4338, + "bitmap": 4339, + "Ġ30": 4340, + "ComputerSystem": 4341, + "itemproperty": 4342, + "obf": 4343, + "Ġdoes": 4344, + "Ġchown": 4345, + "FindAll": 4346, + "ngrok": 4347, + "tenant": 4348, + "DownloadFile": 4349, + "ATHProcessUn": 4350, + "ATHPowerShellCommandLineParamet": 4351, + "ConsumerArgs": 4352, + "IPersistence": 4353, + "Subdomain": 4354, + "Subscription": 4355, + "auditd": 4356, + "manage": 4357, + "ĠOptions": 4358, + "subscriptions": 4359, + "Certificates": 4360, + "AtomicRedTeamT": 4361, + "VMHost": 4362, + "ready": 4363, + "ZXI": 4364, + "rustdesk": 4365, + "1560": 4366, + "/*/": 4367, + "ĠFF": 4368, + "ĠFROM": 4369, + "ĠGraph": 4370, + "ĠURL": 4371, + "anguage": 4372, + "sentutl": 4373, + "IdentityModel": 4374, + "vciB": 4375, + "compress": 4376, + "compiled": 4377, + "ĠPackageLocation": 4378, + "ckets": 4379, + "attribute": 4380, + "Ġadministrator": 4381, + "ĠEnableFirewall": 4382, + "inalCommand": 4383, + "accessRule": 4384, + "EncodedArguments": 4385, + "Ġrequesting": 4386, + "controlset": 4387, + "MinimumViableAssembly": 4388, + "Features": 4389, + "LaunchAgent": 4390, + "ivate": 4391, + "Ġaren": 4392, + "ĠCreateObject": 4393, + "excelxll": 4394, + "examplePath": 4395, + "Ġsubtree": 4396, + "COMMAND": 4397, + "odHound": 4398, + "Ġalways": 4399, + "Ġalready": 4400, + "Ġdefender": 4401, + "QueryType": 4402, + "++)": 4403, + "ABLE": 4404, + "ASS": 4405, + "UTF": 4406, + "flagPath": 4407, + "private": 4408, + "\";};;$": 4409, + "Ġexists": 4410, + "Ġexisting": 4411, + "MSHTAFilePath": 4412, + "Spyware": 4413, + "SpyNet": 4414, + "hvIGF": 4415, + "vssadmin": 4416, + "ConsentStore": 4417, + "ConsentPrompt": 4418, + "chunkSize": 4419, + "loginwindow": 4420, + "subnetSubstring": 4421, + "ĠHijack": 4422, + "cachefilename": 4423, + "paste": 4424, + "switch": 4425, + "Ġ60": 4426, + "Ġapppool": 4427, + "Documents": 4428, + "&`\"\\": 4429, + "SmartScreen": 4430, + "WMI": 4431, + "WMIPersistence": 4432, + "bGx": 4433, + "disk": 4434, + "nltest": 4435, + "pfx": 4436, + "sendback": 4437, + "www": 4438, + "ĠvbNormal": 4439, + "Attach": 4440, + "Ġsecurity": 4441, + "1071": 4442, + "RunServicesOnce": 4443, + "FilterToConsumerArgs": 4444, + "FilterToConsumerBind": 4445, + "responseBody": 4446, + "ĠGroupPolicyRefreshTimeOffset": 4447, + "LDAP": 4448, + "NonPackage": 4449, + "hashcat": 4450, + "Ġrsync": 4451, + "Ġsyslog": 4452, + "Modification": 4453, + "BehaviorAdmin": 4454, + "65534": 4455, + "Backup": 4456, + "BvcGVu": 4457, + "DBLocation": 4458, + "kerbrute": 4459, + "myT": 4460, + "truncate": 4461, + "resourceAccess": 4462, + "ProgID": 4463, + "Removable": 4464, + "EnhancedNotifications": 4465, + "imgLocation": 4466, + "Ġdscl": 4467, + "Templates": 4468, + "CompatDat": 4469, + "activator": 4470, + "KCdlY": 4471, + "ĠHideSC": 4472, + "SafeBoot": 4473, + "zLnBvcGVu": 4474, + "(\\\"$": 4475, + "/\"${": 4476, + "Capability": 4477, + "PsExec": 4478, + "currentcontrolset": 4479, + "doma": 4480, + "limit": 4481, + "mutable": 4482, + "pieces": 4483, + "reqPermission": 4484, + "centos": 4485, + "NetEventSession": 4486, + "Ġinterface": 4487, + "Ġparameter": 4488, + "IGZvciB": 4489, + "manipulate": 4490, + "Ġ\"\\\\?\\": 4491, + "ĠLastUsedTime": 4492, + "TransportAgent": 4493, + "BloodHound": 4494, + "HHFilePath": 4495, + "Milliseconds": 4496, + "OriginalCommand": 4497, + "Pipe": 4498, + "SelfSigned": 4499, + "SELECT": 4500, + "Tenant": 4501, + "Ultra": 4502, + "grant": 4503, + "graphSP": 4504, + "kldstat": 4505, + "ould": 4506, + "qwinsta": 4507, + "wevtutil": 4508, + "zZXJ": 4509, + "}:${": 4510, + "ĠAttempt": 4511, + "Ġabove": 4512, + "ĠELSE": 4513, + "Ġanswer": 4514, + "ĠZipFile": 4515, + "Ġvisudo": 4516, + "icacls": 4517, + "ethingsx": 4518, + "ProtectedView": 4519, + "Ġcbdaemon": 4520, + "WindowsOptionalFeature": 4521, + "derSpecificParent": 4522, + "comMsXml": 4523, + "SystemUpTime": 4524, + "allthethingsx": 4525, + "threshold": 4526, + "LogMeIn": 4527, + "CURITY": 4528, + "Ġ***\"&&": 4529, + "teamviewer": 4530, + "CommandLineSwitchType": 4531, + "SIGINT": 4532, + "ATHProcessUnderSpecificParent": 4533, + "ATHPowerShellCommandLineParameter": 4534, + "LaunchAgents": 4535, + "ConsentPromptBehaviorAdmin": 4536, + "ĠHijacking": 4537, + "ĠvbNormalFocus": 4538, + "FilterToConsumerBinding": 4539, + "NonPackaged": 4540, + "CompatDatabase": 4541, + "zLnBvcGVuKCdlY": 4542, + "CapabilityAccessManager": 4543, + "SelfSignedCertificate": 4544, + "ĠAttempting": 4545, + "!\";": 4546, + "\"@": 4547, + "\"};": 4548, + "\")\"": 4549, + "$($": 4550, + "$\\#{": 4551, + "'s": 4552, + ")]": 4553, + ")};": 4554, + "*'": 4555, + "+'": 4556, + "+]": 4557, + ",^": 4558, + "/;": 4559, + "18": 4560, + "100": 4561, + "1120": 4562, + "31": 4563, + "43": 4564, + "48": 4565, + "455": 4566, + "58": 4567, + "61": 4568, + "70": 4569, + "79": 4570, + "87": 4571, + ":*": 4572, + ";{": 4573, + ";);": 4574, + "<|": 4575, + "=%": 4576, + ">%": 4577, + ">*\"": 4578, + "@]": 4579, + "AE": 4580, + "Ay": 4581, + "Ali": 4582, + "AWS": 4583, + "Bl": 4584, + "BAL": 4585, + "Brm": 4586, + "CC": 4587, + "Cn": 4588, + "Cache": 4589, + "CCLC": 4590, + "DN": 4591, + "DX": 4592, + "DY": 4593, + "Dk": 4594, + "Det": 4595, + "Den": 4596, + "Dep": 4597, + "Drives": 4598, + "DRV": 4599, + "Et": 4600, + "Email": 4601, + "Fri": 4602, + "Fault": 4603, + "GLO": 4604, + "Global": 4605, + "Ha": 4606, + "Hard": 4607, + "Hollow": 4608, + "HResult": 4609, + "IE": 4610, + "IM": 4611, + "Is": 4612, + "IConfiguration": 4613, + "Ignition": 4614, + "Jscript": 4615, + "Job": 4616, + "JEC": 4617, + "Kerberoast": 4618, + "Lm": 4619, + "Lan": 4620, + "LBin": 4621, + "Light": 4622, + "Language": 4623, + "Main": 4624, + "Menu": 4625, + "Mimikatz": 4626, + "Ny": 4627, + "Next": 4628, + "NING": 4629, + "NtpServer": 4630, + "Over": 4631, + "Option": 4632, + "PI": 4633, + "PU": 4634, + "Pot": 4635, + "PATH": 4636, + "PWPDT": 4637, + "PASS": 4638, + "Rl": 4639, + "RpZ": 4640, + "SR": 4641, + "Sing": 4642, + "SWR": 4643, + "Sample": 4644, + "SilentlyContinue": 4645, + "TG": 4646, + "TY": 4647, + "Tam": 4648, + "TIN": 4649, + "TION": 4650, + "TEST": 4651, + "UE": 4652, + "UI": 4653, + "US": 4654, + "UAC": 4655, + "UMT": 4656, + "URI": 4657, + "Vy": 4658, + "VBox": 4659, + "Wh": 4660, + "Wt": 4661, + "Wer": 4662, + "Wan": 4663, + "Wscript": 4664, + "Wget": 4665, + "While": 4666, + "[\"": 4667, + "[@]": 4668, + "\\*": 4669, + "\\.": 4670, + "\\!/": 4671, + "_$": 4672, + "`@#{": 4673, + "au": 4674, + "air": 4675, + "aud": 4676, + "ailed": 4677, + "bj": 4678, + "bz": 4679, + "bon": 4680, + "bak": 4681, + "break": 4682, + "cS": 4683, + "cc": 4684, + "cf": 4685, + "car": 4686, + "call": 4687, + "custom": 4688, + "clear": 4689, + "dz": 4690, + "din": 4691, + "dut": 4692, + "dex": 4693, + "dar": 4694, + "dps": 4695, + "dul": 4696, + "daemon": 4697, + "display": 4698, + "dater": 4699, + "dPipe": 4700, + "ek": 4701, + "eder": 4702, + "eve": 4703, + "esentutl": 4704, + "fe": 4705, + "failure": 4706, + "gB": 4707, + "gL": 4708, + "gl": 4709, + "gcm": 4710, + "gpu": 4711, + "groups": 4712, + "hd": 4713, + "hdG": 4714, + "hollow": 4715, + "hTasks": 4716, + "halt": 4717, + "ih": 4718, + "ide": 4719, + "ise": 4720, + "isc": 4721, + "imp": 4722, + "ios": 4723, + "ience": 4724, + "jscript": 4725, + "join": 4726, + "kur": 4727, + "kcu": 4728, + "lient": 4729, + "lance": 4730, + "lzd": 4731, + "mv": 4732, + "mit": 4733, + "mid": 4734, + "mSettings": 4735, + "multi": 4736, + "nZ": 4737, + "nan": 4738, + "nuser": 4739, + "nch": 4740, + "ndar": 4741, + "ome": 4742, + "odump": 4743, + "odecmd": 4744, + "pm": 4745, + "pv": 4746, + "par": 4747, + "pub": 4748, + "patch": 4749, + "ppam": 4750, + "pci": 4751, + "pOw": 4752, + "qn": 4753, + "qx": 4754, + "rar": 4755, + "rad": 4756, + "rubeus": 4757, + "sd": 4758, + "sit": 4759, + "sbin": 4760, + "sig": 4761, + "sive": 4762, + "smb": 4763, + "tZ": 4764, + "tle": 4765, + "tHost": 4766, + "tail": 4767, + "tmon": 4768, + "tcm": 4769, + "take": 4770, + "trim": 4771, + "tshark": 4772, + "usc": 4773, + "ush": 4774, + "vy": 4775, + "vault": 4776, + "vwr": 4777, + "volume": 4778, + "vinject": 4779, + "vuln": 4780, + "vendor": 4781, + "wt": 4782, + "wMD": 4783, + "while": 4784, + "wpb": 4785, + "wise": 4786, + "yDes": 4787, + "ylance": 4788, + "zagne": 4789, + "{#": 4790, + "}$": 4791, + "}}": 4792, + "});": 4793, + "}).": 4794, + "ĠN": 4795, + "Ġv": 4796, + "Ġat": 4797, + "Ġor": 4798, + "Ġtem": 4799, + "ĠPro": 4800, + "ĠSt": 4801, + "Ġload": 4802, + "Ġ32": 4803, + "Ġip": 4804, + "Ġvo": 4805, + "ĠSoftware": 4806, + "Ġport": 4807, + "Ġmin": 4808, + "Ġobject": 4809, + "ĠID": 4810, + "ĠPassword": 4811, + "Ġhost": 4812, + "Ġnull": 4813, + "ĠRun": 4814, + "Ġed": 4815, + "ĠTime": 4816, + "ĠManagement": 4817, + "Ġtext": 4818, + "Ġzip": 4819, + "ĠHISTFILE": 4820, + "Ġmodule": 4821, + "Ġ40": 4822, + "ĠFind": 4823, + "ĠNO": 4824, + "ĠResource": 4825, + "ĠVer": 4826, + "ĠHISTIGNORE": 4827, + "ĠScreen": 4828, + "Ġevil": 4829, + "Ġdocument": 4830, + "Ġkeep": 4831, + "Ġunamepass": 4832, + "Ġmode": 4833, + "ĠKerberos": 4834, + "ĠCredentials": 4835, + "ĠShow": 4836, + "Ġdummy": 4837, + "Ġlockout": 4838, + "ĠHISTCONTROL": 4839, + "ĠSoftRAID": 4840, + "Ġcentos": 4841, + "ĠConsentPromptBehaviorAdmin": 4842, + "erience": 4843, + "int": 4844, + "ret": 4845, + "recon": 4846, + "restart": 4847, + "once": 4848, + "Ġ\",": 4849, + "Ġ\"-": 4850, + "Ġ\"\"#{": 4851, + "Ġ\"]\"": 4852, + "atb": 4853, + "ato": 4854, + "ating": 4855, + "atter": 4856, + "ative": 4857, + "atten": 4858, + "robj": 4859, + "stp": 4860, + "stable": 4861, + "stdin": 4862, + "Ġ//": 4863, + "icip": 4864, + "icode": 4865, + "etl": 4866, + "etch": 4867, + "etbeat": 4868, + "etric": 4869, + "ecode": 4870, + "ecause": 4871, + "ority": 4872, + "omp": 4873, + "exis": 4874, + "enum": 4875, + "enrsa": 4876, + "enumerate": 4877, + "filebeat": 4878, + "&&#{": 4879, + "&&&&": 4880, + "ittle": 4881, + "}\"&&": 4882, + "}\")&&": 4883, + "}\"));$": 4884, + "olve": 4885, + "hound": 4886, + "WinSt": 4887, + "ride": 4888, + "rieve": 4889, + "sedge": 4890, + "sekur": 4891, + "Ġtor": 4892, + "Ġtra": 4893, + "Ġtarget": 4894, + "Ġtail": 4895, + "Ġcd": 4896, + "Ġcloud": 4897, + "Ġcould": 4898, + "esc": 4899, + "escription": 4900, + "acy": 4901, + "Stric": 4902, + "Connected": 4903, + "Ins": 4904, + "Inve": 4905, + "Invalid": 4906, + "InCE": 4907, + "InPV": 4908, + "Index": 4909, + "HKCR": 4910, + "regex": 4911, + "\";>%": 4912, + "Ġ'.": 4913, + "Ġ'^": 4914, + "Ġ'{": 4915, + "Ġ'*:": 4916, + "codecmd": 4917, + "amsi": 4918, + "comple": 4919, + "comsvc": 4920, + "Exclusion": 4921, + "unit": 4922, + "unset": 4923, + "uninstall": 4924, + "ateShell": 4925, + "ateInCE": 4926, + "scat": 4927, + "Ġ(($": 4928, + "Ġ(\"#{": 4929, + "ainer": 4930, + "GetObject": 4931, + "Requ": 4932, + "Replace": 4933, + "chflags": 4934, + "AtFirst": 4935, + "Ġsup": 4936, + "Top": 4937, + ");}": 4938, + ");};": 4939, + ");{$": 4940, + "door": 4941, + "model": 4942, + "Ġforeach": 4943, + "Ġfeder": 4944, + "outputFilePath": 4945, + "abel": 4946, + "Ġ{$": 4947, + "rase": 4948, + "term": 4949, + "allusers": 4950, + "Setting": 4951, + "plate": 4952, + "ird": 4953, + "ironment": 4954, + "ortcut": 4955, + "protocol": 4956, + "UsersFolder": 4957, + "Ġ\"${": 4958, + "ĠDisplay": 4959, + "ĠDescription": 4960, + "logins": 4961, + "ipconfig": 4962, + "ĠĠĠĠĠĠĠĠ": 4963, + "newModule": 4964, + "newServiceDll": 4965, + "Creating": 4966, + "ntire": 4967, + "ntivirus": 4968, + "Ġ15": 4969, + "Ġ154": 4970, + "Ġ1000": 4971, + "Ġ162": 4972, + "email": 4973, + "lyName": 4974, + "success": 4975, + "Ġbit": 4976, + "Ġbef": 4977, + "Ġbecause": 4978, + "curpid": 4979, + "Threading": 4980, + "ulation": 4981, + "Computers": 4982, + "ORT": 4983, + "ADGroupMember": 4984, + "serviceaccount": 4985, + "109": 4986, + "Enumerate": 4987, + "Ġwor": 4988, + "Ġwho": 4989, + "shred": 4990, + "shortcut": 4991, + "NTDS": 4992, + "Container": 4993, + "tester": 4994, + "testcat": 4995, + "ProcessName": 4996, + "execstart": 4997, + "ORDER": 4998, + "Ġinvo": 4999, + "imer": 5000, + "ERNAME": 5001, + "ERORDER": 5002, + "ĠClient": 5003, + "orest": 5004, + ";;};$": 5005, + "Assign": 5006, + "Ġdirectory": 5007, + "Ġdaemon": 5008, + "Ġdial": 5009, + "Ġdrives": 5010, + "Ġdmid": 5011, + "commandpath": 5012, + "usted": 5013, + "eld": 5014, + "SERVER": 5015, + "PasswordSpray": 5016, + "tedBy": 5017, + "}');": 5018, + "ServiceSettings": 5019, + "mshtml": 5020, + "ĠIEX": 5021, + "Ġgzip": 5022, + "Ġguard": 5023, + "Ġgenrsa": 5024, + "Ġthan": 5025, + "Ġact": 5026, + "Ġaux": 5027, + "Discovery": 5028, + "PowerCL": 5029, + "socket": 5030, + "ProtocolHandler": 5031, + "runonce": 5032, + "Ġpam": 5033, + "Ġpowershell": 5034, + "atomicredteam": 5035, + "spray": 5036, + "make": 5037, + "mavinject": 5038, + "Ġnormal": 5039, + "Ġneed": 5040, + "Ġ($_": 5041, + "AddIns": 5042, + "ĠPort": 5043, + "ĠPurge": 5044, + "ĠPreference": 5045, + "Seen": 5046, + "keychain": 5047, + "Char": 5048, + "PSPath": 5049, + "PSRead": 5050, + "osquery": 5051, + "ĠDefine": 5052, + "))&&": 5053, + "))\\\"\"": 5054, + "decrypt": 5055, + "ILTIN": 5056, + "Ġuseraccount": 5057, + "Ġrestart": 5058, + "');;": 5059, + "ATs": 5060, + "Ġ+=": 5061, + "registryData": 5062, + "Expect": 5063, + "Expression": 5064, + "Experience": 5065, + "Ġmatter": 5066, + "Ġnetwork": 5067, + "endlyName": 5068, + "Ġifconfig": 5069, + "Ġ$((": 5070, + "SYSTEMROOT": 5071, + "listcreds": 5072, + "OutputDirectory": 5073, + "=\"/": 5074, + "nslookup": 5075, + "Scripting": 5076, + "ScriptScan": 5077, + "ScriptEventConsumer": 5078, + "Ġdes": 5079, + "Ġdescription": 5080, + "Ġdeleted": 5081, + "Nothing": 5082, + "AccountControl": 5083, + "DomainController": 5084, + "DomainPasswordSpray": 5085, + "ĠReal": 5086, + "ĠRead": 5087, + "adminctl": 5088, + "Ġshutdown": 5089, + "CreateShortcut": 5090, + "AccessToken": 5091, + "certs": 5092, + "ĠActive": 5093, + "ĠASCII": 5094, + "ĠAPI": 5095, + "vbscript": 5096, + "Ġ*/*": 5097, + "DisableBlock": 5098, + "DisableBehavior": 5099, + "DisableRealtime": 5100, + "DisableScriptScan": 5101, + "foo": 5102, + "Webclient": 5103, + "$(#{": 5104, + "Delete": 5105, + "nonexis": 5106, + "Ġsepar": 5107, + "();;": 5108, + "ENABLE": 5109, + "ĠMac": 5110, + "Collection": 5111, + "bashrc": 5112, + "mlink": 5113, + "wallpaper": 5114, + "1218": 5115, + "}.[": 5116, + "LOLBin": 5117, + "datePath": 5118, + "noprofile": 5119, + "nologin": 5120, + "perProtection": 5121, + "')&&": 5122, + "sysctl": 5123, + "Ġcontent": 5124, + "ALL": 5125, + "trated": 5126, + "trusted": 5127, + "Ġhkcu": 5128, + "\",$": 5129, + "\",\"#{": 5130, + "Notepad": 5131, + "Ġrunas": 5132, + "ĠrunTime": 5133, + "Ġ`\"`\"": 5134, + "Ġtestuser": 5135, + "ĠSub": 5136, + "ARD": 5137, + "INJEC": 5138, + "virt": 5139, + "ĠWHE": 5140, + "Ġsetting": 5141, + "PolicyStore": 5142, + "KeyCheck": 5143, + ":\"\\..\\": 5144, + "mklink": 5145, + "unamestr": 5146, + "Ġlogging": 5147, + "Ġlogged": 5148, + "writer": 5149, + "filtr": 5150, + "Ġ\"*.": 5151, + "Ġ\"*/": 5152, + "Ġ\"*<|": 5153, + "DefaultInstall": 5154, + "phrase": 5155, + "RoleName": 5156, + ".\";}": 5157, + "EventLog": 5158, + "findstr": 5159, + "malware": 5160, + "malcmdlets": 5161, + "notification": 5162, + "tenv": 5163, + "owners": 5164, + ")&&$": 5165, + "AllText": 5166, + "NOW": 5167, + "shellhost": 5168, + "SharpHound": 5169, + "GoAWS": 5170, + "dscacheutil": 5171, + "Ġprotocol": 5172, + "Ġprotection": 5173, + "agesVal": 5174, + "466": 5175, + "HTTP": 5176, + "manServer": 5177, + "}));": 5178, + "ĠOEM": 5179, + "exfiltrated": 5180, + "ooler": 5181, + "ĠHat": 5182, + "Ġ\"[+]": 5183, + "ReadResponse": 5184, + "ReadAllText": 5185, + "shared": 5186, + "Schedul": 5187, + "Ġconfiguration": 5188, + "*.*": 5189, + "AnyDes": 5190, + "DllName": 5191, + "Ġkext": 5192, + "Ġkill": 5193, + "streamcommand": 5194, + "CertificateAction": 5195, + "Members": 5196, + "cmstp": 5197, + "TokenSet": 5198, + "Minidump": 5199, + "Virus": 5200, + "lazagne": 5201, + "Ġits": 5202, + "Ġspooler": 5203, + "capture": 5204, + "Ġlocalport": 5205, + "Ġlocalhost": 5206, + "dedit": 5207, + "places": 5208, + "Ġexpires": 5209, + "Addresses": 5210, + "installer": 5211, + "PackagesVal": 5212, + "ĠForeach": 5213, + "Ġegrep": 5214, + "Ġentire": 5215, + "Reflection": 5216, + "ScheduledTaskAction": 5217, + "compile": 5218, + "ĠwinHttp": 5219, + "ryptog": 5220, + "\");;": 5221, + "SaveTo": 5222, + "bios": 5223, + "Ġadmins": 5224, + "ĠNotepad": 5225, + "$_\"": 5226, + "nique": 5227, + "pua": 5228, + "push": 5229, + "ĠLAN": 5230, + "Ġjav": 5231, + "ĠCreated": 5232, + "Ġcannot": 5233, + "updateWallpaper": 5234, + "COMPUT": 5235, + "ialName": 5236, + "results": 5237, + "Ġclip": 5238, + "SECURITY": 5239, + "WmiInstance": 5240, + "privile": 5241, + "privesc": 5242, + "organization": 5243, + "InfoTech": 5244, + "ternateShell": 5245, + "Ġbinpath": 5246, + "LoadWith": 5247, + "ĠIPAddress": 5248, + "PROMP": 5249, + "PROGR": 5250, + "TRUN": 5251, + "ZWF": 5252, + "google": 5253, + "Ġmodified": 5254, + "Ġsshpass": 5255, + "invoke": 5256, + "Ġtickets": 5257, + "propertyType": 5258, + "HttpBrowser": 5259, + "AGUA": 5260, + "AHQ": 5261, + "AntiPhish": 5262, + "OSConfig": 5263, + "Safari": 5264, + "VolumeShadow": 5265, + "blue": 5266, + "black": 5267, + "preload": 5268, + "packetbeat": 5269, + "requiredResources": 5270, + "ĠChrome": 5271, + "ĠCheck": 5272, + "RunOnceEx": 5273, + "ĠTickets": 5274, + "PROFILING": 5275, + "145": 5276, + "AMFILES": 5277, + "DriveLetter": 5278, + "Position": 5279, + "credentials": 5280, + "marker": 5281, + "nlpb": 5282, + "powercat": 5283, + "poweroff": 5284, + "sendbyte": 5285, + "vboxmanage": 5286, + "xlsm": 5287, + "Ġvbscript": 5288, + "detectorId": 5289, + "tokens": 5290, + "Ġsecrets": 5291, + "newValueData": 5292, + "ADFSConfig": 5293, + "Ġretrieve": 5294, + "RoleMemberEmail": 5295, + "Ġdefaults": 5296, + "AADIntADFS": 5297, + ";@\";>%": 5298, + "Entity": 5299, + "HEAP": 5300, + "SHELL": 5301, + "TcpClient": 5302, + "\\*.*\"": 5303, + "both": 5304, + "xlBook": 5305, + "ĠschTasks": 5306, + "ĠobjShell": 5307, + "infotech": 5308, + "StorageHandler": 5309, + "totalopen": 5310, + "totalports": 5311, + "Ġshadowcopy": 5312, + "Special": 5313, + "expandproperty": 5314, + "MsolService": 5315, + "MsolRoleMember": 5316, + "AlternateShell": 5317, + "IHN": 5318, + "Nlc": 5319, + "Particip": 5320, + "PartialName": 5321, + "TargetPath": 5322, + "mscfile": 5323, + "warnings": 5324, + "ĠUnique": 5325, + "ĠapplicationPath": 5326, + "technique": 5327, + "rimary": 5328, + "Ġpermission": 5329, + "certificates": 5330, + "virtualbox": 5331, + "ignoreboth": 5332, + "WPDTSD": 5333, + "+/]{": 5334, + "AZQB": 5335, + "Cookies": 5336, + "DCLCWPDTSD": 5337, + "Linux": 5338, + "LastIndex": 5339, + "PYT": 5340, + "PrintBrm": 5341, + "Sockets": 5342, + "TMPFILE": 5343, + "WOW": 5344, + "libexec": 5345, + "overwrite": 5346, + "Ġloop": 5347, + "recurse": 5348, + "ĠtaskName": 5349, + "ConsoleSpray": 5350, + "RequiredResourceAccess": 5351, + "1010000": 5352, + "Ġinstall": 5353, + "Ġauto": 5354, + "vbaProject": 5355, + "foundFiles": 5356, + "VideoController": 5357, + "LOCRRC": 5358, + "WindowStyle": 5359, + "GetTypeFromCLSID": 5360, + "AaQB": 5361, + "BUILTIN": 5362, + "Finder": 5363, + "RtcC": 5364, + "Simulate": 5365, + "VIDERORDER": 5366, + "bcdedit": 5367, + "cvs": 5368, + "kextstat": 5369, + "nnni": 5370, + "pktmon": 5371, + "ported": 5372, + "prise": 5373, + "Ġenvironment": 5374, + "ĠAtomicTestT": 5375, + "Ġotherwise": 5376, + "esxi": 5377, + "cookies": 5378, + "ĠDeleted": 5379, + "Ġbruteforce": 5380, + "extracted": 5381, + "Accessibility": 5382, + "ĠAllow": 5383, + "obfusc": 5384, + "Ġdoesn": 5385, + "diskVolumeShadow": 5386, + "RemovableDrives": 5387, + "ĠHideSCA": 5388, + "IGZvciBtb": 5389, + "UltraViewer": 5390, + "LogMeInIgnition": 5391, + ",^,#{": 5392, + ";);\"@": 5393, + "Alias": 5394, + "BALROOT": 5395, + "DkmSettings": 5396, + "FriendlyName": 5397, + "GLOBALROOT": 5398, + "HarddiskVolumeShadow": 5399, + "LanmanServer": 5400, + "Override": 5401, + "RpZnlpb": 5402, + "Single": 5403, + "SWRPWPDT": 5404, + "TamperProtection": 5405, + "UACBypass": 5406, + "White": 5407, + "WerFault": 5408, + "WantedBy": 5409, + "[@]}));": 5410, + "bonblack": 5411, + "carbonblack": 5412, + "customshellhost": 5413, + "duty": 5414, + "dpsLight": 5415, + "lzdGV": 5416, + "nanodump": 5417, + "tHostKeyCheck": 5418, + "takeown": 5419, + "vaultcmd": 5420, + "Ġtemplate": 5421, + "ĠStable": 5422, + "Ġvoid": 5423, + "ĠNOT": 5424, + "attend": 5425, + "WinStations": 5426, + "sekurlsa": 5427, + "Ġtrace": 5428, + "Ġcloudtrail": 5429, + "StrictHostKeyCheck": 5430, + "Inveigh": 5431, + "InvalidCertificateAction": 5432, + "comsvcs": 5433, + "ateInCEIP": 5434, + "Ġ((${#": 5435, + "AtFirstSeen": 5436, + "Ġbefore": 5437, + "ThreadingModel": 5438, + "Assignment": 5439, + "Ġdialog": 5440, + "Ġdmidecode": 5441, + "ServiceSettingsData": 5442, + "Ġguardduty": 5443, + "PowerCLIConfiguration": 5444, + "ĠPreferences": 5445, + "osqueryd": 5446, + "DisableBlockAtFirstSeen": 5447, + "DisableBehaviorMonitoring": 5448, + "DisableRealtimeMonitoring": 5449, + "DisableScriptScanning": 5450, + "nonexistent": 5451, + "Ġseparate": 5452, + "INJECTRUN": 5453, + "ĠWHERE": 5454, + "Ġ\"*<|>*\"": 5455, + "notificationPackagesVal": 5456, + "GoAWSConsoleSpray": 5457, + "Scheduler": 5458, + "AnyDesk": 5459, + "ĠLANG": 5460, + "Ġjavascript": 5461, + "updateWallpapercode": 5462, + "COMPUTERNAME": 5463, + "organizational": 5464, + "InfoTechStorageHandler": 5465, + "LoadWithPartialName": 5466, + "PROMPT": 5467, + "PROGRAMFILES": 5468, + "AntiPhishRule": 5469, + "requiredResourcesAccess": 5470, + "Ġretrieved": 5471, + "RoleMemberEmailAddress": 5472, + "ĠschTasksCmd": 5473, + "AlternateShellStartup": 5474, + "ParticipateInCEIP": 5475, + "ĠUniqueID": 5476, + "LastIndexOf": 5477, + "obfuscated": 5478, + "HarddiskVolumeShadowCopy": 5479, + "RpZnlpbmc": 5480, + "StrictHostKeyChecking": 5481, + "INJECTRUNNING": 5482, + "notificationPackagesValues": 5483, + "!$": 5484, + "!`": 5485, + "!\"&&": 5486, + "!\"}": 5487, + "!'\"": 5488, + "!>>": 5489, + "\"\"": 5490, + "\"-": 5491, + "\":\\": 5492, + "\"\";;": 5493, + "\"\").": 5494, + "##": 5495, + "$'": 5496, + "$/": 5497, + "$;": 5498, + "$\\": 5499, + "%/#{": 5500, + "''": 5501, + "'@": 5502, + "')\"&&": 5503, + "'+'": 5504, + "'!'\"": 5505, + "(<": 5506, + "(?": 5507, + ")?": 5508, + ")`": 5509, + ")|": 5510, + "):\\": 5511, + "){;": 5512, + ")\\\"": 5513, + ")`\")\";$": 5514, + ")}};": 5515, + ")%/#{": 5516, + "*]": 5517, + "*';": 5518, + "*\")": 5519, + "**\"": 5520, + "*$/": 5521, + "+\")": 5522, + "+\":\\": 5523, + "-$": 5524, + "-*": 5525, + "-$(": 5526, + "-')": 5527, + ".%": 5528, + ".[": 5529, + "._": 5530, + ".`": 5531, + ".\"}": 5532, + ".\"&&./": 5533, + ".*$/": 5534, + "/\"": 5535, + "//": 5536, + "/$(": 5537, + "/...": 5538, + "03": 5539, + "07": 5540, + "015": 5541, + "164": 5542, + "1106": 5543, + "25": 5544, + "273": 5545, + "237": 5546, + "38": 5547, + "355": 5548, + "340": 5549, + "41": 5550, + "424": 5551, + "5319": 5552, + "514": 5553, + "68": 5554, + "600": 5555, + "76": 5556, + "789": 5557, + "840": 5558, + "821": 5559, + "963": 5560, + "909": 5561, + "983": 5562, + ":'": 5563, + ":[": 5564, + ";]\"": 5565, + ";};$": 5566, + "=(": 5567, + "=-": 5568, + "=[": 5569, + "=='": 5570, + "=@#{": 5571, + "=((": 5572, + "=)?": 5573, + ">));": 5574, + "?<": 5575, + "@{": 5576, + "AI": 5577, + "AQ": 5578, + "AV": 5579, + "AAg": 5580, + "BL": 5581, + "Bz": 5582, + "Bar": 5583, + "Bad": 5584, + "Bit": 5585, + "Bund": 5586, + "Bud": 5587, + "BIO": 5588, + "Break": 5589, + "Blob": 5590, + "BOL": 5591, + "Bios": 5592, + "CB": 5593, + "CM": 5594, + "Cb": 5595, + "Cg": 5596, + "CPath": 5597, + "Core": 5598, + "CMD": 5599, + "Cleanup": 5600, + "DH": 5601, + "DO": 5602, + "Db": 5603, + "Dn": 5604, + "Del": 5605, + "Driver": 5606, + "DNS": 5607, + "Eval": 5608, + "FB": 5609, + "FL": 5610, + "FO": 5611, + "FQ": 5612, + "FX": 5613, + "Ff": 5614, + "Fn": 5615, + "Fu": 5616, + "Fam": 5617, + "Forest": 5618, + "GC": 5619, + "GS": 5620, + "GX": 5621, + "Gn": 5622, + "Gps": 5623, + "GPS": 5624, + "GIN": 5625, + "Guard": 5626, + "HD": 5627, + "Hk": 5628, + "Hex": 5629, + "HELL": 5630, + "Home": 5631, + "HARD": 5632, + "IS": 5633, + "IU": 5634, + "Ic": 5635, + "Ik": 5636, + "Ip": 5637, + "Iuc": 5638, + "JI": 5639, + "Jl": 5640, + "Jz": 5641, + "Jitter": 5642, + "KQ": 5643, + "KV": 5644, + "Kv": 5645, + "Kz": 5646, + "KSP": 5647, + "Ls": 5648, + "Lu": 5649, + "Late": 5650, + "Lib": 5651, + "Libr": 5652, + "Label": 5653, + "Mj": 5654, + "MAT": 5655, + "Match": 5656, + "MIN": 5657, + "MULT": 5658, + "NB": 5659, + "NC": 5660, + "NU": 5661, + "Ni": 5662, + "Native": 5663, + "OG": 5664, + "OO": 5665, + "OU": 5666, + "Or": 5667, + "OOF": 5668, + "Own": 5669, + "ODB": 5670, + "Options": 5671, + "PE": 5672, + "PL": 5673, + "Pf": 5674, + "Pn": 5675, + "Pri": 5676, + "Pus": 5677, + "Plist": 5678, + "Priv": 5679, + "Pages": 5680, + "PPID": 5681, + "Pant": 5682, + "Paper": 5683, + "PWD": 5684, + "POST": 5685, + "PUA": 5686, + "PORT": 5687, + "PEntity": 5688, + "QJ": 5689, + "Qo": 5690, + "Rh": 5691, + "Rr": 5692, + "Ry": 5693, + "Ret": 5694, + "Rout": 5695, + "RIP": 5696, + "SG": 5697, + "SS": 5698, + "SW": 5699, + "Sa": 5700, + "Sn": 5701, + "Ste": 5702, + "Sen": 5703, + "Source": 5704, + "Site": 5705, + "Svc": 5706, + "Skip": 5707, + "SSH": 5708, + "SQL": 5709, + "Tak": 5710, + "TIME": 5711, + "Treat": 5712, + "Ur": 5713, + "UID": 5714, + "Uso": 5715, + "VT": 5716, + "Vc": 5717, + "Vis": 5718, + "Vbox": 5719, + "VDE": 5720, + "WH": 5721, + "WX": 5722, + "Wr": 5723, + "Wx": 5724, + "Ware": 5725, + "WOR": 5726, + "WARE": 5727, + "WIN": 5728, + "WQL": 5729, + "Xen": 5730, + "XML": 5731, + "XLL": 5732, + "XBvc": 5733, + "XPOST": 5734, + "Yn": 5735, + "Yy": 5736, + "Yes": 5737, + "YQB": 5738, + "ZQ": 5739, + "ZU": 5740, + "Zagne": 5741, + "[-": 5742, + "[$_.": 5743, + "[;]\"": 5744, + "];": 5745, + "];\"": 5746, + "]){": 5747, + "](\"{": 5748, + "^/": 5749, + "`$": 5750, + "aX": 5751, + "ai": 5752, + "bC": 5753, + "ba": 5754, + "bw": 5755, + "bor": 5756, + "bad": 5757, + "bert": 5758, + "batch": 5759, + "block": 5760, + "bled": 5761, + "cz": 5762, + "cle": 5763, + "cce": 5764, + "cpt": 5765, + "cam": 5766, + "cpl": 5767, + "cconf": 5768, + "crypt": 5769, + "cHJ": 5770, + "dD": 5771, + "dH": 5772, + "dat": 5773, + "dro": 5774, + "dit": 5775, + "dValue": 5776, + "dset": 5777, + "dash": 5778, + "daf": 5779, + "driv": 5780, + "duration": 5781, + "days": 5782, + "dhelper": 5783, + "dXJ": 5784, + "eE": 5785, + "ee": 5786, + "est": 5787, + "etent": 5788, + "fin": 5789, + "flt": 5790, + "first": 5791, + "fmm": 5792, + "final": 5793, + "firefox": 5794, + "flow": 5795, + "fetch": 5796, + "gs": 5797, + "gz": 5798, + "ger": 5799, + "git": 5800, + "gPl": 5801, + "gplink": 5802, + "gener": 5803, + "gci": 5804, + "gwmi": 5805, + "graphic": 5806, + "gserviceaccount": 5807, + "hX": 5808, + "hl": 5809, + "hy": 5810, + "hat": 5811, + "hip": 5812, + "hServer": 5813, + "hAHQ": 5814, + "iE": 5815, + "ike": 5816, + "ias": 5817, + "ired": 5818, + "iver": 5819, + "ieq": 5820, + "ied": 5821, + "ident": 5822, + "ijack": 5823, + "jA": 5824, + "jE": 5825, + "jI": 5826, + "jQ": 5827, + "jh": 5828, + "jm": 5829, + "jZXN": 5830, + "jitter": 5831, + "kb": 5832, + "ki": 5833, + "ko": 5834, + "ku": 5835, + "kdir": 5836, + "kconfig": 5837, + "kIF": 5838, + "kKC": 5839, + "lin": 5840, + "lif": 5841, + "lnet": 5842, + "last": 5843, + "mh": 5844, + "mof": 5845, + "micro": 5846, + "mage": 5847, + "mus": 5848, + "mService": 5849, + "mgr": 5850, + "mtp": 5851, + "mutil": 5852, + "mwc": 5853, + "msedge": 5854, + "nb": 5855, + "nf": 5856, + "nv": 5857, + "now": 5858, + "nop": 5859, + "nel": 5860, + "nail": 5861, + "nsent": 5862, + "numer": 5863, + "nQg": 5864, + "nCertificates": 5865, + "nqx": 5866, + "oof": 5867, + "olog": 5868, + "option": 5869, + "odb": 5870, + "pJ": 5871, + "pV": 5872, + "pX": 5873, + "pc": 5874, + "pg": 5875, + "pr": 5876, + "px": 5877, + "pho": 5878, + "pyp": 5879, + "pot": 5880, + "pcal": 5881, + "pine": 5882, + "png": 5883, + "qD": 5884, + "quser": 5885, + "rq": 5886, + "ron": 5887, + "ran": 5888, + "rsp": 5889, + "ratus": 5890, + "rsyslog": 5891, + "rsync": 5892, + "ront": 5893, + "rusion": 5894, + "rpm": 5895, + "sS": 5896, + "sf": 5897, + "sl": 5898, + "spy": 5899, + "sup": 5900, + "sure": 5901, + "sender": 5902, + "smod": 5903, + "silent": 5904, + "srm": 5905, + "sEnabled": 5906, + "sftp": 5907, + "snk": 5908, + "sConsent": 5909, + "sbG": 5910, + "setcap": 5911, + "smtp": 5912, + "tY": 5913, + "td": 5914, + "tm": 5915, + "tv": 5916, + "tor": 5917, + "typ": 5918, + "tab": 5919, + "table": 5920, + "tru": 5921, + "title": 5922, + "tAGUA": 5923, + "uT": 5924, + "ua": 5925, + "ui": 5926, + "uj": 5927, + "uer": 5928, + "uation": 5929, + "ugger": 5930, + "uished": 5931, + "uJy": 5932, + "uBOL": 5933, + "vZ": 5934, + "va": 5935, + "vin": 5936, + "vec": 5937, + "vib": 5938, + "vpack": 5939, + "vpc": 5940, + "wE": 5941, + "wI": 5942, + "wR": 5943, + "wg": 5944, + "wk": 5945, + "wq": 5946, + "wud": 5947, + "where": 5948, + "wcm": 5949, + "xor": 5950, + "xen": 5951, + "xwd": 5952, + "xsa": 5953, + "xMj": 5954, + "xwud": 5955, + "yL": 5956, + "yy": 5957, + "ykatz": 5958, + "ymm": 5959, + "yKCd": 5960, + "ynch": 5961, + "ymlink": 5962, + "yZWF": 5963, + "ycle": 5964, + "zV": 5965, + "zc": 5966, + "zg": 5967, + "{};": 5968, + "|?{": 5969, + "|[^": 5970, + "}%": 5971, + "}|": 5972, + "~')|": 5973, + "Ġ?": 5974, + "Ġi": 5975, + "Ġle": 5976, + "Ġic": 5977, + "ĠRE": 5978, + "Ġpy": 5979, + "Ġup": 5980, + "ĠValue": 5981, + "Ġ64": 5982, + "Ġver": 5983, + "ĠForce": 5984, + "ĠFolder": 5985, + "ĠOR": 5986, + "ĠHost": 5987, + "Ġop": 5988, + "ĠAss": 5989, + "Ġel": 5990, + "ĠAz": 5991, + "ĠError": 5992, + "ĠUsers": 5993, + "Ġ36": 5994, + "Ġask": 5995, + "ĠApp": 5996, + "Ġdownload": 5997, + "ĠAzure": 5998, + "Ġfilename": 5999, + "Ġvm": 6000, + "ĠServices": 6001, + "Ġib": 6002, + "Ġance": 6003, + "Ġvar": 6004, + "Ġarch": 6005, + "Ġold": 6006, + "ĠRes": 6007, + "ĠLocal": 6008, + "ĠSID": 6009, + "ĠPowerShell": 6010, + "Ġarp": 6011, + "ĠPolicy": 6012, + "ĠStream": 6013, + "ĠObjectId": 6014, + "ĠEvent": 6015, + "ĠProvider": 6016, + "Ġdump": 6017, + "Ġargs": 6018, + "Ġhello": 6019, + "ĠExpand": 6020, + "ĠRandom": 6021, + "ĠXml": 6022, + "Ġpty": 6023, + "ĠViewer": 6024, + "Ġlength": 6025, + "ĠConfiguration": 6026, + "Ġrandom": 6027, + "Ġports": 6028, + "ĠFullName": 6029, + "Ġ96": 6030, + "ĠAtt": 6031, + "ĠCreation": 6032, + "Ġvari": 6033, + "Ġany": 6034, + "ĠHISTFILESIZE": 6035, + "ĠEnhanced": 6036, + "ĠManufacturer": 6037, + "ĠHISTSIZE": 6038, + "ĠLegalNoticeText": 6039, + "ĠLegalNoticeCaption": 6040, + "Ġarchive": 6041, + "ĠVideo": 6042, + "ĠBookmarks": 6043, + "ĠQU": 6044, + "Ġerase": 6045, + "Ġmega": 6046, + "ĠSpring": 6047, + "ĠKeep": 6048, + "ĠSIGINT": 6049, + "ĠHKCR": 6050, + "ĠNothing": 6051, + "Ġextracted": 6052, + "ere": 6053, + "erface": 6054, + "erprise": 6055, + "Ġ-&&": 6056, + "rece": 6057, + "repro": 6058, + "replication": 6059, + "renamed": 6060, + "online": 6061, + "onsor": 6062, + "Ġ\"+": 6063, + "Ġ\"^": 6064, + "Ġ\"\")": 6065, + "Ġ\".\"": 6066, + "Ġ\"'!'\"": 6067, + "ats": 6068, + "atson": 6069, + "lels": 6070, + "leCl": 6071, + "legal": 6072, + "lesn": 6073, + "state": 6074, + "station": 6075, + "stMethod": 6076, + "stabl": 6077, + "Ġ/@": 6078, + "icExtension": 6079, + "etad": 6080, + "etit": 6081, + "ecycle": 6082, + "orh": 6083, + "orar": 6084, + "orSecurity": 6085, + "orld": 6086, + "memd": 6087, + "menc": 6088, + "nto": 6089, + "nterface": 6090, + "ali": 6091, + "alware": 6092, + "allels": 6093, + "Ġ$$'": 6094, + "ioning": 6095, + "ionSystem": 6096, + "array": 6097, + "serve": 6098, + "cen": 6099, + "enName": 6100, + "enab": 6101, + "encoding": 6102, + "filecontent": 6103, + "Ġ=\"": 6104, + "Ġ=$": 6105, + "&&$": 6106, + "&&[": 6107, + "adfs": 6108, + "itd": 6109, + "loy": 6110, + "anne": 6111, + "}\"-": 6112, + "}\"}": 6113, + "}\"))": 6114, + "PathBypass": 6115, + "PathsEnabled": 6116, + "Provis": 6117, + "ingAction": 6118, + "ingDirectory": 6119, + "ingAttach": 6120, + "hocol": 6121, + "WinSo": 6122, + "rip": 6123, + "rigger": 6124, + "seq": 6125, + "sevec": 6126, + "exePath": 6127, + "userdomain": 6128, + "userlist": 6129, + "hest": 6130, + "Ġtot": 6131, + "Ġtop": 6132, + "Ġtrun": 6133, + "Ġtrust": 6134, + "Ġtshark": 6135, + "Ġtitle": 6136, + "Ġcb": 6137, + "Ġcn": 6138, + "Ġcred": 6139, + "Ġcap": 6140, + "Ġcase": 6141, + "Ġclose": 6142, + "Ġcalled": 6143, + "Ġcreat": 6144, + "Ġcylance": 6145, + "001010000": 6146, + "NamedPipe": 6147, + "Ġ|/": 6148, + "acc": 6149, + "acl": 6150, + "acon": 6151, + "State": 6152, + "Stand": 6153, + "Stub": 6154, + "Stratus": 6155, + "Inf": 6156, + "Inject": 6157, + "InFile": 6158, + "Inge": 6159, + "Inline": 6160, + "Inbox": 6161, + "WindowsAp": 6162, + "pth": 6163, + "wordpath": 6164, + "wordwll": 6165, + "regedit": 6166, + "\";\"": 6167, + "\";};$": 6168, + "Ġ'-": 6169, + "Ġ'>": 6170, + "Ġ'[": 6171, + "core": 6172, + "amp": 6173, + ":\\'": 6174, + "Exe": 6175, + "Ext": 6176, + "Exts": 6177, + "Exclude": 6178, + "Existing": 6179, + "Exfiltr": 6180, + "ift": 6181, + "ifed": 6182, + "context": 6183, + "outlook": 6184, + "unload": 6185, + "unted": 6186, + "unlink": 6187, + "unattend": 6188, + "ationTime": 6189, + "illed": 6190, + "scp": 6191, + "scan": 6192, + "scpu": 6193, + "Ġ(\"": 6194, + "Ġ(&": 6195, + "Ġ(#{": 6196, + "Ġ>=": 6197, + "toso": 6198, + "veHk": 6199, + "isp": 6200, + "isher": 6201, + "ubunt": 6202, + "ubleCl": 6203, + "GetCurrent": 6204, + "GetCred": 6205, + "GetRaw": 6206, + "RestMethod": 6207, + "aspx": 6208, + "chsh": 6209, + "ersonate": 6210, + "AtLogon": 6211, + "};&": 6212, + "};;": 6213, + "};[": 6214, + "Ġsure": 6215, + "Ġsleep": 6216, + "Ġsrm": 6217, + "Ġsvc": 6218, + "Ġsilver": 6219, + "Ġsetcap": 6220, + "Ġsdset": 6221, + "ToStart": 6222, + "ToString": 6223, + "ToAss": 6224, + "ToRun": 6225, + ");[": 6226, + "NewAction": 6227, + "NewClass": 6228, + "Newline": 6229, + "mouse": 6230, + "mounted": 6231, + "Ġftp": 6232, + "Ġfollow": 6233, + "Ġfalcon": 6234, + "Ġfailed": 6235, + "Ġfilled": 6236, + "redirection": 6237, + "redhat": 6238, + "outputdirectory": 6239, + "mple": 6240, + "Ġ{$_": 6241, + "AtomicCert": 6242, + "AtomicSafe": 6243, + "FileT": 6244, + "Filename": 6245, + "Filepath": 6246, + "SetWallpaper": 6247, + "SetAccessRule": 6248, + "passwordList": 6249, + "passwordFilter": 6250, + "addin": 6251, + "upg": 6252, + "upport": 6253, + "updater": 6254, + "plutil": 6255, + "irationTime": 6256, + "ObjectDel": 6257, + "loading": 6258, + "orthand": 6259, + "otnet": 6260, + "Currentactive": 6261, + "probe": 6262, + "provider": 6263, + "prompt": 6264, + "ForAAD": 6265, + "UserDo": 6266, + "UserAccountControl": 6267, + "Ġ\"$\"": 6268, + "Ġ\"$($": 6269, + "netReporting": 6270, + "ĠDE": 6271, + "ĠDO": 6272, + "ĠDword": 6273, + "ĠDisc": 6274, + "logout": 6275, + "logging": 6276, + "logger": 6277, + "ipAddresses": 6278, + "newfile": 6279, + "newLegalNoticeText": 6280, + "newLegalNoticeCaption": 6281, + "Ġ13": 6282, + "Ġ17": 6283, + "Ġ100": 6284, + "Ġ164": 6285, + "Ġ110": 6286, + "Ġ111": 6287, + "Ġ157": 6288, + "Ġ197": 6289, + "lyTak": 6290, + "suid": 6291, + ").#{": 6292, + "TeXN": 6293, + "Ġbu": 6294, + "Ġbut": 6295, + "Ġbetter": 6296, + "ĠREGIST": 6297, + "contents": 6298, + "contentType": 6299, + "Lock": 6300, + "WriteTime": 6301, + "WriteLine": 6302, + "clt": 6303, + "clist": 6304, + "clang": 6305, + "apis": 6306, + "aphound": 6307, + "Ġ[*]": 6308, + "scriptPath": 6309, + "scriptContent": 6310, + "irePre": 6311, + "StartDirectory": 6312, + "ulator": 6313, + "ulated": 6314, + "Commenc": 6315, + "ayLoad": 6316, + "bind": 6317, + "Hosts": 6318, + "1553": 6319, + "1552": 6320, + "rawing": 6321, + "ADObject": 6322, + "ADComputer": 6323, + "ADODB": 6324, + "]::#{": 6325, + "dups": 6326, + "104": 6327, + "1035": 6328, + "1091": 6329, + "Engl": 6330, + "Strings": 6331, + "StringSet": 6332, + "thumb": 6333, + "threading": 6334, + "third": 6335, + "NetIP": 6336, + "NetTCP": 6337, + "NetWire": 6338, + "sha": 6339, + "NTLM": 6340, + "NTAccount": 6341, + "mdir": 6342, + "efd": 6343, + "ItemPropertyValue": 6344, + "Ġ>>/": 6345, + "ProcessToStart": 6346, + "inelyTak": 6347, + "execstop": 6348, + "lsb": 6349, + "lsm": 6350, + "Ġinit": 6351, + "Ġinsp": 6352, + "Ġinvalid": 6353, + "Ġinsmod": 6354, + "immutable": 6355, + "ERT": 6356, + "TWEnabled": 6357, + "Ġ%{": 6358, + "ebugger": 6359, + "ĠCN": 6360, + "ĠCatch": 6361, + "ĠCache": 6362, + "ĠCMD": 6363, + "ĠCaption": 6364, + "ĠCIM": 6365, + "ĠCryptog": 6366, + "%\\..\\": 6367, + "SecurityProviders": 6368, + "SecurityIdentifier": 6369, + "igest": 6370, + "ighest": 6371, + ";;[": 6372, + "`\"`\"": 6373, + "`\"`\",": 6374, + "arydirectory": 6375, + "aryAuthentication": 6376, + "('/": 6377, + "('-')": 6378, + "Manip": 6379, + "imewd": 6380, + "Ġ;};": 6381, + "Ġdn": 6382, + "Ġday": 6383, + "usd": 6384, + "repair": 6385, + "elt": 6386, + "dllpath": 6387, + "objectclass": 6388, + "Ġ20": 6389, + "Ġ200": 6390, + "Ġ240": 6391, + "Passwords": 6392, + "PasswordDBLocation": 6393, + ")\"\"\";;": 6394, + "HIG": 6395, + "HIN": 6396, + "HIVE": 6397, + "tedData": 6398, + "hostw": 6399, + "}')": 6400, + "}').": 6401, + "}')\"": 6402, + "}');$": 6403, + "ServiceObjectDel": 6404, + "msxsl": 6405, + "}\\\"": 6406, + "ĠImage": 6407, + "ĠInterface": 6408, + "Ġgreen": 6409, + "Ġgwmi": 6410, + "Ġgetent": 6411, + "localip": 6412, + "Ġantivirus": 6413, + "Ġawk": 6414, + "extList": 6415, + "}\";.\\": 6416, + "PowerDump": 6417, + "soaphound": 6418, + "635": 6419, + "637": 6420, + "Ġextension": 6421, + "Ġextern": 6422, + "ShellExecute": 6423, + "ShellServiceObjectDel": 6424, + "runme": 6425, + "running": 6426, + "runbook": 6427, + "Ġping": 6428, + "Ġprin": 6429, + "Ġpwd": 6430, + "Ġprint": 6431, + "Ġpause": 6432, + "Ġperson": 6433, + "Ġpush": 6434, + "1111": 6435, + "1134": 6436, + "11355": 6437, + "AzDomain": 6438, + "AzSubscription": 6439, + "spn": 6440, + "spaw": 6441, + "ĠSystemParameters": 6442, + "folderarray": 6443, + "copyPath": 6444, + "uments": 6445, + "3619": 6446, + "setup": 6447, + "setspn": 6448, + "Ġ]&&": 6449, + "runtime": 6450, + "ĠPS": 6451, + "ĠPut": 6452, + "ĠPost": 6453, + "ĠPID": 6454, + "ĠPRO": 6455, + "ĠPubl": 6456, + "ĠPrimary": 6457, + "Commands": 6458, + "CommandParamVariation": 6459, + "CommandToRun": 6460, + "EXEC": 6461, + "cating": 6462, + "Seatb": 6463, + "Rundll": 6464, + "RunAs": 6465, + "RunTime": 6466, + "RunKey": 6467, + "RunHTMLApplication": 6468, + "RunLevel": 6469, + "keyObjectGuid": 6470, + "Autos": 6471, + "Change": 6472, + "Chunk": 6473, + "Channe": 6474, + "PSImage": 6475, + "PSDrive": 6476, + "PSRemo": 6477, + "Ġ};;#": 6478, + "websi": 6479, + "webproxy": 6480, + "webcam": 6481, + "LogOff": 6482, + "AppRole": 6483, + "AppCompat": 6484, + "AppPathBypass": 6485, + ")))": 6486, + ")))&&": 6487, + "))))&&": 6488, + "Parallels": 6489, + "targetsecure": 6490, + "inputfile": 6491, + "inputFilePath": 6492, + "AzureBlob": 6493, + "AzurePasswords": 6494, + "='/": 6495, + "AsLocal": 6496, + "Timeout": 6497, + "Ġreq": 6498, + "Ġresult": 6499, + "Ġrestor": 6500, + "apppatch": 6501, + "884": 6502, + "Ġstorage": 6503, + "Ġstats": 6504, + "ServerName": 6505, + "ServerIP": 6506, + "(\"\"": 6507, + "(\"$": 6508, + "(\"\\": 6509, + "passphrase": 6510, + "Ġ+\"%": 6511, + "ExpirationTime": 6512, + "Lists": 6513, + "Robert": 6514, + "queryformat": 6515, + "printenv": 6516, + "Ġmc": 6517, + "Ġmy": 6518, + "Ġmasquer": 6519, + "Ġmkdir": 6520, + "Ġmalware": 6521, + "urlcache": 6522, + "cipher": 6523, + "UseEncodedArguments": 6524, + "ĠTry": 6525, + "ĠTEST": 6526, + "ĠTimer": 6527, + "Ġisn": 6528, + "AzureADTenant": 6529, + "beacon": 6530, + "ĠfileObject": 6531, + "ExecStop": 6532, + "DirectoryEnt": 6533, + "DirectoryIdentifier": 6534, + "ible": 6535, + "nsn": 6536, + "interval": 6537, + "ManagerBackup": 6538, + "Ġdelet": 6539, + "NotIn": 6540, + "NotRequired": 6541, + "NotRequ": 6542, + "fflesn": 6543, + "gnupg": 6544, + "Ġ}}": 6545, + "AccountToken": 6546, + "DomainUser": 6547, + "DomainUsers": 6548, + "DomainProfile": 6549, + "DomainTrust": 6550, + "subj": 6551, + "ĠRequest": 6552, + "ĠReporting": 6553, + "Ġshred": 6554, + "Ġshorthand": 6555, + "CreateRemote": 6556, + "CreateThread": 6557, + "AccessControl": 6558, + "AccessProtection": 6559, + "vides": 6560, + "ĠAnti": 6561, + "ĠAES": 6562, + "FilePaths": 6563, + "OnRealtime": 6564, + "OnAccessProtection": 6565, + "secret": 6566, + "winzip": 6567, + "winHttp": 6568, + "Ġ*&&": 6569, + "Ġ***\"": 6570, + "ProgramFiles": 6571, + "DisableInt": 6572, + "DisableConfig": 6573, + "DisableIO": 6574, + "DisableScan": 6575, + "DisableKeep": 6576, + "DisableEnhancedNotifications": 6577, + "DisableSR": 6578, + "DisableRout": 6579, + "DisableOnAccessProtection": 6580, + "crond": 6581, + "fodhelper": 6582, + "ApplicationId": 6583, + "ApplicationPermission": 6584, + "577": 6585, + "encodedChunk": 6586, + "\"):": 6587, + "none": 6588, + "Ġsessh": 6589, + "();\"": 6590, + "();#": 6591, + "();[": 6592, + "();}": 6593, + "();@('": 6594, + "169": 6595, + "1602": 6596, + "END": 6597, + "ENV": 6598, + "ĠMain": 6599, + "ĠMax": 6600, + "ĠMake": 6601, + "ĠMonitor": 6602, + "ĠMini": 6603, + "Ġelseif": 6604, + "NEVT": 6605, + "Reset": 6606, + "Spoof": 6607, + "LocalPort": 6608, + "LocalGroupMember": 6609, + "EnablePus": 6610, + "ACE": 6611, + "Collect": 6612, + "Kevin": 6613, + "868": 6614, + "869": 6615, + "}.$": 6616, + "}.*\"": 6617, + "Ġlive": 6618, + "Ġlater": 6619, + "Ġlike": 6620, + "Ġlscpu": 6621, + "Locations": 6622, + "FilterPolicy": 6623, + "noexit": 6624, + "textExtra": 6625, + "textPattern": 6626, + "textMatches": 6627, + "CommandLineEventConsumer": 6628, + "()).": 6629, + "perm": 6630, + "perator": 6631, + "DohServer": 6632, + "sysmon": 6633, + "sysadminctl": 6634, + "sysrq": 6635, + "Ġcontext": 6636, + "Ġcontoso": 6637, + "topic": 6638, + "ventvwr": 6639, + "ventionSystem": 6640, + "AdminLogon": 6641, + "9961": 6642, + "SION": 6643, + "Ġ512": 6644, + "Ġ503": 6645, + "PowerShellIc": 6646, + "CertData": 6647, + "CertTrust": 6648, + "NoPassword": 6649, + "NoAuto": 6650, + "NoNewline": 6651, + "ModuleLogging": 6652, + "Unicode": 6653, + "scriptions": 6654, + "Activate": 6655, + "lineOption": 6656, + "configure": 6657, + "Interface": 6658, + "Interval": 6659, + "\\$($": 6660, + "sshd": 6661, + "GroupName": 6662, + "GroupID": 6663, + "GroupId": 6664, + "afe": 6665, + "ĠSave": 6666, + "ĠSilver": 6667, + "ĠSHELL": 6668, + "ĠSupport": 6669, + "INFS": 6670, + "TaskMod": 6671, + "TaskScheduler": 6672, + "Upper": 6673, + "ldr": 6674, + "tract": 6675, + "ĠWall": 6676, + "ĠWIT": 6677, + "ĠWorld": 6678, + "Ġcomputer": 6679, + "TempCred": 6680, + "1981": 6681, + "liM": 6682, + "Ġsetup": 6683, + "procdump": 6684, + "KeyCredential": 6685, + "KeyIdentifier": 6686, + "KeyExport": 6687, + ":\"%": 6688, + ":\"\\": 6689, + ";};;": 6690, + "IGdy": 6691, + "dcrypt": 6692, + "dcshadow": 6693, + "dcServerName": 6694, + "save": 6695, + "saction": 6696, + "saver": 6697, + "Ġ\"\"$($": 6698, + "Ġbaseboard": 6699, + "FullControl": 6700, + "defender": 6701, + "RequestorSecurity": 6702, + "Sessions": 6703, + "SessionManagerBackup": 6704, + "ProtectionOverride": 6705, + "pwquality": 6706, + "Ġ\"*/.": 6707, + "Redirection": 6708, + "ComputerFQ": 6709, + "crontab": 6710, + "014": 6711, + "ncn": 6712, + "ncrypt": 6713, + "phone": 6714, + "Ġlsa": 6715, + "Ġlspci": 6716, + "Ġchrome": 6717, + "Ġchkconfig": 6718, + "computername": 6719, + "RoleDefinition": 6720, + "windowspowershell": 6721, + ".\";;$": 6722, + "4079": 6723, + "40600": 6724, + "EventFilter": 6725, + "FromString": 6726, + "PreventionSystem": 6727, + "ktopimg": 6728, + "notice": 6729, + "notran": 6730, + "tenance": 6731, + "arguments": 6732, + "offline": 6733, + "Company": 6734, + "Downloadstring": 6735, + "208": 6736, + "2021": 6737, + "CimV": 6738, + "pwdage": 6739, + "shells": 6740, + "Sharpweb": 6741, + "SharpUp": 6742, + "Ġbeen": 6743, + "Ġbehavior": 6744, + "GoToAss": 6745, + "IPs": 6746, + "Ġenc": 6747, + "Ġencodecmd": 6748, + "Ġensure": 6749, + "Ġproduct": 6750, + "Ġprompt": 6751, + "InstanceModification": 6752, + "HTT": 6753, + "HTAS": 6754, + "MpCmd": 6755, + "MpEngine": 6756, + "MpEnablePus": 6757, + "SubString": 6758, + "Submit": 6759, + "auditctl": 6760, + "auditbeat": 6761, + "monitor": 6762, + "monolog": 6763, + "manCreds": 6764, + "simple": 6765, + "taskhostw": 6766, + "}){": 6767, + "}){;": 6768, + "ĠOperator": 6769, + "ĠSearch": 6770, + "Ġcurrentprofile": 6771, + "56789": 6772, + "ĠHel": 6773, + "ĠHidden": 6774, + "ĠHighest": 6775, + "Ġ\"[[;]\"": 6776, + "ardProfile": 6777, + "ReadCount": 6778, + "EndDate": 6779, + "shares": 6780, + "ResourceGroupName": 6781, + "3777": 6782, + "DllImport": 6783, + "Ġkind": 6784, + "Ġkmutil": 6785, + "Ġ\"\\\\#{": 6786, + "Clients": 6787, + "CertificateThumbprint": 6788, + "HON": 6789, + "NDLL": 6790, + "NDMu": 6791, + "SCRIP": 6792, + "SCHTAS": 6793, + "SDRC": 6794, + "Tran": 6795, + "VMWare": 6796, + "cmV": 6797, + "cmxsa": 6798, + "fullmemd": 6799, + "symb": 6800, + "xmlfile": 6801, + "readme": 6802, + "Tokens": 6803, + "TokenSystem": 6804, + "cluster": 6805, + "clsids": 6806, + "nessusd": 6807, + "leroot": 6808, + "expired": 6809, + "RemoteComputer": 6810, + "RemoteCertTrust": 6811, + "Ġspace": 6812, + "Ġspray": 6813, + "SearchString": 6814, + "officetest": 6815, + "443": 6816, + "4444": 6817, + "44455": 6818, + "caption": 6819, + "ishPages": 6820, + "AddressFam": 6821, + "installtype": 6822, + "/*;": 6823, + "291": 6824, + "Feder": 6825, + "TermService": 6826, + "ftpUr": 6827, + "umes": 6828, + "ĠFax": 6829, + "ĠGreen": 6830, + "ĠUsing": 6831, + "Ġevery": 6832, + "Ġeventvwr": 6833, + "Ġxor": 6834, + "Ġxclip": 6835, + "Ġonly": 6836, + "ĠUserShell": 6837, + "releases": 6838, + "&&###": 6839, + "RefObjectId": 6840, + "programdata": 6841, + "Rules": 6842, + "ScheduledTaskPrincipal": 6843, + "ScheduledTaskSettings": 6844, + "ScheduledTaskTrigger": 6845, + "mmc": 6846, + "mimikatzParam": 6847, + "compression": 6848, + "SecondaryAuthentication": 6849, + "\",\"/": 6850, + "\",\"--": 6851, + "\");{": 6852, + "945": 6853, + "ActiveScriptEventConsumer": 6854, + "GVhZ": 6855, + "GVyKCd": 6856, + "Warnings": 6857, + "nodes": 6858, + "ĠBypass": 6859, + "ĠBrowser": 6860, + "Ġunlink": 6861, + "Ġtemporar": 6862, + "Ġadminuser": 6863, + "ĠEnableScripts": 6864, + "ĠEnableLin": 6865, + "ĠEnableSmartScreen": 6866, + "}\"),": 6867, + "ScreenConnect": 6868, + "NETFramework": 6869, + "803": 6870, + "FSHome": 6871, + "LaunchINFS": 6872, + "MLToken": 6873, + "Mailbox": 6874, + "MailMessage": 6875, + "MaxConnections": 6876, + "SPOOF": 6877, + "ivenName": 6878, + "yanki": 6879, + "Ġ<<": 6880, + "ĠLong": 6881, + "exampleName": 6882, + "exampleFullPath": 6883, + "kedConnections": 6884, + "Ġsubnet": 6885, + "Ġsubprocess": 6886, + "Ġsubscriptions": 6887, + "apiKey": 6888, + "AutoRun": 6889, + "LogonCredential": 6890, + "UpdatedValue": 6891, + "\"));$": 6892, + "\")){;": 6893, + "343": 6894, + "3456789": 6895, + "MDAy": 6896, + "NPClass": 6897, + "OLSpray": 6898, + "Operational": 6899, + "Subject": 6900, + "WScriptShell": 6901, + "issue": 6902, + "wbadmin": 6903, + "ĠVolume": 6904, + "ĠVBox": 6905, + "Ġalias": 6906, + "ĠDisableEnhancedNotifications": 6907, + "ĠDisablePriv": 6908, + "ĠISA": 6909, + "ĠISO": 6910, + "ĠDefaults": 6911, + "ĠDefaultInstall": 6912, + "ĠDefaultPassword": 6913, + "ĠDefaultUserName": 6914, + "ĠDefaultDomainName": 6915, + "evilscreen": 6916, + "++){": 6917, + "024": 6918, + "7204": 6919, + "ASR": 6920, + "Trim": 6921, + "WDWO": 6922, + "WDigest": 6923, + "aWNl": 6924, + "field": 6925, + "parents": 6926, + "tcpdump": 6927, + "zeros": 6928, + "ĠExtract": 6929, + "ĠServiceDll": 6930, + "Ġ\"#\"": 6931, + "orginal": 6932, + "orgWallpaper": 6933, + "startingDirectory": 6934, + "ĠIPv": 6935, + "\":{\"": 6936, + "(`\"`\"": 6937, + "Byb": 6938, + "ByHost": 6939, + "ByXml": 6940, + "MSOLSpray": 6941, + "PROVIDERORDER": 6942, + "SpynetReporting": 6943, + "skar": 6944, + "ĠShellSmartScreen": 6945, + "ĠAsymm": 6946, + "Ġaccounts": 6947, + "Ġmodprobe": 6948, + "downldr": 6949, + "Ġ'#!/": 6950, + "Ġ'#\\!/": 6951, + "connection": 6952, + "screencapture": 6953, + "chunks": 6954, + "ĠDisabl": 6955, + "subnetIPs": 6956, + "NPPSPY": 6957, + "0899": 6958, + "DEFA": 6959, + "DESCRIP": 6960, + "ParentId": 6961, + "[]]$": 6962, + "[]]'": 6963, + "azure": 6964, + "caches": 6965, + "gpg": 6966, + "gpo": 6967, + "ieDBLocation": 6968, + "pYjI": 6969, + "prefetch": 6970, + "preserve": 6971, + "package": 6972, + "swap": 6973, + "swift": 6974, + "saml": 6975, + "tickets": 6976, + "Ġexecve": 6977, + "ĠLogged": 6978, + "ĠCompress": 6979, + "AdvancedRun": 6980, + "AdvancedSetting": 6981, + "RunOnceKey": 6982, + "Interopservices": 6983, + "objid": 6984, + "EncodedCommandParamVariation": 6985, + "memberof": 6986, + "excludedpath": 6987, + "excludedProcess": 6988, + "excludedExts": 6989, + "&`\"`\")\";$": 6990, + "3540600": 6991, + "CmdLine": 6992, + "Posts": 6993, + "Smb": 6994, + "SmtpServer": 6995, + "dsenab": 6996, + "displayName": 6997, + "discovery": 6998, + "dnsServer": 6999, + "dnsQuery": 7000, + "policies": 7001, + "xlsx": 7002, + "ĠMicrosoftRedirection": 7003, + "ĠProcessor": 7004, + "ĠEXIT": 7005, + "InputProvider": 7006, + "FileSystemObject": 7007, + "FileSystemAccessRule": 7008, + "FileSystemLabel": 7009, + "CreationInclude": 7010, + "1070": 7011, + "1074": 7012, + "1222002": 7013, + "lsaKey": 7014, + "Ġmethods": 7015, + "decodedText": 7016, + "decodedContent": 7017, + "Ġldapadd": 7018, + "ldapadd": 7019, + "ldapsearch": 7020, + "Translate": 7021, + "AADIntAccessToken": 7022, + "ĠGroupPolicyRefreshTimeDC": 7023, + "533": 7024, + ";@($": 7025, + "AuditLog": 7026, + "AuditBypass": 7027, + "CustomKeyIdentifier": 7028, + "DumpCreds": 7029, + "Enterprise": 7030, + "FORMAT": 7031, + "KerberosRequestorSecurity": 7032, + "NonExisting": 7033, + "RDPPORT": 7034, + "UNCPath": 7035, + "bytesRead": 7036, + "xlam": 7037, + "ĠRename": 7038, + "ĠRSA": 7039, + "Ġpsr": 7040, + "Ġscrobj": 7041, + "ĠobjExec": 7042, + "Ġobjws": 7043, + "urnValue": 7044, + "StorageType": 7045, + "checks": 7046, + "dotm": 7047, + "agentd": 7048, + "...\";$": 7049, + "Ġdisabled": 7050, + "EXEFilename": 7051, + "CreateProcessSystem": 7052, + "autosuid": 7053, + "Internalmonolog": 7054, + "RegisterXLL": 7055, + "RegisterByXml": 7056, + "ShortcutLocation": 7057, + "calendar": 7058, + "Technique": 7059, + "kirbifile": 7060, + "65535": 7061, + "Alive": 7062, + "AclObject": 7063, + "Flags": 7064, + "GRfa": 7065, + "Generic": 7066, + "Generated": 7067, + "Sysmon": 7068, + "SysWOW": 7069, + "cbagentd": 7070, + "launcher": 7071, + "tbW": 7072, + "truncating": 7073, + "weet": 7074, + "weak": 7075, + "warning": 7076, + "ĠETWEnabled": 7077, + "ĠUninstall": 7078, + "ĠAutoShare": 7079, + "ĠAutoAdminLogon": 7080, + "ontLog": 7081, + "homedrive": 7082, + "StatusBar": 7083, + "Ġdscacheutil": 7084, + "Ġperl": 7085, + "Ġconnection": 7086, + "PerfOS": 7087, + "PerfFormat": 7088, + "xslfile": 7089, + "Ġ999999": 7090, + "Ġcertificates": 7091, + "+/]": 7092, + "CFBund": 7093, + "CookieDBLocation": 7094, + "DCLCSWRPWPDT": 7095, + "Failed": 7096, + "Heading": 7097, + "HistorySave": 7098, + "MuY": 7099, + "SAMLToken": 7100, + "VBScript": 7101, + "Valid": 7102, + "VERSION": 7103, + "cuMC": 7104, + "driverquery": 7105, + "hZGRfa": 7106, + "luZ": 7107, + "lush": 7108, + "mtab": 7109, + "postData": 7110, + "sampleFile": 7111, + "sampleData": 7112, + "})){": 7113, + "Ġ^|": 7114, + "Ġyour": 7115, + "Ġyou": 7116, + "Ġatomicredteam": 7117, + "ĠNULL": 7118, + "recursive": 7119, + "selectors": 7120, + "Ġ'%{": 7121, + "istinguished": 7122, + "Ġsimulate": 7123, + "Ġ128": 7124, + "Ġinstance": 7125, + "Ġauth": 7126, + "Ġready": 7127, + "vbaCode": 7128, + "foundFilePaths": 7129, + "ĠMSOnline": 7130, + "transport": 7131, + "transfer": 7132, + "LOCRSDRC": 7133, + "syntaxList": 7134, + "--------": 7135, + "ĠExportable": 7136, + "WindowState": 7137, + "PhishingAttach": 7138, + "originalDescription": 7139, + "GetTypeFromProgID": 7140, + "iWindowPosY": 7141, + "6055": 7142, + "Evil": 7143, + "LdapConnection": 7144, + "LdapDirectoryIdentifier": 7145, + "MacOS": 7146, + "PXVy": 7147, + "RUNDLL": 7148, + "TSConnections": 7149, + "UgVDE": 7150, + "Usage": 7151, + "UsIHN": 7152, + "VBAaddin": 7153, + "VBAWarnings": 7154, + "WIyL": 7155, + "WINEVT": 7156, + "WorkingDirectory": 7157, + "]*\\.[": 7158, + "dnscat": 7159, + "jscname": 7160, + "jscpath": 7161, + "journald": 7162, + "mypid": 7163, + "mypwd": 7164, + "rtf": 7165, + "sensor": 7166, + "sensit": 7167, + "trusts": 7168, + "wLjE": 7169, + "ĠInstallDate": 7170, + "ĠQueryLanguage": 7171, + "erasedups": 7172, + "icalPath": 7173, + "ntdsutil": 7174, + "fileExtensionsString": 7175, + "networksetup": 7176, + "Ġaddresses": 7177, + "emondClients": 7178, + "Ġbackdoor": 7179, + "AdmPwdExpirationTime": 7180, + "NetFirewallRule": 7181, + "Ġdecodecmd": 7182, + ")\")){;": 7183, + "msbuildname": 7184, + "msbuildpath": 7185, + "ĠINIT": 7186, + "ĠINFO": 7187, + "localgroupmember": 7188, + "DisallowRun": 7189, + "DisallowExploit": 7190, + "PowerPnt": 7191, + "PowerPoint": 7192, + "AzRoleDefinition": 7193, + "AzRoleAssignment": 7194, + "AuthType": 7195, + "formation": 7196, + "AzureADDirectoryRole": 7197, + "AzureADDirectoryRoleMember": 7198, + "ScriptBlockLogging": 7199, + "secondOctet": 7200, + "secondarydirectory": 7201, + "DisableAntiSpyware": 7202, + "DisableAntiVirus": 7203, + "Springfield": 7204, + "timestomp": 7205, + "timestamp": 7206, + "VMHostService": 7207, + "compresslevel": 7208, + "attributes": 7209, + "Ġadministrators": 7210, + "EncodedArgumentsParamVariation": 7211, + "WMIObject": 7212, + "WMIExec": 7213, + "bGxpYjI": 7214, + "Attachments": 7215, + "ĠGroupPolicyRefreshTimeOffsetDC": 7216, + "LDAPFilter": 7217, + "Ġsyslogd": 7218, + "ĠLastUsedTimeStart": 7219, + "ĠLastUsedTimeStop": 7220, + "TenantId": 7221, + "\"};;$": 7222, + "/;\\": 7223, + ":*;": 7224, + "Blbi": 7225, + "CCDCLCSWRPWPDT": 7226, + "CnJl": 7227, + "CCLCSW": 7228, + "Detail": 7229, + "Denial": 7230, + "Deploy": 7231, + "Etw": 7232, + "NextBytes": 7233, + "PUBL": 7234, + "Potato": 7235, + "Rlbn": 7236, + "SamplesConsent": 7237, + "UMTU": 7238, + "audisp": 7239, + "cfg": 7240, + "impact": 7241, + "nZpY": 7242, + "tZC": 7243, + "wMDIuc": 7244, + "wpbbin": 7245, + "ĠNFSHome": 7246, + "ĠProxy": 7247, + "Ġ325": 7248, + "ĠTimeService": 7249, + "Ġzipfile": 7250, + "Ġ4096": 7251, + "ĠVerify": 7252, + "ĠScreenSave": 7253, + "Ġ\"]\");": 7254, + "etricX": 7255, + "acyExperience": 7256, + "completed": 7257, + "Ġsupported": 7258, + "TopicExtension": 7259, + ");};;#": 7260, + "Ġfederation": 7261, + "allusersprofile": 7262, + "ĠDisplayVersion": 7263, + "1098": 7264, + "EnumerateAzureBlob": 7265, + "Ġworked": 7266, + "Ġwhoami": 7267, + "Ġinvoke": 7268, + "Ġactivate": 7269, + "PSReadlineOption": 7270, + "ĠRealName": 7271, + "ĠReadOnly": 7272, + "ĠActiveDirectory": 7273, + "ĠMacro": 7274, + "Collections": 7275, + "virtio": 7276, + "exfiltratedData": 7277, + "Ġkextunload": 7278, + "Membership": 7279, + "SaveToFile": 7280, + "privileged": 7281, + "ĠIPAddressToString": 7282, + "googleapis": 7283, + "AADIntADFSCertificates": 7284, + "NlcnZpY": 7285, + "PYTHON": 7286, + "SimulateUserDo": 7287, + "SingleUser": 7288, + "lzdGVtZC": 7289, + "obfuscatedps": 7290, + "RpZnlpbmcgcm": 7291, + "\"-\"": 7292, + "+\")'": 7293, + "07104": 7294, + "1649": 7295, + "53197": 7296, + "=((([": 7297, + "AVProtection": 7298, + "BadPotato": 7299, + "Buddy": 7300, + "BIOS": 7301, + "BiosVersion": 7302, + "DOWS": 7303, + "Evaluation": 7304, + "ForestTrust": 7305, + "Gpscript": 7306, + "HARDWARE": 7307, + "IpAddress": 7308, + "KSPACE": 7309, + "Latest": 7310, + "LibHello": 7311, + "Libraries": 7312, + "MULTI": 7313, + "OOBE": 7314, + "Pfx": 7315, + "PnPEntity": 7316, + "Priority": 7317, + "PlistBuddy": 7318, + "Panther": 7319, + "PUAProtection": 7320, + "ReturnValue": 7321, + "Saver": 7322, + "Stealth": 7323, + "Sensor": 7324, + "TreatAs": 7325, + "Visible": 7326, + "WORKSPACE": 7327, + "WINDOWS": 7328, + "XBvcnQg": 7329, + "ccencrypt": 7330, + "cHJveHk": 7331, + "drop": 7332, + "dXJsbG": 7333, + "fltmc": 7334, + "firstOctet": 7335, + "finalpath": 7336, + "gPlink": 7337, + "identity": 7338, + "kIFNlcnZpY": 7339, + "linenum": 7340, + "lifecycle": 7341, + "microphone": 7342, + "music": 7343, + "nowrap": 7344, + "nailpho": 7345, + "nsenter": 7346, + "numeric": 7347, + "odbcconf": 7348, + "pypykatz": 7349, + "pcalua": 7350, + "rusionPreventionSystem": 7351, + "spynet": 7352, + "super": 7353, + "typicalPath": 7354, + "trufflesn": 7355, + "uJykK": 7356, + "uBOLite": 7357, + "xMjcuMC": 7358, + "ymlinkEvaluation": 7359, + "yZWFkKC": 7360, + "|?{(": 7361, + "Ġleave": 7362, + "Ġicon": 7363, + "ĠFolders": 7364, + "ĠHostId": 7365, + "Ġelif": 7366, + "Ġ365": 7367, + "Ġibs": 7368, + "Ġancestor": 7369, + "ĠResolve": 7370, + "ĠLocalAccountToken": 7371, + "ĠEventNameSpace": 7372, + "ĠExpandString": 7373, + "ĠAttack": 7374, + "receiver": 7375, + "reproast": 7376, + "stablished": 7377, + "etadata": 7378, + "Provisioning": 7379, + "hocolate": 7380, + "WinSock": 7381, + "sevecek": 7382, + "Ġtruncate": 7383, + "Ġcreating": 7384, + "StandardProfile": 7385, + "StubPath": 7386, + "InlineProtocolHandler": 7387, + "WindowsApps": 7388, + "ubuntu": 7389, + "ubleClick": 7390, + "GetCredmanCreds": 7391, + "GetRawCertData": 7392, + "mountedpath": 7393, + "Ġftpserver": 7394, + "AtomicSafeMode": 7395, + "passwordFilterName": 7396, + "CurrentactiveUser": 7397, + "ForAADGraph": 7398, + "Ġ197001010000": 7399, + "ĠREGISTRY": 7400, + "irePreAuth": 7401, + "Commencing": 7402, + "EnglishPages": 7403, + "thumbnailpho": 7404, + "thirdOctet": 7405, + "NetTCPConnection": 7406, + "inelyTakingAction": 7407, + "Ġinspect": 7408, + "ĠCMDS": 7409, + "ĠCryptographic": 7410, + "`\"`\")`\")\";$": 7411, + "('-'));};;#": 7412, + "imewdbled": 7413, + "ĠImagePath": 7414, + "Ġantivirusproduct": 7415, + "ShellServiceObjectDelayLoad": 7416, + "Ġprintf": 7417, + "Ġpushd": 7418, + "113556": 7419, + "AzDomainInfo": 7420, + "spawnto": 7421, + "ĠSystemParametersInfo": 7422, + "36190899": 7423, + "ĠPublisher": 7424, + "ĠPrimaryGroupID": 7425, + "Seatbelt": 7426, + "Autosize": 7427, + "Channels": 7428, + "PSRemoting": 7429, + "website": 7430, + "AppCompatFlags": 7431, + "targetsecurepw": 7432, + "AsLocalUNCPath": 7433, + "Ġrestoral": 7434, + "Robertson": 7435, + "Ġmasquerade": 7436, + "AzureADTenantDetail": 7437, + "DirectoryEntry": 7438, + "Ġdeletion": 7439, + "NotRequirePreAuth": 7440, + "ĠRequesting": 7441, + "CreateRemoteThread": 7442, + "OnRealtimeEnable": 7443, + "DisableIntrusionPreventionSystem": 7444, + "DisableIOAVProtection": 7445, + "DisableScanOnRealtimeEnable": 7446, + "DisableKeepAlive": 7447, + "DisableRoutinelyTakingAction": 7448, + "ApplicationPermissions": 7449, + "Ġsesshijack": 7450, + "ĠMiniDump": 7451, + "textExtraction": 7452, + "PowerShellIcmp": 7453, + "TaskModifed": 7454, + "ĠWITHIN": 7455, + "KeyExportPolicy": 7456, + "IGdyZX": 7457, + "ComputerFQDN": 7458, + "RoleDefinitionId": 7459, + "40793": 7460, + "ktopimgdownldr": 7461, + "notransaction": 7462, + "GoToAssist": 7463, + "InstanceModificationEvent": 7464, + "MpCmdRun": 7465, + "SubmitSamplesConsent": 7466, + "ĠOperators": 7467, + "NDMuMDAy": 7468, + "SCHTASKS": 7469, + "cmxsaWIyL": 7470, + "fullmemdmp": 7471, + "symbolic": 7472, + "expiredate": 7473, + "Ġspraying": 7474, + "444553540600": 7475, + "AddressFamily": 7476, + "ftpUrl": 7477, + "Ġeverything": 7478, + "ScheduledTaskSettingsSet": 7479, + "GVhZGVyKCd": 7480, + "Ġtemporarily": 7481, + "ĠEnableLinkedConnections": 7482, + "LaunchINFSection": 7483, + "MaxConnectionsPer": 7484, + "ĠLongPathsEnabled": 7485, + "ĠVBoxDRV": 7486, + "ĠDisablePrivacyExperience": 7487, + "evilscreensaver": 7488, + "aWNlLm": 7489, + "ĠShellSmartScreenLevel": 7490, + "ĠAsymmetricX": 7491, + "ĠDisabling": 7492, + "DEFAULT": 7493, + "DESCRIPTION": 7494, + "dsenableroot": 7495, + "CreationIncludeCmdLine": 7496, + "AADIntAccessTokenForAADGraph": 7497, + "EnterpriseServices": 7498, + "KerberosRequestorSecurityToken": 7499, + "NonExistingScript": 7500, + "RDPPORTLatest": 7501, + "Internalmonologue": 7502, + "PerfFormattedData": 7503, + "CFBundle": 7504, + "hZGRfaGVhZGVyKCd": 7505, + "LOCRSDRCWDWO": 7506, + "PhishingAttachment": 7507, + "PXVybGxpYjI": 7508, + "sensitive": 7509, + "DisallowExploitProtectionOverride": 7510, + "CCDCLCSWRPWPDTLOCRSDRCWDWO": 7511, + "CnJlcS": 7512, + "CCLCSWLOCRRC": 7513, + "PUBLIC": 7514, + "ĠNFSHomeDirectory": 7515, + "EnumerateAzureBlobs": 7516, + "SimulateUserDoubleClick": 7517, + "dXJsbGliM": 7518, + "trufflesnout": 7519, + "ĠLocalAccountTokenFilterPolicy": 7520, + "thumbnailphoto": 7521, + "NDMuMDAyID": 7522, + "!'": 7523, + "!;": 7524, + "!\\": 7525, + "!($": 7526, + "\".": 7527, + "\"/": 7528, + "\"=": 7529, + "\">": 7530, + "\"|": 7531, + "\"\";": 7532, + "\"::": 7533, + "\"=\"": 7534, + "\"\\#{": 7535, + "\"((": 7536, + "\"\":": 7537, + "\")\"&&": 7538, + "\"\"%": 7539, + "#!/": 7540, + "$)": 7541, + "$]": 7542, + "$\";": 7543, + "%.": 7544, + "%/": 7545, + "%{": 7546, + "%')": 7547, + "%;\"": 7548, + "%'\"": 7549, + "%\"=": 7550, + "&(": 7551, + "&\"#{": 7552, + "&\"$": 7553, + "'\";": 7554, + "')\"": 7555, + "'\\\"": 7556, + "';;#": 7557, + "'./": 7558, + "'\";;$": 7559, + "'\";;#": 7560, + "'))\\\"\"": 7561, + "'~')|": 7562, + "'/;\\": 7563, + "(=": 7564, + "(($": 7565, + "()\"": 7566, + "()\";$": 7567, + "({$": 7568, + "(!(": 7569, + "(@('": 7570, + "(!$": 7571, + "(@{": 7572, + "(!($": 7573, + ")-": 7574, + ")}\"": 7575, + ")};$": 7576, + "){$": 7577, + ")\";};;$": 7578, + "*#{": 7579, + "*&&": 7580, + "*\";": 7581, + "*]\"": 7582, + "*').": 7583, + "*/;": 7584, + "*')&&": 7585, + "*(?": 7586, + "+$": 7587, + "+=": 7588, + "+`\"": 7589, + "+)\"": 7590, + "+');": 7591, + "+\");": 7592, + ",#": 7593, + ",-": 7594, + ",`\"": 7595, + ",('": 7596, + ",\\\"": 7597, + ",\");$": 7598, + ",@{": 7599, + ",({$": 7600, + "-/": 7601, + "-','": 7602, + ".\";$": 7603, + ".\\#{": 7604, + ".\")": 7605, + ".')": 7606, + ".*.": 7607, + ".\");": 7608, + ".((": 7609, + ".{$": 7610, + ".)[": 7611, + ".+'": 7612, + ".$_\"": 7613, + "/+": 7614, + "/..": 7615, + "/:$": 7616, + "/*\"": 7617, + "/\"&&./": 7618, + "//'": 7619, + "/[^": 7620, + "/\\/": 7621, + "/^/": 7622, + "/-/": 7623, + "05": 7624, + "06": 7625, + "064": 7626, + "036": 7627, + "050": 7628, + "059": 7629, + "132": 7630, + "115": 7631, + "163": 7632, + "186": 7633, + "1638": 7634, + "1004": 7635, + "28": 7636, + "255": 7637, + "201": 7638, + "280": 7639, + "2000": 7640, + "250": 7641, + "283": 7642, + "33": 7643, + "364": 7644, + "388": 7645, + "3001": 7646, + "356": 7647, + "3004": 7648, + "396": 7649, + "339": 7650, + "45": 7651, + "400": 7652, + "411": 7653, + "404": 7654, + "480": 7655, + "4000": 7656, + "450": 7657, + "458": 7658, + "4109": 7659, + "4237": 7660, + "4945": 7661, + "51": 7662, + "500": 7663, + "564": 7664, + "512": 7665, + "520": 7666, + "530": 7667, + "521": 7668, + "534": 7669, + "508": 7670, + "65": 7671, + "69": 7672, + "616": 7673, + "650": 7674, + "617": 7675, + "71": 7676, + "75": 7677, + "788": 7678, + "755": 7679, + "786": 7680, + "746": 7681, + "750": 7682, + "783": 7683, + "761": 7684, + "7480": 7685, + "82": 7686, + "85": 7687, + "804": 7688, + "819": 7689, + "820": 7690, + "846": 7691, + "852": 7692, + "878": 7693, + "8455": 7694, + "912": 7695, + "956": 7696, + "980": 7697, + "954": 7698, + "9343": 7699, + ":<": 7700, + ":=": 7701, + ":]": 7702, + ":~": 7703, + ":\";": 7704, + ":=#{": 7705, + ":*:": 7706, + ":$(#{": 7707, + ";{;": 7708, + ";([": 7709, + ";.\\": 7710, + ";__": 7711, + "\"": 7722, + ">$": 7723, + "><": 7724, + ">'\"": 7725, + ">,`\"": 7726, + "?'": 7727, + "?:[": 7728, + "@$(#{": 7729, + "@(@('": 7730, + "AJ": 7731, + "AX": 7732, + "Ai": 7733, + "Av": 7734, + "AAt": 7735, + "AAc": 7736, + "Aud": 7737, + "Aail": 7738, + "ABo": 7739, + "AIT": 7740, + "Amsi": 7741, + "Alt": 7742, + "AML": 7743, + "AFE": 7744, + "AMD": 7745, + "AAB": 7746, + "AVE": 7747, + "Ammy": 7748, + "AYQB": 7749, + "Abw": 7750, + "AxMjcuMC": 7751, + "BJ": 7752, + "BM": 7753, + "BN": 7754, + "BP": 7755, + "BQ": 7756, + "BR": 7757, + "Ba": 7758, + "Br": 7759, + "Bu": 7760, + "But": 7761, + "BER": 7762, + "Bsp": 7763, + "Bsa": 7764, + "BLD": 7765, + "Bpe": 7766, + "BzLn": 7767, + "Bnn": 7768, + "BDX": 7769, + "BhdG": 7770, + "Bird": 7771, + "BHD": 7772, + "BwI": 7773, + "BTeXN": 7774, + "CS": 7775, + "Ca": 7776, + "Cd": 7777, + "Ci": 7778, + "Ck": 7779, + "Cq": 7780, + "Ct": 7781, + "Cro": 7782, + "Can": 7783, + "Cam": 7784, + "Cate": 7785, + "Call": 7786, + "Cure": 7787, + "CHI": 7788, + "CScript": 7789, + "CAC": 7790, + "CAL": 7791, + "Clock": 7792, + "Crypt": 7793, + "Cdd": 7794, + "Capture": 7795, + "Cgo": 7796, + "CDE": 7797, + "Calc": 7798, + "CTP": 7799, + "Cloud": 7800, + "CTION": 7801, + "Cryptog": 7802, + "CJz": 7803, + "CYy": 7804, + "Chocolate": 7805, + "DM": 7806, + "DT": 7807, + "Dl": 7808, + "Dw": 7809, + "Dz": 7810, + "Der": 7811, + "Don": 7812, + "Dro": 7813, + "Dde": 7814, + "DWord": 7815, + "DIN": 7816, + "Drv": 7817, + "DAn": 7818, + "DDE": 7819, + "DRI": 7820, + "Direction": 7821, + "Dotnet": 7822, + "Drawing": 7823, + "Debugger": 7824, + "DcmV": 7825, + "EH": 7826, + "Ea": 7827, + "Ee": 7828, + "Em": 7829, + "Eo": 7830, + "Ep": 7831, + "Es": 7832, + "Ey": 7833, + "Ear": 7834, + "EOF": 7835, + "EART": 7836, + "EAM": 7837, + "Esx": 7838, + "ECURITY": 7839, + "EGIN": 7840, + "FF": 7841, + "FG": 7842, + "FP": 7843, + "FT": 7844, + "Fb": 7845, + "Fi": 7846, + "Fy": 7847, + "Fire": 7848, + "FID": 7849, + "FCL": 7850, + "Fli": 7851, + "Fmk": 7852, + "Foreach": 7853, + "Function": 7854, + "Final": 7855, + "Firm": 7856, + "Failure": 7857, + "Fav": 7858, + "Fbd": 7859, + "FZa": 7860, + "Factiv": 7861, + "FOP": 7862, + "FTP": 7863, + "Fsd": 7864, + "FpV": 7865, + "FEND": 7866, + "Flush": 7867, + "FCYy": 7868, + "GN": 7869, + "GT": 7870, + "GU": 7871, + "GW": 7872, + "Gc": 7873, + "Ge": 7874, + "Gk": 7875, + "Gy": 7876, + "Gop": 7877, + "Ghost": 7878, + "Gzip": 7879, + "GGR": 7880, + "GIf": 7881, + "Graphic": 7882, + "GON": 7883, + "Gih": 7884, + "Gvy": 7885, + "GGS": 7886, + "Gui": 7887, + "GivenName": 7888, + "GluZ": 7889, + "HN": 7890, + "HS": 7891, + "HY": 7892, + "Hc": 7893, + "Hf": 7894, + "Hh": 7895, + "Hj": 7896, + "Hl": 7897, + "Hit": 7898, + "Hub": 7899, + "Hyp": 7900, + "Hunt": 7901, + "HAL": 7902, + "HVM": 7903, + "Hinf": 7904, + "HLL": 7905, + "Hook": 7906, + "HMu": 7907, + "Hwt": 7908, + "HGGR": 7909, + "IA": 7910, + "IK": 7911, + "Il": 7912, + "Ir": 7913, + "Iss": 7914, + "IRE": 7915, + "Imp": 7916, + "Iso": 7917, + "ICOD": 7918, + "Ixs": 7919, + "IAB": 7920, + "IES": 7921, + "ISK": 7922, + "IBR": 7923, + "JK": 7924, + "JM": 7925, + "Jk": 7926, + "Jr": 7927, + "Jx": 7928, + "Jps": 7929, + "JScript": 7930, + "JSV": 7931, + "Json": 7932, + "JFf": 7933, + "JdH": 7934, + "JpX": 7935, + "Jwcm": 7936, + "JAail": 7937, + "KB": 7938, + "KG": 7939, + "KR": 7940, + "KT": 7941, + "KY": 7942, + "Ka": 7943, + "Kj": 7944, + "Kl": 7945, + "KTo": 7946, + "Kpy": 7947, + "KVM": 7948, + "Ksy": 7949, + "KIC": 7950, + "Kvf": 7951, + "KTY": 7952, + "KqD": 7953, + "KcHJveHk": 7954, + "KDz": 7955, + "KHGGR": 7956, + "LH": 7957, + "LR": 7958, + "LU": 7959, + "LX": 7960, + "Ly": 7961, + "Low": 7962, + "Lay": 7963, + "Lef": 7964, + "LVM": 7965, + "Lxd": 7966, + "LSTART": 7967, + "LUN": 7968, + "LUA": 7969, + "Later": 7970, + "LSA": 7971, + "Little": 7972, + "LNi": 7973, + "LZU": 7974, + "LjA": 7975, + "Lku": 7976, + "LBsp": 7977, + "LCJz": 7978, + "LIBR": 7979, + "LJdH": 7980, + "LKqD": 7981, + "MF": 7982, + "MM": 7983, + "MY": 7984, + "Mv": 7985, + "Mub": 7986, + "Mult": 7987, + "Mgr": 7988, + "Mapp": 7989, + "Morer": 7990, + "MAR": 7991, + "Muf": 7992, + "Mimi": 7993, + "MSC": 7994, + "MSP": 7995, + "MAM": 7996, + "MMC": 7997, + "Misc": 7998, + "MtZ": 7999, + "MAZQB": 8000, + "MAI": 8001, + "MBIOS": 8002, + "Metadata": 8003, + "MBER": 8004, + "NF": 8005, + "NZ": 8006, + "Ne": 8007, + "Nh": 8008, + "Nk": 8009, + "Nq": 8010, + "Nt": 8011, + "Nu": 8012, + "Nw": 8013, + "Nz": 8014, + "Nic": 8015, + "Nor": 8016, + "Nut": 8017, + "Nls": 8018, + "NNE": 8019, + "Nick": 8020, + "NCE": 8021, + "Nmt": 8022, + "Nsb": 8023, + "NhdG": 8024, + "OC": 8025, + "OW": 8026, + "Oh": 8027, + "Os": 8028, + "Oy": 8029, + "Oin": 8030, + "Oef": 8031, + "OKe": 8032, + "OSI": 8033, + "Oak": 8034, + "OSE": 8035, + "OUT": 8036, + "OII": 8037, + "OKS": 8038, + "Osx": 8039, + "ODAn": 8040, + "PC": 8041, + "PK": 8042, + "PQ": 8043, + "PT": 8044, + "PW": 8045, + "Pb": 8046, + "Pe": 8047, + "Pi": 8048, + "Pr": 8049, + "Pt": 8050, + "Pz": 8051, + "Put": 8052, + "PRE": 8053, + "Ppt": 8054, + "Prin": 8055, + "PPassword": 8056, + "Pend": 8057, + "PEN": 8058, + "Please": 8059, + "Publ": 8060, + "Png": 8061, + "POL": 8062, + "Peng": 8063, + "Panel": 8064, + "Prives": 8065, + "Persistence": 8066, + "Person": 8067, + "Push": 8068, + "PFX": 8069, + "PKz": 8070, + "PPL": 8071, + "PuT": 8072, + "PNPClass": 8073, + "PBM": 8074, + "PGih": 8075, + "PNk": 8076, + "POW": 8077, + "QS": 8078, + "QZ": 8079, + "Qb": 8080, + "Qh": 8081, + "Qn": 8082, + "Qs": 8083, + "Qt": 8084, + "Qv": 8085, + "Qx": 8086, + "Que": 8087, + "QEM": 8088, + "Qsh": 8089, + "QAg": 8090, + "QEC": 8091, + "QAA": 8092, + "QCP": 8093, + "QWt": 8094, + "QpJ": 8095, + "QzV": 8096, + "QPNk": 8097, + "RP": 8098, + "Ri": 8099, + "Rm": 8100, + "Rn": 8101, + "Rer": 8102, + "RST": 8103, + "RVM": 8104, + "RTR": 8105, + "RING": 8106, + "Rcb": 8107, + "Right": 8108, + "RBC": 8109, + "RSK": 8110, + "RQJ": 8111, + "RWX": 8112, + "Rkb": 8113, + "RHl": 8114, + "Sb": 8115, + "Si": 8116, + "Sx": 8117, + "Sur": 8118, + "Ses": 8119, + "Sort": 8120, + "Sig": 8121, + "Sheet": 8122, + "SSP": 8123, + "Sav": 8124, + "SJy": 8125, + "Section": 8126, + "Ssl": 8127, + "Scen": 8128, + "SymlinkEvaluation": 8129, + "SBTeXN": 8130, + "TZ": 8131, + "Tb": 8132, + "Tm": 8133, + "Tu": 8134, + "Tx": 8135, + "Ty": 8136, + "Tor": 8137, + "Tath": 8138, + "Tring": 8139, + "Tip": 8140, + "Try": 8141, + "TER": 8142, + "Trun": 8143, + "Tru": 8144, + "Tcd": 8145, + "Tray": 8146, + "TAB": 8147, + "TSV": 8148, + "TkK": 8149, + "Title": 8150, + "TECT": 8151, + "Timer": 8152, + "TKY": 8153, + "UP": 8154, + "UV": 8155, + "UX": 8156, + "Uc": 8157, + "Ue": 8158, + "Uf": 8159, + "Um": 8160, + "Ux": 8161, + "Uz": 8162, + "URE": 8163, + "Uns": 8164, + "UDisable": 8165, + "UAL": 8166, + "Uuid": 8167, + "UZW": 8168, + "Usk": 8169, + "UmV": 8170, + "UDS": 8171, + "Uuc": 8172, + "UQJ": 8173, + "Va": 8174, + "Ve": 8175, + "Vh": 8176, + "Vj": 8177, + "Vo": 8178, + "Vic": 8179, + "Van": 8180, + "Vault": 8181, + "VWR": 8182, + "VSC": 8183, + "VGV": 8184, + "Vzd": 8185, + "Vuln": 8186, + "Vendor": 8187, + "VHD": 8188, + "VNC": 8189, + "Vba": 8190, + "Vzc": 8191, + "VQS": 8192, + "WT": 8193, + "Wi": 8194, + "Wk": 8195, + "Wid": 8196, + "Wul": 8197, + "Wls": 8198, + "WUn": 8199, + "Wrm": 8200, + "Wrap": 8201, + "WQg": 8202, + "WUg": 8203, + "Wsx": 8204, + "WCM": 8205, + "WCMD": 8206, + "WKQ": 8207, + "WvZ": 8208, + "Wwg": 8209, + "Watson": 8210, + "WUsIHN": 8211, + "WAIT": 8212, + "WJwcm": 8213, + "WNhdG": 8214, + "WQs": 8215, + "WVzd": 8216, + "XY": 8217, + "XZ": 8218, + "Xb": 8219, + "Xc": 8220, + "XaW": 8221, + "XAG": 8222, + "XCB": 8223, + "Xnb": 8224, + "XEo": 8225, + "XHwt": 8226, + "XLSTART": 8227, + "YN": 8228, + "YZ": 8229, + "Yg": 8230, + "Yi": 8231, + "Yu": 8232, + "Yw": 8233, + "Ynt": 8234, + "Your": 8235, + "YES": 8236, + "YPASS": 8237, + "Ygcm": 8238, + "YOU": 8239, + "YAbw": 8240, + "YEH": 8241, + "YMtZ": 8242, + "YSBTeXN": 8243, + "YUDS": 8244, + "YWwg": 8245, + "ZA": 8246, + "ZF": 8247, + "ZZ": 8248, + "Ze": 8249, + "Zer": 8250, + "ZiB": 8251, + "ZLVM": 8252, + "ZPr": 8253, + "ZRer": 8254, + "[(": 8255, + "[:": 8256, + "[{\"": 8257, + "[*]\"": 8258, + "\\'": 8259, + "\\\";$": 8260, + "\\')": 8261, + "\\.\"": 8262, + "\\*\\": 8263, + "])": 8264, + "][": 8265, + "]}": 8266, + "]\"#{": 8267, + "]([": 8268, + "];;#": 8269, + "]};$": 8270, + "].\\": 8271, + "]));$": 8272, + "]),": 8273, + "]}};": 8274, + "];{": 8275, + "];;};$": 8276, + "]*/;": 8277, + "^\"]": 8278, + "_\"": 8279, + "_%": 8280, + "_-": 8281, + "_\")": 8282, + "_})": 8283, + "_'&&": 8284, + "_';;#": 8285, + "aH": 8286, + "aL": 8287, + "aa": 8288, + "ae": 8289, + "aRE": 8290, + "apt": 8291, + "aps": 8292, + "aware": 8293, + "aith": 8294, + "aff": 8295, + "aWR": 8296, + "aGV": 8297, + "aHa": 8298, + "aZQ": 8299, + "aZagne": 8300, + "aEp": 8301, + "bF": 8302, + "bT": 8303, + "bf": 8304, + "bh": 8305, + "bp": 8306, + "bal": 8307, + "bar": 8308, + "bde": 8309, + "bes": 8310, + "bac": 8311, + "band": 8312, + "bare": 8313, + "bag": 8314, + "bef": 8315, + "bus": 8316, + "bcopy": 8317, + "bSI": 8318, + "bypass": 8319, + "bAU": 8320, + "bmV": 8321, + "bgB": 8322, + "bxor": 8323, + "bXBvcnQg": 8324, + "bIr": 8325, + "bOs": 8326, + "bWQs": 8327, + "cO": 8328, + "cP": 8329, + "cY": 8330, + "cw": 8331, + "cer": 8332, + "cord": 8333, + "cif": 8334, + "cis": 8335, + "cAd": 8336, + "csh": 8337, + "cig": 8338, + "cServer": 8339, + "cff": 8340, + "cfd": 8341, + "cked": 8342, + "cuac": 8343, + "cbd": 8344, + "cThread": 8345, + "cryption": 8346, + "cfa": 8347, + "cylance": 8348, + "cacy": 8349, + "cAaQB": 8350, + "cDH": 8351, + "chocolate": 8352, + "cAX": 8353, + "cBu": 8354, + "cHMu": 8355, + "cXnb": 8356, + "dj": 8357, + "dm": 8358, + "dp": 8359, + "dw": 8360, + "dRe": 8361, + "dport": 8362, + "dID": 8363, + "dCode": 8364, + "dAccess": 8365, + "dModule": 8366, + "dRL": 8367, + "dsk": 8368, + "dav": 8369, + "daily": 8370, + "dlY": 8371, + "drt": 8372, + "dsed": 8373, + "dclist": 8374, + "dontLog": 8375, + "distinguished": 8376, + "dKa": 8377, + "dTru": 8378, + "dWUsIHN": 8379, + "dYi": 8380, + "eC": 8381, + "eS": 8382, + "eg": 8383, + "eab": 8384, + "eaf": 8385, + "eak": 8386, + "empire": 8387, + "eigh": 8388, + "ealth": 8389, + "fb": 8390, + "fc": 8391, + "fk": 8392, + "fv": 8393, + "fw": 8394, + "fing": 8395, + "fun": 8396, + "fers": 8397, + "fore": 8398, + "fru": 8399, + "fault": 8400, + "firewall": 8401, + "fdb": 8402, + "free": 8403, + "fla": 8404, + "fAH": 8405, + "fbb": 8406, + "fRl": 8407, + "fcc": 8408, + "fCB": 8409, + "fba": 8410, + "front": 8411, + "flush": 8412, + "fFmk": 8413, + "gV": 8414, + "gW": 8415, + "gc": 8416, + "gin": 8417, + "gath": 8418, + "ges": 8419, + "gIn": 8420, + "gup": 8421, + "gPS": 8422, + "gsec": 8423, + "gzip": 8424, + "gET": 8425, + "gDP": 8426, + "gdG": 8427, + "gcb": 8428, + "global": 8429, + "ganization": 8430, + "gEt": 8431, + "gcc": 8432, + "gui": 8433, + "gorh": 8434, + "gdXJsbGliM": 8435, + "gJx": 8436, + "gKsy": 8437, + "gYSBTeXN": 8438, + "hD": 8439, + "hG": 8440, + "hi": 8441, + "hj": 8442, + "hp": 8443, + "hon": 8444, + "hex": 8445, + "hll": 8446, + "hub": 8447, + "hunt": 8448, + "hrd": 8449, + "hJI": 8450, + "hVc": 8451, + "hgs": 8452, + "hAJ": 8453, + "hNZ": 8454, + "hbSI": 8455, + "iN": 8456, + "ii": 8457, + "iq": 8458, + "ips": 8459, + "iwq": 8460, + "iJAail": 8461, + "iKT": 8462, + "jO": 8463, + "jar": 8464, + "jLM": 8465, + "jav": 8466, + "jtY": 8467, + "jJr": 8468, + "jNw": 8469, + "jXEo": 8470, + "jYWwg": 8471, + "jeS": 8472, + "kr": 8473, + "kx": 8474, + "kz": 8475, + "kec": 8476, + "kID": 8477, + "kSe": 8478, + "klist": 8479, + "kmod": 8480, + "kAC": 8481, + "kick": 8482, + "kTR": 8483, + "kvsc": 8484, + "kerberoast": 8485, + "kTG": 8486, + "kCleanup": 8487, + "kai": 8488, + "kali": 8489, + "kAAB": 8490, + "kLH": 8491, + "kRVM": 8492, + "kWi": 8493, + "kZLVM": 8494, + "khNZ": 8495, + "lS": 8496, + "ln": 8497, + "lr": 8498, + "lz": 8499, + "lation": 8500, + "lis": 8501, + "lower": 8502, + "live": 8503, + "lma": 8504, + "lSe": 8505, + "lCreate": 8506, + "lvb": 8507, + "lAH": 8508, + "lBook": 8509, + "launchctl": 8510, + "lzL": 8511, + "lIH": 8512, + "lLE": 8513, + "lways": 8514, + "lbn": 8515, + "lIE": 8516, + "lgl": 8517, + "lative": 8518, + "little": 8519, + "label": 8520, + "lByb": 8521, + "lBJ": 8522, + "lIxs": 8523, + "lZiB": 8524, + "ljJr": 8525, + "mn": 8526, + "mr": 8527, + "mu": 8528, + "mst": 8529, + "mnt": 8530, + "mow": 8531, + "mys": 8532, + "mhe": 8533, + "mcom": 8534, + "mun": 8535, + "mers": 8536, + "mir": 8537, + "mlog": 8538, + "mls": 8539, + "mim": 8540, + "mimi": 8541, + "mAy": 8542, + "metric": 8543, + "metadata": 8544, + "na": 8545, + "ny": 8546, + "nput": 8547, + "nif": 8548, + "nir": 8549, + "nTe": 8550, + "nim": 8551, + "nsudo": 8552, + "npython": 8553, + "ncat": 8554, + "ngr": 8555, + "num": 8556, + "nOutput": 8557, + "nprint": 8558, + "nThe": 8559, + "nish": 8560, + "nmap": 8561, + "nitch": 8562, + "nWait": 8563, + "nSuccessfully": 8564, + "nmember": 8565, + "national": 8566, + "nprivesc": 8567, + "nWH": 8568, + "nwq": 8569, + "nRlbn": 8570, + "nEe": 8571, + "oD": 8572, + "oP": 8573, + "oT": 8574, + "oc": 8575, + "ox": 8576, + "oon": 8577, + "oing": 8578, + "ose": 8579, + "oop": 8580, + "ous": 8581, + "oData": 8582, + "oreground": 8583, + "oPolicy": 8584, + "oci": 8585, + "octet": 8586, + "osed": 8587, + "ocHJveHk": 8588, + "pE": 8589, + "pz": 8590, + "pop": 8591, + "pwn": 8592, + "pos": 8593, + "pText": 8594, + "poin": 8595, + "pCreate": 8596, + "press": 8597, + "pdG": 8598, + "ppb": 8599, + "prt": 8600, + "person": 8601, + "pblue": 8602, + "primary": 8603, + "pCg": 8604, + "ppg": 8605, + "petit": 8606, + "pGIf": 8607, + "pnput": 8608, + "pose": 8609, + "qow": 8610, + "qem": 8611, + "qWS": 8612, + "qPYT": 8613, + "qGX": 8614, + "qZU": 8615, + "qeE": 8616, + "qwE": 8617, + "qFCYy": 8618, + "qcBu": 8619, + "qiwq": 8620, + "rat": 8621, + "rpt": 8622, + "rab": 8623, + "rary": 8624, + "rack": 8625, + "radmin": 8626, + "rutil": 8627, + "range": 8628, + "rLogon": 8629, + "rpZ": 8630, + "rZXI": 8631, + "rFn": 8632, + "rGn": 8633, + "rmdir": 8634, + "rCTP": 8635, + "rQWt": 8636, + "rganization": 8637, + "sB": 8638, + "sO": 8639, + "sct": 8640, + "scon": 8641, + "sand": 8642, + "sAp": 8643, + "sted": 8644, + "skey": 8645, + "saut": 8646, + "sdelete": 8647, + "sign": 8648, + "sXml": 8649, + "sSV": 8650, + "sAM": 8651, + "sTrans": 8652, + "sinfo": 8653, + "sHidden": 8654, + "salt": 8655, + "section": 8656, + "solve": 8657, + "safe": 8658, + "sKcHJveHk": 8659, + "sTring": 8660, + "sXc": 8661, + "sgV": 8662, + "ti": 8663, + "tz": 8664, + "ton": 8665, + "tro": 8666, + "tion": 8667, + "tit": 8668, + "the": 8669, + "tain": 8670, + "tuf": 8671, + "tstat": 8672, + "tBA": 8673, + "tie": 8674, + "torun": 8675, + "tzZXJ": 8676, + "tgs": 8677, + "trigger": 8678, + "tweet": 8679, + "tMF": 8680, + "tUm": 8681, + "tkZLVM": 8682, + "tqcBu": 8683, + "uh": 8684, + "uv": 8685, + "uin": 8686, + "ude": 8687, + "uWin": 8688, + "upt": 8689, + "uAD": 8690, + "uID": 8691, + "uted": 8692, + "uum": 8693, + "ufo": 8694, + "uIC": 8695, + "uBlock": 8696, + "uAG": 8697, + "uAH": 8698, + "uPX": 8699, + "uational": 8700, + "ually": 8701, + "uau": 8702, + "uvy": 8703, + "uHN": 8704, + "uMuf": 8705, + "uUmV": 8706, + "uqow": 8707, + "vW": 8708, + "vY": 8709, + "vor": 8710, + "ven": 8711, + "vol": 8712, + "vac": 8713, + "vation": 8714, + "vil": 8715, + "vers": 8716, + "vail": 8717, + "vAG": 8718, + "vGP": 8719, + "vlaunch": 8720, + "vIGZ": 8721, + "vZG": 8722, + "vdC": 8723, + "vOKe": 8724, + "vPubl": 8725, + "vkWi": 8726, + "vnif": 8727, + "wo": 8728, + "wow": 8729, + "wit": 8730, + "wget": 8731, + "wific": 8732, + "ward": 8733, + "wIC": 8734, + "wav": 8735, + "waz": 8736, + "wKS": 8737, + "wAaQB": 8738, + "wNC": 8739, + "watson": 8740, + "wOy": 8741, + "wQsh": 8742, + "waith": 8743, + "wuau": 8744, + "xv": 8745, + "xord": 8746, + "xnet": 8747, + "xcopy": 8748, + "xmt": 8749, + "xOw": 8750, + "xattr": 8751, + "xclip": 8752, + "xPXVybGxpYjI": 8753, + "xCt": 8754, + "xPGih": 8755, + "xVQS": 8756, + "yb": 8757, + "yss": 8758, + "yam": 8759, + "ymo": 8760, + "ybox": 8761, + "yAG": 8762, + "yYy": 8763, + "yTSConnections": 8764, + "yAxMjcuMC": 8765, + "yKG": 8766, + "yuqow": 8767, + "zf": 8768, + "zz": 8769, + "zon": 8770, + "zST": 8771, + "zsh": 8772, + "zwn": 8773, + "zaW": 8774, + "zAH": 8775, + "zpf": 8776, + "zKS": 8777, + "zAHQ": 8778, + "zuj": 8779, + "zwE": 8780, + "zzg": 8781, + "zHc": 8782, + "zbIr": 8783, + "zhVc": 8784, + "{(": 8785, + "{}": 8786, + "{;;": 8787, + "{}}": 8788, + "{_})": 8789, + "|;": 8790, + "|[": 8791, + "|#{": 8792, + "|__": 8793, + "|/'": 8794, + "|%{": 8795, + "}&": 8796, + "}?": 8797, + "}@": 8798, + "}]": 8799, + "}_": 8800, + "}:/": 8801, + "});$": 8802, + "}=#{": 8803, + "}/*": 8804, + "}/$": 8805, + "}}};": 8806, + "}-$": 8807, + "}-$(": 8808, + "}=)?": 8809, + "}(=": 8810, + "Ġ_": 8811, + "Ġro": 8812, + "Ġass": 8813, + "Ġhe": 8814, + "Ġord": 8815, + "Ġword": 8816, + "Ġam": 8817, + "ĠTo": 8818, + "Ġag": 8819, + "Ġred": 8820, + "Ġ}&&": 8821, + "ĠLo": 8822, + "ĠTh": 8823, + "Ġap": 8824, + "ĠST": 8825, + "Ġqu": 8826, + "Ġmd": 8827, + "Ġef": 8828, + "Ġetc": 8829, + "Ġus": 8830, + "ĠUSER": 8831, + "Ġ}\";": 8832, + "Ġma": 8833, + "ĠCommand": 8834, + "ĠAut": 8835, + "Ġremote": 8836, + "Ġiex": 8837, + "ĠSYSTEM": 8838, + "ĠExec": 8839, + "ĠScript": 8840, + "ĠAccess": 8841, + "Ġvi": 8842, + "ĠApplication": 8843, + "Ġlogon": 8844, + "ĠFo": 8845, + "ĠNE": 8846, + "Ġteam": 8847, + "ĠExplorer": 8848, + "ĠLO": 8849, + "Ġone": 8850, + "ĠForeground": 8851, + "ĠOff": 8852, + "Ġlock": 8853, + "ĠFull": 8854, + "ĠSession": 8855, + "Ġhel": 8856, + "ĠLogin": 8857, + "ĠRoot": 8858, + "Ġplist": 8859, + "ĠInstallUtil": 8860, + "ĠStartup": 8861, + "Ġiwr": 8862, + "ĠShort": 8863, + "ĠToken": 8864, + "ĠBase": 8865, + "Ġval": 8866, + "ĠContinue": 8867, + "ĠScheduled": 8868, + "Ġ44": 8869, + "Ġplace": 8870, + "Ġopenssl": 8871, + "Ġufw": 8872, + "ĠEncoded": 8873, + "Ġ80": 8874, + "Ġenter": 8875, + "ĠLogon": 8876, + "Ġmem": 8877, + "Ġmount": 8878, + "Ġallow": 8879, + "ĠNotification": 8880, + "ĠEnv": 8881, + "Ġmessage": 8882, + "Ġie": 8883, + "Ġrsa": 8884, + "ĠQuit": 8885, + "ĠEdge": 8886, + "Ġversion": 8887, + "Ġhostname": 8888, + "ĠScan": 8889, + "Ġedit": 8890, + "ĠLocalMachine": 8891, + "ĠNPPSpy": 8892, + "ĠMod": 8893, + "ĠoStream": 8894, + "Ġservices": 8895, + "Ġ}\"};": 8896, + "ĠProg": 8897, + "ĠPrompt": 8898, + "Ġvirus": 8899, + "Ġvirtual": 8900, + "Ġignore": 8901, + "ĠAuthentication": 8902, + "Ġover": 8903, + "Ġhead": 8904, + "Ġptt": 8905, + "ĠCurrentUser": 8906, + "Ġusing": 8907, + "Ġextract": 8908, + "Ġmax": 8909, + "ĠMove": 8910, + "Ġhelper": 8911, + "Ġoriginal": 8912, + "ĠATOMIC": 8913, + "ĠKEY": 8914, + "Ġerror": 8915, + "Ġntds": 8916, + "Ġentry": 8917, + "ĠExploit": 8918, + "ĠLocalAdmin": 8919, + "ĠExplorerSync": 8920, + "ĠJob": 8921, + "ĠConnected": 8922, + "Ġmodel": 8923, + "ĠComputers": 8924, + "ĠContainer": 8925, + "Ġmake": 8926, + "ĠExpect": 8927, + "ĠScripting": 8928, + "ĠLOLBin": 8929, + "ĠSharpHound": 8930, + "Ġplaces": 8931, + "ĠGoAWSConsoleSpray": 8932, + "Ġorganizational": 8933, + "Ġ909": 8934, + "Ġacc": 8935, + "Ġmouse": 8936, + "Ġplutil": 8937, + "ĠHIG": 8938, + "ĠEND": 8939, + "Ġorginal": 8940, + "Ġmemberof": 8941, + "ĠCommencing": 8942, + "era": 8943, + "eration": 8944, + "ermin": 8945, + "erne": 8946, + "erator": 8947, + "ermal": 8948, + "erNetwork": 8949, + "erCertificate": 8950, + "ermission": 8951, + "erature": 8952, + "ervis": 8953, + "erHidden": 8954, + "ernel": 8955, + "Ġ-\"": 8956, + "Ġ-}": 8957, + "Ġ-)&&": 8958, + "ino": 8959, + "inv": 8960, + "iname": 8961, + "inary": 8962, + "inkey": 8963, + "invert": 8964, + "internal": 8965, + "inished": 8966, + "information": 8967, + "real": 8968, + "rename": 8969, + "resu": 8970, + "reach": 8971, + "reten": 8972, + "reporting": 8973, + "restore": 8974, + "record": 8975, + "remcom": 8976, + "tee": 8977, + "tes": 8978, + "tect": 8979, + "tegr": 8980, + "tening": 8981, + "telnet": 8982, + "tevil": 8983, + "onTath": 8984, + "onymo": 8985, + "Ġ\";": 8986, + "Ġ\"<": 8987, + "Ġ\"\";": 8988, + "Ġ\":\\": 8989, + "Ġ\";;": 8990, + "Ġ\":$": 8991, + "Ġ\"--": 8992, + "Ġ\")'": 8993, + "Ġ\")[": 8994, + "Ġ\"--------": 8995, + "atp": 8996, + "atr": 8997, + "atform": 8998, + "len": 8999, + "leet": 9000, + "less": 9001, + "leare": 9002, + "leShow": 9003, + "leTS": 9004, + "lements": 9005, + "lendar": 9006, + "ross": 9007, + "roker": 9008, + "roSheet": 9009, + "stion": 9010, + "stab": 9011, + "strok": 9012, + "stations": 9013, + "strip": 9014, + "stQt": 9015, + "Ġ/'": 9016, + "Ġ//#{": 9017, + "icit": 9018, + "icing": 9019, + "icate": 9020, + "icted": 9021, + "icwe": 9022, + "ically": 9023, + "icpCg": 9024, + "etw": 9025, + "eters": 9026, + "etype": 9027, + "etup": 9028, + "etail": 9029, + "etCapture": 9030, + "etQEC": 9031, + "econ": 9032, + "ecpol": 9033, + "orEn": 9034, + "orite": 9035, + "orpor": 9036, + "mein": 9037, + "ntad": 9038, + "alf": 9039, + "alg": 9040, + "aldomain": 9041, + "alog": 9042, + "algo": 9043, + "alDLL": 9044, + "alMove": 9045, + "alrecon": 9046, + "alpine": 9047, + "aldTru": 9048, + "utc": 9049, + "utu": 9050, + "utable": 9051, + "utlogon": 9052, + "ssword": 9053, + "ssnTe": 9054, + "omatic": 9055, + "Ġ$'": 9056, + "Ġ$?": 9057, + "ileges": 9058, + "existing": 9059, + "ionLocal": 9060, + "ionpolicy": 9061, + "aring": 9062, + "arSet": 9063, + "arted": 9064, + "arbit": 9065, + "arant": 9066, + "servation": 9067, + "ces": 9068, + "ceive": 9069, + "cebc": 9070, + "cedID": 9071, + "owmount": 9072, + "eny": 9073, + "enig": 9074, + "enumer": 9075, + "encodecmd": 9076, + "filesystem": 9077, + "filedata": 9078, + "Ġ=(": 9079, + "&&.": 9080, + "&&$(": 9081, + "&&'./": 9082, + "urly": 9083, + "urandom": 9084, + "aders": 9085, + "adid": 9086, + "adem": 9087, + "adcomputer": 9088, + "addefault": 9089, + "adrecon": 9090, + "advpack": 9091, + "device": 9092, + "deed": 9093, + "depen": 9094, + "delegate": 9095, + "detect": 9096, + "itm": 9097, + "iting": 9098, + "itation": 9099, + "itgroup": 9100, + "itance": 9101, + "lol": 9102, + "locate": 9103, + "anch": 9104, + "anget": 9105, + "anning": 9106, + "}\").": 9107, + "}\"';": 9108, + "}\");$": 9109, + "}\"}';": 9110, + "ols": 9111, + "olution": 9112, + "olufo": 9113, + "llers": 9114, + "llOC": 9115, + "PathName": 9116, + "PathType": 9117, + "ProcServer": 9118, + "ingProcess": 9119, + "ingServer": 9120, + "ingFinal": 9121, + "assis": 9122, + "assoc": 9123, + "hok": 9124, + "hoice": 9125, + "hots": 9126, + "houtlogon": 9127, + "hourly": 9128, + "Winword": 9129, + "WinLogon": 9130, + "WinHTTP": 9131, + "WinHTT": 9132, + "WinSx": 9133, + "Winstations": 9134, + "ysically": 9135, + "cture": 9136, + "rike": 9137, + "rides": 9138, + "sel": 9139, + "seten": 9140, + "useraccount": 9141, + "userdns": 9142, + "userPrincipalName": 9143, + "userdaemon": 9144, + "heme": 9145, + "heduled": 9146, + "Ġtar": 9147, + "Ġtrigger": 9148, + "Ġtweet": 9149, + "Ġtscon": 9150, + "Ġcpassword": 9151, + "Ġcop": 9152, + "Ġcpu": 9153, + "Ġcustom": 9154, + "Ġcaption": 9155, + "Ġcook": 9156, + "Ġcome": 9157, + "Ġccmstp": 9158, + "Ġcron": 9159, + "Ġcront": 9160, + "ĠcBut": 9161, + "ĠcGluZ": 9162, + "Ġczpf": 9163, + "Ġcleare": 9164, + "Ġcorpor": 9165, + "Ġchoice": 9166, + "008": 9167, + "0002": 9168, + "0072": 9169, + "Ġ|%": 9170, + "Ġ|;": 9171, + "Ġ|?{": 9172, + "escap": 9173, + "esNotRequirePreAuth": 9174, + "acd": 9175, + "acct": 9176, + "acity": 9177, + "acmr": 9178, + "Stuff": 9179, + "Static": 9180, + "Style": 9181, + "StdModule": 9182, + "Strike": 9183, + "READ": 9184, + "REDT": 9185, + "REMAR": 9186, + "REfv": 9187, + "Ini": 9188, + "Inher": 9189, + "Information": 9190, + "Incis": 9191, + "Integr": 9192, + "Indepen": 9193, + "InProcServer": 9194, + "WindowsIdentity": 9195, + "WindowsPowershell": 9196, + "WindowsSensor": 9197, + "erts": 9198, + "ptyp": 9199, + "ptance": 9200, + "ueAp": 9201, + "pscp": 9202, + "psprovider": 9203, + "wordlist": 9204, + "regfile": 9205, + "regas": 9206, + "registr": 9207, + "register": 9208, + "\";[": 9209, + "\";#{": 9210, + "\";;;": 9211, + "Ġ'/": 9212, + "Ġ'}'": 9213, + "Ġ'\"#{": 9214, + "Ġ');$": 9215, + "Ġ'',": 9216, + "Ġ';;$": 9217, + "Ġ'};$": 9218, + "Ġ'.\\": 9219, + "Ġ'__": 9220, + "Ġ'';$": 9221, + "Ġ'{\"": 9222, + "Ġ'&&[": 9223, + "Ġ'/;\\": 9224, + "Ġ'_'&&": 9225, + "Ġ'&&'./": 9226, + "ambd": 9227, + "Items": 9228, + "comadmin": 9229, + "computers": 9230, + "comspec": 9231, + "artment": 9232, + ":\\\"": 9233, + "Exist": 9234, + "asswords": 9235, + "iff": 9236, + "ifm": 9237, + "ifconfig": 9238, + "MicrosoftApp": 9239, + "conhost": 9240, + "unc": 9241, + "unlock": 9242, + "ateOn": 9243, + "ationCall": 9244, + "andle": 9245, + "ilar": 9246, + "SystemInformation": 9247, + "scrobj": 9248, + "scii": 9249, + "scheme": 9250, + "kebag": 9251, + "Ġ(%": 9252, + "Ġ((": 9253, + "Ġ(\\": 9254, + "Ġ(*.": 9255, + "Ġ(!$": 9256, + "Ġ>$": 9257, + "Ġ>&": 9258, + "Ġ>(": 9259, + "tov": 9260, + "tostring": 9261, + "vemls": 9262, + "isplayName": 9263, + "GetValue": 9264, + "GetHost": 9265, + "GetText": 9266, + "GetStream": 9267, + "GetAll": 9268, + "GetToken": 9269, + "GetResponse": 9270, + "GetRuntime": 9271, + "GetHelp": 9272, + "GetClipboard": 9273, + "GetFi": 9274, + "ReP": 9275, + "ReS": 9276, + "Repl": 9277, + "Reload": 9278, + "Restr": 9279, + "Reboot": 9280, + "Relation": 9281, + "ypwm": 9282, + "areas": 9283, + "aste": 9284, + "asive": 9285, + "async": 9286, + "asreproast": 9287, + "ashok": 9288, + "chk": 9289, + "chr": 9290, + "chs": 9291, + "chart": 9292, + "chcp": 9293, + "chaddress": 9294, + "chattr": 9295, + "chassis": 9296, + "Atdm": 9297, + "};\"": 9298, + "};#": 9299, + "};(": 9300, + "};;$": 9301, + "};};": 9302, + "};\"#{": 9303, + "Ġsl": 9304, + "Ġsort": 9305, + "Ġsrc": 9306, + "Ġsaf": 9307, + "Ġsize": 9308, + "Ġsplit": 9309, + "Ġsqlite": 9310, + "Ġsmb": 9311, + "Ġside": 9312, + "Ġsynch": 9313, + "Ġsyss": 9314, + "Ġsolution": 9315, + "ToEnd": 9316, + "ToHistory": 9317, + "ToWindowsUpdate": 9318, + "Tools": 9319, + "ToGetHelp": 9320, + ");'": 9321, + ");;": 9322, + ");{;": 9323, + ");\"&&": 9324, + ");;#": 9325, + "doaEp": 9326, + "doskey": 9327, + "NewName": 9328, + "NewLocalAdmin": 9329, + "moz": 9330, + "more": 9331, + "mock": 9332, + "movable": 9333, + "mozilla": 9334, + "Ġfl": 9335, + "Ġfso": 9336, + "Ġfilter": 9337, + "Ġfalse": 9338, + "Ġfree": 9339, + "Ġframework": 9340, + "ĠfAllow": 9341, + "ĠfDen": 9342, + "Ġfetch": 9343, + "Ġforest": 9344, + "ĠfSingle": 9345, + "Ġforeground": 9346, + "Ġfsinfo": 9347, + "ĠfuWin": 9348, + "Ġfinished": 9349, + "agic": 9350, + "reds": 9351, + "redVan": 9352, + "abc": 9353, + "about": 9354, + "Ġ{.": 9355, + "Ġ{;$": 9356, + "viceID": 9357, + "AtomicSn": 9358, + "AtomicTaskModifed": 9359, + "FileStream": 9360, + "FileShare": 9361, + "FileMenu": 9362, + "FileProtocolHandler": 9363, + "FileExt": 9364, + "raWUn": 9365, + "tercheck": 9366, + "allUsers": 9367, + "allports": 9368, + "allfailure": 9369, + "SetFile": 9370, + "SetValue": 9371, + "SetPassword": 9372, + "SetTask": 9373, + "passwordpolicy": 9374, + "passwordspray": 9375, + "addfile": 9376, + "addUser": 9377, + "addstore": 9378, + "upload": 9379, + "ply": 9380, + "plied": 9381, + "plrCTP": 9382, + "platform": 9383, + "plicit": 9384, + "LMNO": 9385, + "LMII": 9386, + "ObjectInstall": 9387, + "ObjectClass": 9388, + "Objectsid": 9389, + "ObjectCate": 9390, + "loadFile": 9391, + "324": 9392, + "32521": 9393, + "CurrentCred": 9394, + "prow": 9395, + "protection": 9396, + "profil": 9397, + "provides": 9398, + "provlaunch": 9399, + "ForCredential": 9400, + "ForPend": 9401, + "Forward": 9402, + "Username": 9403, + "UserList": 9404, + "Userlist": 9405, + "UserPrincipal": 9406, + "UserDns": 9407, + "UserThread": 9408, + "UserDomainName": 9409, + "UserHunt": 9410, + "perty": 9411, + "Servers": 9412, + "Ġ\"$([": 9413, + "Ġ\"$_\"": 9414, + "ableVBox": 9415, + "netrc": 9416, + "netcat": 9417, + "netvsc": 9418, + "ĠDate": 9419, + "ĠDRO": 9420, + "ĠDrive": 9421, + "ĠDOT": 9422, + "ĠDetonate": 9423, + "ĠDoes": 9424, + "ĠDriver": 9425, + "ĠDont": 9426, + "ĠDIS": 9427, + "ĠDrawing": 9428, + "ĠDebugger": 9429, + "ĠDISK": 9430, + "logmein": 9431, + "iphon": 9432, + "ipleTS": 9433, + "ĠĠĠĠĠĠ": 9434, + "idWls": 9435, + "Secret": 9436, + "urelock": 9437, + "REGSV": 9438, + "TypeDefinition": 9439, + "Ġaddr": 9440, + "Ġadduser": 9441, + "Ġ11": 9442, + "Ġ120": 9443, + "Ġ146": 9444, + "Ġ127": 9445, + "Ġ1024": 9446, + "Ġ145": 9447, + "emulation": 9448, + "emptyp": 9449, + "lyBird": 9450, + "}&&#": 9451, + ").\"": 9452, + ").$": 9453, + "://\"": 9454, + "645": 9455, + "6443": 9456, + "Ġthem": 9457, + "ĠthePath": 9458, + "Ġtheir": 9459, + "itySup": 9460, + "Outfile": 9461, + "::\"": 9462, + "::'": 9463, + "Ġbz": 9464, + "Ġbus": 9465, + "Ġbrowser": 9466, + "Ġboot": 9467, + "Ġbios": 9468, + "Lov": 9469, + "Versions": 9470, + "VersionString": 9471, + "VersionIndepen": 9472, + "verify": 9473, + "WriteAll": 9474, + "clud": 9475, + "clHIG": 9476, + "Things": 9477, + "Threat": 9478, + "There": 9479, + "Thermal": 9480, + "Ġ[[": 9481, + "mentCommand": 9482, + "mentProvider": 9483, + "scriptfile": 9484, + "scripting": 9485, + "domains": 9486, + "domainpass": 9487, + "domaindump": 9488, + "domainpasswordpolicy": 9489, + "STap": 9490, + "STDIN": 9491, + "STlz": 9492, + "StartType": 9493, + "ular": 9494, + "ComServer": 9495, + "Comple": 9496, + "Common": 9497, + "Commun": 9498, + "ORCE": 9499, + "binst": 9500, + "HostName": 9501, + "gett": 9502, + "getString": 9503, + "getBytes": 9504, + "getgo": 9505, + "getowner": 9506, + "getglobal": 9507, + "150": 9508, + "151": 9509, + "155": 9510, + "1556": 9511, + "1559": 9512, + "EMEa": 9513, + "ADD": 9514, + "ADDomain": 9515, + "ADPrincipal": 9516, + "ADServicePrincipal": 9517, + "ADDomainController": 9518, + "ADMIN": 9519, + "ADRepl": 9520, + "servicebinary": 9521, + "1010": 9522, + "1040": 9523, + "1034": 9524, + "1090": 9525, + "1048": 9526, + "1087": 9527, + "quires": 9528, + "qukLH": 9529, + "quarant": 9530, + "Enum": 9531, + "Encrypt": 9532, + "Encryption": 9533, + "rcvar": 9534, + "Ġwscript": 9535, + "Ġwork": 9536, + "Ġwant": 9537, + "Ġwould": 9538, + "Ġwere": 9539, + "123456789": 9540, + "120002": 9541, + "AdGroup": 9542, + "AdComputer": 9543, + "AdAB": 9544, + "AdABo": 9545, + "OFA": 9546, + "thly": 9547, + "thack": 9548, + "thread": 9549, + "threat": 9550, + "NetConnection": 9551, + "NetSup": 9552, + "NetDomainTrust": 9553, + "NetForestTrust": 9554, + "shrc": 9555, + "sharp": 9556, + "ships": 9557, + "showmount": 9558, + "NTHash": 9559, + "NTVWR": 9560, + "systemstore": 9561, + "systeminfo": 9562, + "efeb": 9563, + "efrFn": 9564, + "efsAp": 9565, + "opend": 9566, + "operator": 9567, + "testbypass": 9568, + "ProcessID": 9569, + "ProcessId": 9570, + "ProcessCreationIncludeCmdLine": 9571, + "($_.": 9572, + "execreload": 9573, + "lsmod": 9574, + "lsSJy": 9575, + "ryiz": 9576, + "Ġ07": 9577, + "Ġ01010000": 9578, + "Ġinput": 9579, + "Ġinster": 9580, + "Ġinfo": 9581, + "Ġinsi": 9582, + "Ġindeed": 9583, + "Ġinclud": 9584, + "ims": 9585, + "imal": 9586, + "imorh": 9587, + "imitation": 9588, + "ERY": 9589, + "ERSHELL": 9590, + "ARED": 9591, + "ebf": 9592, + "eboot": 9593, + "ĠClear": 9594, + "ĠClean": 9595, + "ĠCleanup": 9596, + "ĠCalc": 9597, + "ĠCERT": 9598, + "Apartment": 9599, + "%\\%": 9600, + "SecuritySettings": 9601, + "SecurityCenter": 9602, + ";;($": 9603, + "`\")\"": 9604, + "`\"`\")\";$": 9605, + "aryPathName": 9606, + "('$": 9607, + "('^": 9608, + "('}'": 9609, + "('='": 9610, + "('',": 9611, + "('%')": 9612, + "('.')": 9613, + "('\\')": 9614, + "ManCreds": 9615, + "Ġ{;#{": 9616, + "Associ": 9617, + "Ġ;&": 9618, + "Ġ;{": 9619, + "Ġ;}": 9620, + "Ġ;#{": 9621, + "Ġ;&&": 9622, + "Ġ;;$": 9623, + "Ġ;'@": 9624, + "..#{": 9625, + "...;": 9626, + "..;#{": 9627, + "Ġdd": 9628, + "Ġds": 9629, + "Ġdx": 9630, + "Ġdy": 9631, + "Ġdue": 9632, + "Ġdate": 9633, + "Ġdsrm": 9634, + "Ġdclist": 9635, + "ĠdontLog": 9636, + "Ġdistinguished": 9637, + "Ġdetail": 9638, + "Ġdeny": 9639, + "ĠdisplayName": 9640, + "countdmp": 9641, + "commands": 9642, + "commandline": 9643, + "commandtorun": 9644, + "Installable": 9645, + "InstallScreen": 9646, + "InstallHel": 9647, + "InstallHinf": 9648, + "ControlPanel": 9649, + "usly": 9650, + "uskit": 9651, + "repend": 9652, + "minidump": 9653, + "dllfilename": 9654, + "startsw": 9655, + "AssemblyPath": 9656, + "color": 9657, + "objects": 9658, + "objectsid": 9659, + "IDont": 9660, + "Acpi": 9661, + "SERT": 9662, + "Ġ21": 9663, + "Ġ256": 9664, + "TestGuid": 9665, + "TestIso": 9666, + "PasswordNotRequired": 9667, + "PasswordVault": 9668, + ")\");$": 9669, + "HIAZQB": 9670, + "HIHj": 9671, + "HIJK": 9672, + "cmdline": 9673, + "USERDOMAIN": 9674, + "USERDN": 9675, + "tedHosts": 9676, + "iveShell": 9677, + "hostPID": 9678, + "}'\"": 9679, + "}';;": 9680, + "}'));": 9681, + "}',$": 9682, + "}';};;$": 9683, + "}')).": 9684, + "}'\";;#": 9685, + "}');;$": 9686, + "ServiceAppRole": 9687, + "msv": 9688, + "msdc": 9689, + "mszST": 9690, + "}\\$": 9691, + "}\\\";$": 9692, + "}\\*.*": 9693, + "}\\*#{": 9694, + "}\\..;#{": 9695, + "ĠIF": 9696, + "ĠIO": 9697, + "ĠIf": 9698, + "ĠIt": 9699, + "ĠIsHidden": 9700, + "ĠIcedID": 9701, + "Ġgs": 9702, + "Ġgit": 9703, + "Ġgcp": 9704, + "Ġgpg": 9705, + "Ġgoing": 9706, + "Ġgrab": 9707, + "localuser": 9708, + "localserver": 9709, + "Ġaudit": 9710, + "Ġause": 9711, + "Ġavail": 9712, + "Ġascii": 9713, + "exts": 9714, + "Dism": 9715, + "Display": 9716, + "Dispose": 9717, + "}\";%": 9718, + "}\";}": 9719, + "}\";#{": 9720, + "}\";};": 9721, + "ackmap": 9722, + "PowerUp": 9723, + "sock": 9724, + "Ġ&&$": 9725, + "Ġ&&\";": 9726, + "6368": 9727, + "63616": 9728, + "Cli": 9729, + "CljtY": 9730, + "rorbl": 9731, + "Ġexample": 9732, + "Ġexfiltr": 9733, + "Ġexchaddress": 9734, + "Shells": 9735, + "ShellCommand": 9736, + "Ġpart": 9737, + "Ġpayload": 9738, + "Ġpgrep": 9739, + "Ġpriv": 9740, + "Ġpair": 9741, + "Ġpbcopy": 9742, + "Ġpcw": 9743, + "Ġpaste": 9744, + "Ġprepend": 9745, + "moteSigned": 9746, + "1112": 9747, + "AzAutomation": 9748, + "AzEvent": 9749, + "AzADUser": 9750, + "AzNy": 9751, + "AzADServicePrincipal": 9752, + "ients": 9753, + "sponsor": 9754, + "speak": 9755, + "ĠSystemBiosVersion": 9756, + "ActionCenter": 9757, + "maps": 9758, + "makec": 9759, + "Ġnow": 9760, + "Ġnul": 9761, + "Ġnext": 9762, + "Ġnos": 9763, + "Ġnmap": 9764, + "Ġnumber": 9765, + "Ġneigh": 9766, + "360": 9767, + "36819": 9768, + "setfile": 9769, + "setnot": 9770, + "setsecure": 9771, + "setwebproxy": 9772, + "Ġ]];": 9773, + "strings": 9774, + "Adding": 9775, + "AddFromString": 9776, + "AddToHistory": 9777, + "ĠPATH": 9778, + "ĠPASS": 9779, + "ĠPetit": 9780, + "ĠPNPClass": 9781, + "ĠPOSI": 9782, + "ĠPermission": 9783, + "ĠPreten": 9784, + "ĠPurelock": 9785, + "EXT": 9786, + "EXp": 9787, + "EMPHY": 9788, + "RunHandler": 9789, + "RunDLL": 9790, + "Runbook": 9791, + "udp": 9792, + "udXJ": 9793, + "udHh": 9794, + "keyfile": 9795, + "keylog": 9796, + "Autoruns": 9797, + "ChzZXJ": 9798, + "ChXaW": 9799, + "PSSession": 9800, + "PSProvider": 9801, + "osx": 9802, + "Ġ};&": 9803, + "Ġ};};$": 9804, + "webServer": 9805, + "webexce": 9806, + "webbrowser": 9807, + "webrequest": 9808, + "webdav": 9809, + "bour": 9810, + "bound": 9811, + "boWsx": 9812, + "grab": 9813, + "Logs": 9814, + "Logfile": 9815, + "LogPath": 9816, + "LogName": 9817, + "Logoff": 9818, + "Logged": 9819, + "Logical": 9820, + "TextFile": 9821, + "Append": 9822, + "AppCert": 9823, + "AppActivate": 9824, + "AppvPubl": 9825, + ")){": 9826, + "))|": 9827, + ")))\"": 9828, + ")){;": 9829, + ")))'": 9830, + "))),": 9831, + "Ids": 9832, + "IdPT": 9833, + "Ġpasswordspray": 9834, + "targethost": 9835, + "targetServerIP": 9836, + "downloadTrigger": 9837, + "decodecmd": 9838, + "decomp": 9839, + "dirlist": 9840, + "wdStrike": 9841, + "Ġusers": 9842, + "Ġuserenum": 9843, + "ExternalDevice": 9844, + "AzureAdmin": 9845, + "AzureStealth": 9846, + "AzureRm": 9847, + "=';": 9848, + "=';$": 9849, + "='))\\\"\"": 9850, + "='*';": 9851, + "AsClient": 9852, + "Async": 9853, + "AsHex": 9854, + "Asynch": 9855, + "AsPPL": 9856, + "Ġreplication": 9857, + "Ġremove": 9858, + "Ġresource": 9859, + "Ġresize": 9860, + "Ġrehash": 9861, + "Ġrecovery": 9862, + "Ġrelative": 9863, + "Ġresolve": 9864, + "Ġreceive": 9865, + "Ġremovable": 9866, + "Ġrequires": 9867, + "');@(@('": 9868, + "000000": 9869, + "processname": 9870, + "Ġstill": 9871, + "Ġstrip": 9872, + "Ġstarted": 9873, + "ServerXml": 9874, + "ServerXML": 9875, + "(\"(": 9876, + "(\".\"": 9877, + "(\"\\\\": 9878, + "(\",\");$": 9879, + "(\"[*]\"": 9880, + "cationLength": 9881, + "forfiles": 9882, + "forwar": 9883, + "passview": 9884, + "passhunt": 9885, + "Ġ+%": 9886, + "Ġ@'": 9887, + "Ġ@(": 9888, + "Ġ@';": 9889, + "Ġ@('#{": 9890, + "Ġ@();$": 9891, + "Ġ@();;": 9892, + "clients": 9893, + "Lister": 9894, + "RooT": 9895, + "uming": 9896, + "SecureDesktop": 9897, + "SecureBoot": 9898, + "querytype": 9899, + "printercheck": 9900, + "Ġ.(": 9901, + "Ġ.;": 9902, + "Ġ./*": 9903, + "Ġ.('%')": 9904, + "Ġmicrosoft": 9905, + "Ġmain": 9906, + "Ġmany": 9907, + "Ġmsedge": 9908, + "Ġmagic": 9909, + "';[": 9910, + "';};$": 9911, + "quemu": 9912, + "vmm": 9913, + "vmw": 9914, + "vmbus": 9915, + "vmxnet": 9916, + "Ġnetstat": 9917, + "accountpolicies": 9918, + "MoX": 9919, + "MoMY": 9920, + "ContentType": 9921, + "UseRundll": 9922, + "UseLogonCredential": 9923, + "UseCurrentCred": 9924, + "ĠTO": 9925, + "ĠThe": 9926, + "ĠTCP": 9927, + "ĠTrue": 9928, + "ĠTARGETPID": 9929, + "ĠTGS": 9930, + "ĠTGT": 9931, + "ĠTrack": 9932, + "ĠTermin": 9933, + "Ġiflag": 9934, + "ĠisSecure": 9935, + "ĠisHttp": 9936, + "Ġ$(#{": 9937, + "Ġ$(($": 9938, + "AzureADDomain": 9939, + "AzureADServiceAppRole": 9940, + "CONNE": 9941, + "begin": 9942, + "Ġfilesystem": 9943, + "Ġcreatevm": 9944, + "ExecChrome": 9945, + "Executable": 9946, + "ExecReload": 9947, + "OutputAssembly": 9948, + "=\"(": 9949, + "nsdump": 9950, + "nsAM": 9951, + "Scriptlet": 9952, + "utes": 9953, + "Ġdesk": 9954, + "Ġdelim": 9955, + "executing": 9956, + "executionpolicy": 9957, + "ManagementPath": 9958, + "ManagementClass": 9959, + "NotConnect": 9960, + "ffHS": 9961, + "systemdrive": 9962, + "Accounts": 9963, + "AccountType": 9964, + "AccountEnabled": 9965, + "AccountLock": 9966, + "554": 9967, + "5535": 9968, + "Domains": 9969, + "DomainGroup": 9970, + "DomainPolicy": 9971, + "DomainShare": 9972, + "DomainGroupMember": 9973, + "DomainGPO": 9974, + "SZWQg": 9975, + "SZaGV": 9976, + "cpCgo": 9977, + "cpcDH": 9978, + "subr": 9979, + "wsf": 9980, + "Ġ\\/": 9981, + "Ġ\\\"#{": 9982, + "ĠRestart": 9983, + "ĠRelease": 9984, + "ĠReplace": 9985, + "ĠRemoteSigned": 9986, + "ConnectAsync": 9987, + "CLAS": 9988, + "CLEART": 9989, + "CLREfv": 9990, + "CodeModule": 9991, + "NullOr": 9992, + "serverPath": 9993, + "Ġshown": 9994, + "Ġsharing": 9995, + "CreateFrom": 9996, + "CreateNewLocalAdmin": 9997, + "CreateTextFile": 9998, + "AccessFor": 9999, + "AccessTime": 10000, + "AccessPolicy": 10001, + "AccessVB": 10002, + "AccessRight": 10003, + "Defense": 10004, + "certctl": 10005, + "certreq": 10006, + "ĠAntivirus": 10007, + "ĠAlways": 10008, + "ĠAny": 10009, + "OnUsers": 10010, + "OnStartup": 10011, + "OnLogon": 10012, + "OnCa": 10013, + "Onuv": 10014, + "OnSecureDesktop": 10015, + "getent": 10016, + "seconds": 10017, + "vbd": 10018, + "vbnRlbn": 10019, + "winrm": 10020, + "winPE": 10021, + "Ġ*;": 10022, + "Ġ*)\"": 10023, + "Ġ*>>": 10024, + "Ġ*:*:": 10025, + "oldchecks": 10026, + "Disabled": 10027, + "DisableRemote": 10028, + "DisableInternet": 10029, + "DisableAtt": 10030, + "DisableNotify": 10031, + "DisableNotifications": 10032, + "DisableUns": 10033, + "DisableSecuritySettings": 10034, + "crx": 10035, + "crmlog": 10036, + "crackmap": 10037, + "foreground": 10038, + "foZZ": 10039, + "ApplicationFirewall": 10040, + "ApplicationGuard": 10041, + "5708": 10042, + "EDgo": 10043, + "WebView": 10044, + "WebException": 10045, + "WebConfiguration": 10046, + "WebBrowser": 10047, + "WebGlobal": 10048, + "macos": 10049, + "ĠIgnition": 10050, + "\")]": 10051, + "\")&&": 10052, + "\")};": 10053, + "\"));{": 10054, + "\")[-": 10055, + "Detector": 10056, + "Depth": 10057, + "LineOption": 10058, + "logonpasswords": 10059, + "Ġnothing": 10060, + "();;$": 10061, + "();;[": 10062, + "167": 10063, + "1654": 10064, + "165708": 10065, + "ĠMIN": 10066, + "ĠMachine": 10067, + "ĠMMC": 10068, + "ĠMON": 10069, + "ĠMulti": 10070, + "ĠMsXml": 10071, + "ĠMEMPHY": 10072, + "AutomationAccountName": 10073, + "Foko": 10074, + "Sponsor": 10075, + "automation": 10076, + "never": 10077, + "LocalFilePath": 10078, + "EnableFirewall": 10079, + "EnableSecureBoot": 10080, + "921": 10081, + "ACEMEa": 10082, + "ACDisableNotify": 10083, + "dataonly": 10084, + "datastorage": 10085, + "mluc": 10086, + "26564": 10087, + "861": 10088, + "867": 10089, + "86921": 10090, + "Descen": 10091, + "}.%": 10092, + "}.$(": 10093, + "}.*'": 10094, + "}.*').": 10095, + "Ġlow": 10096, + "Ġlarg": 10097, + "Ġlisten": 10098, + "Ġlanguage": 10099, + "Ġlpv": 10100, + "Ġlittle": 10101, + "ĠlaZagne": 10102, + "Ġlambd": 10103, + "Ġlimitation": 10104, + "Ġ$_.\"": 10105, + "binarycookies": 10106, + "LOAD": 10107, + "LOGON": 10108, + "WRM": 10109, + "\\\")\"": 10110, + "\\\");$": 10111, + "nobody": 10112, + "notevil": 10113, + "ressPreference": 10114, + "(){": 10115, + "()}": 10116, + "()};": 10117, + "())\"": 10118, + "()[-": 10119, + "()+`\"": 10120, + "()]}};": 10121, + "BocC": 10122, + "Bochs": 10123, + "izers": 10124, + "perio": 10125, + "permut": 10126, + "'),": 10127, + "'))\"&&": 10128, + "'));\"&&": 10129, + "')).\"": 10130, + "CopyFrom": 10131, + "DoesNotRequirePreAuth": 10132, + "DoNotConnect": 10133, + "NAGU": 10134, + "powershellsensitive": 10135, + "sysm": 10136, + "sysrc": 10137, + "syscall": 10138, + "sysvol": 10139, + "syswow": 10140, + "}\",#": 10141, + "Ġconsole": 10142, + "Ġconfirm": 10143, + "Ġconstructor": 10144, + "Ġconnected": 10145, + "Ġcontro": 10146, + "AdminAuditLog": 10147, + "999": 10148, + "99999": 10149, + "ALTIME": 10150, + "ALUe": 10151, + "PDQ": 10152, + "SICAL": 10153, + "Ġ54": 10154, + "Ġ5000000": 10155, + "Ġhw": 10156, + "Ġhow": 10157, + "Ġhash": 10158, + "Ġhave": 10159, + "Ġhigh": 10160, + "Ġstarting": 10161, + "Ġstartvm": 10162, + "RemoveDefinition": 10163, + "AtomicTestFileT": 10164, + "printcmd": 10165, + "NoSave": 10166, + "NoKC": 10167, + "NoZW": 10168, + "NoIi": 10169, + "NoWrap": 10170, + "zipfile": 10171, + "ĠSetWallpaper": 10172, + "ModulePath": 10173, + "ModuleName": 10174, + "Unified": 10175, + "Unique": 10176, + "Unattend": 10177, + "Unblock": 10178, + "Unprivileged": 10179, + "Unhrd": 10180, + "tpbXBvcnQg": 10181, + "Ġnewfile": 10182, + "Activ": 10183, + "lineHosts": 10184, + "Ġ`\",": 10185, + "Ġ`\"`\")\";$": 10186, + "International": 10187, + "plet": 10188, + "Ġtesting": 10189, + "Ġtestcat": 10190, + "utils": 10191, + "sshpass": 10192, + "WinlogonTokenSystem": 10193, + "',([": 10194, + "CredSSP": 10195, + "CredManCreds": 10196, + "GroupMembership": 10197, + "Malicious": 10198, + "afd": 10199, + "akteul": 10200, + "ĠSort": 10201, + "ĠSET": 10202, + "ĠSQB": 10203, + "ĠSamAccountName": 10204, + "ĠSCR": 10205, + "ĠSymlinkEvaluation": 10206, + "ĠSAML": 10207, + "ĠSECURITY": 10208, + "ĠSMBIOS": 10209, + "ĠSnitch": 10210, + "ickTimeout": 10211, + "Ġformat": 10212, + "Ġforces": 10213, + "ARCH": 10214, + "ARCHI": 10215, + "ARIES": 10216, + "INSERT": 10217, + "OfflineHosts": 10218, + "Taskmgr": 10219, + "UpCm": 10220, + "Updater": 10221, + "Uploading": 10222, + "UploadFile": 10223, + "trace": 10224, + "ĠWill": 10225, + "ĠWarmup": 10226, + "lockscreen": 10227, + "Ġcomputers": 10228, + "Ġcomspec": 10229, + "Ġcomsx": 10230, + "Temperature": 10231, + "040": 10232, + "196": 10233, + "1943": 10234, + "1971": 10235, + "Recent": 10236, + "liBpe": 10237, + "ĠsetZer": 10238, + "procs": 10239, + "Keychain": 10240, + "KeyMgr": 10241, + "Keystrok": 10242, + "135": 10243, + "1337": 10244, + "1396": 10245, + ":\"$": 10246, + ";};;#": 10247, + ";};;[": 10248, + "dcsync": 10249, + "dccuac": 10250, + "mktemp": 10251, + "saDb": 10252, + "santad": 10253, + "Ġgetaccountpolicies": 10254, + "Ġ\"\".": 10255, + "Ġ\"/\"": 10256, + "Ġ\"/?": 10257, + "authtoken": 10258, + "authNotRequired": 10259, + ";#$": 10260, + "]\"'": 10261, + "]\"\").": 10262, + "ĠYES": 10263, + "Ġlogout": 10264, + "Ġlogman": 10265, + "attache": 10266, + "defb": 10267, + "defs": 10268, + "defend": 10269, + "FilesInPV": 10270, + "SessionName": 10271, + "SessionPer": 10272, + "cloudaudit": 10273, + "cloudfront": 10274, + "createobject": 10275, + "createdump": 10276, + "dylib": 10277, + "historylength": 10278, + "writing": 10279, + "Ġ3389": 10280, + "Ġ333": 10281, + "Ġ3852": 10282, + "Ġcatalog": 10283, + "ifyvm": 10284, + "ifycmdline": 10285, + "modules": 10286, + "1056": 10287, + "DirLister": 10288, + "RuWRM": 10289, + "pwpolicy": 10290, + "roles": 10291, + "ComputerAdmin": 10292, + "ComputerStatus": 10293, + "ComputerDefaults": 10294, + "ExcelVBAaddin": 10295, + "cronjob": 10296, + "Downgr": 10297, + "dbd": 10298, + "dbm": 10299, + "dbaf": 10300, + "ncmV": 10301, + "obdev": 10302, + "observation": 10303, + "phY": 10304, + "php": 10305, + "phant": 10306, + "phPXVybGxpYjI": 10307, + "physically": 10308, + "useback": 10309, + "Ġlsof": 10310, + "Ġchpasswd": 10311, + "Ġchange": 10312, + "Ġchflags": 10313, + "achements": 10314, + "StreamRead": 10315, + "StreamWr": 10316, + "EventID": 10317, + "FromImage": 10318, + "FromParent": 10319, + "Prequest": 10320, + "PreauthNotRequired": 10321, + "PrincipalId": 10322, + "PrincipalContext": 10323, + "PrincipalSource": 10324, + "Their": 10325, + "TheHash": 10326, + "TheThings": 10327, + "findall": 10328, + "ngivenName": 10329, + "notlike": 10330, + "tenz": 10331, + "arios": 10332, + "dentProgID": 10333, + "destinationpath": 10334, + "ProviderPath": 10335, + "RegKey": 10336, + "classname": 10337, + "Compress": 10338, + "CompColor": 10339, + "Components": 10340, + "AppDataLow": 10341, + ")&&([": 10342, + "2022": 10343, + "2029": 10344, + "AllFiles": 10345, + "AllScreen": 10346, + "AllCheck": 10347, + "AllLov": 10348, + "AllTheThings": 10349, + "CimProvider": 10350, + "NOE": 10351, + "jsKV": 10352, + "pwdlength": 10353, + "SharpView": 10354, + "SharpCloud": 10355, + "SharpWatson": 10356, + "calculator": 10357, + "ATHRemote": 10358, + "Utils": 10359, + "IPAddress": 10360, + "Qucm": 10361, + "QuickTimeout": 10362, + "axr": 10363, + "cated": 10364, + "dscrpt": 10365, + "Ġenum": 10366, + "Ġprofile": 10367, + "Ġproto": 10368, + "Ġprogram": 10369, + "Ġproperty": 10370, + "installed": 10371, + "msiexec": 10372, + "executablepath": 10373, + "containers": 10374, + "*\");{": 10375, + "Immutable": 10376, + "Immers": 10377, + "MprLogon": 10378, + "MpxCt": 10379, + "MpThreat": 10380, + "MpComputerStatus": 10381, + "ltZW": 10382, + "monthly": 10383, + "manufacturer": 10384, + "})'": 10385, + "})\\": 10386, + "})\";;": 10387, + "})*(?": 10388, + "})@$(#{": 10389, + "Ġ&\"$": 10390, + "Ġ&(\"{": 10391, + "Ġ&\\\"\"": 10392, + "ĠOS": 10393, + "ĠOU": 10394, + "ĠOUT": 10395, + "ĠOrig": 10396, + "ĠONCE": 10397, + "ĠOPEN": 10398, + "ĠOrganization": 10399, + "ĠOSTap": 10400, + "deleteUser": 10401, + "ConfigUpdater": 10402, + "StartupType": 10403, + "StartupItems": 10404, + "dumpert": 10405, + "dumpcr": 10406, + "566": 10407, + "5609": 10408, + "ModeDescription": 10409, + "astEnabled": 10410, + "iofile": 10411, + "ioreg": 10412, + "ioDevice": 10413, + "ĠHistory": 10414, + "ĠHaHa": 10415, + "Ġadvpack": 10416, + "Ġexecuting": 10417, + "Ġ\"[\"": 10418, + "Ġ\"[#{": 10419, + "Ġ\"[!]": 10420, + "searchVuln": 10421, + "ReadWrite": 10422, + "ReadToEnd": 10423, + "ShortVersionString": 10424, + "Networkinformation": 10425, + "shareenumer": 10426, + "Executes": 10427, + "ExecuteShortcut": 10428, + "ExecuteShellCommand": 10429, + "Ġdeletes": 10430, + "Ġdeletejournal": 10431, + "ResourceId": 10432, + "ResourceAppId": 10433, + "DesktopAnti": 10434, + "DesktopSwitch": 10435, + "3778": 10436, + "Dlls": 10437, + "Verb": 10438, + "Verification": 10439, + "Verified": 10440, + "Ġkerberoast": 10441, + "Ġkali": 10442, + "Ġkernel": 10443, + "Ġ\"\\\\$": 10444, + "streams": 10445, + "streamCommand": 10446, + "\";;./": 10447, + "profiles": 10448, + "ClientDLL": 10449, + "ClientAccessib": 10450, + "ClientConfigUpdater": 10451, + "forcedCode": 10452, + "CertificateCheck": 10453, + "CertificateValid": 10454, + "2219": 10455, + "Agc": 10456, + "AgTG": 10457, + "AgSZaGV": 10458, + "HOST": 10459, + "HOOKS": 10460, + "NDJps": 10461, + "SDB": 10462, + "SDOMAIN": 10463, + "TrING": 10464, + "VMware": 10465, + "VMFirm": 10466, + "VMTZ": 10467, + "cmUsIHN": 10468, + "cmDw": 10469, + "cmNoKC": 10470, + "fullName": 10471, + "symlink": 10472, + "ĠStartW": 10473, + "ĠStartEXE": 10474, + "ĠStartMenu": 10475, + "Ġ\"%#{": 10476, + "exportPFX": 10477, + "TokenManip": 10478, + "1547007": 10479, + "BaseStream": 10480, + "BaseSettings": 10481, + "Minimal": 10482, + "ZXEs": 10483, + "itecture": 10484, + "laZagne": 10485, + "timers": 10486, + "ĠADFS": 10487, + "ĠADMIN": 10488, + "expression": 10489, + "expires": 10490, + "exposed": 10491, + "ansom": 10492, + "RemotePath": 10493, + "RemoteManagement": 10494, + "RemotePC": 10495, + "RemoteAccessPolicy": 10496, + "RemoteCertificateValid": 10497, + "Ġspctl": 10498, + "Ġspread": 10499, + "Ġspawn": 10500, + "SearchScope": 10501, + "SearchRooT": 10502, + "Ġsessions": 10503, + "','^": 10504, + "','#{": 10505, + "441": 10506, + "442": 10507, + "44878": 10508, + ";}}}": 10509, + "[$$]": 10510, + "dfca": 10511, + "confirm": 10512, + "ishingServer": 10513, + "1566": 10514, + "156909": 10515, + "Ġexpression": 10516, + "Recursive": 10517, + "Environments": 10518, + "\"}}": 10519, + "\"});": 10520, + ".\\/": 10521, + "095609": 10522, + "274": 10523, + "275": 10524, + "279": 10525, + "2781": 10526, + "2768": 10527, + "294": 10528, + "296": 10529, + "OpenRead": 10530, + "OpenWith": 10531, + "OpenURL": 10532, + "OpenCalc": 10533, + "PacketCapture": 10534, + "ftpServer": 10535, + "gging": 10536, + "ggIi": 10537, + "ggfCB": 10538, + "iaNut": 10539, + "ĠFalse": 10540, + "ĠFOU": 10541, + "ĠFORCE": 10542, + "ĠGET": 10543, + "ĠGOT": 10544, + "ĠGuard": 10545, + "ĠGlobal": 10546, + "ĠGUI": 10547, + "ĠUP": 10548, + "ĠUSE": 10549, + "ĠUbn": 10550, + "ĠUUID": 10551, + "ĠUACDisableNotify": 10552, + "Ġee": 10553, + "Ġepl": 10554, + "Ġesentutl": 10555, + "Ġestablished": 10556, + "Ġelements": 10557, + "ĠxlApp": 10558, + "Ġxattr": 10559, + "ĠxlBook": 10560, + "Ġonstart": 10561, + "Ġonlogon": 10562, + "Ġasreproast": 10563, + "ĠUsername": 10564, + "ĠUserPrincipalName": 10565, + "ĠUserAuthentication": 10566, + "ĠUserInit": 10567, + "&&#!/": 10568, + "ributes": 10569, + "usersdpsLight": 10570, + "raphy": 10571, + "programfiles": 10572, + "PropertiesMy": 10573, + "MemberDefinition": 10574, + "--/": 10575, + "BASH": 10576, + "FirewallPolicy": 10577, + "PublicProfile": 10578, + "XmlDocument": 10579, + "mmhd": 10580, + "rereg": 10581, + "vcGVu": 10582, + "extensions": 10583, + "regsvcs": 10584, + "complete": 10585, + "Ġwindefend": 10586, + "foxprow": 10587, + "\",\"\",$": 10588, + "defaults": 10589, + "VirtualAddress": 10590, + "VirtualScreen": 10591, + "\");#": 10592, + "\");}": 10593, + "\");};": 10594, + "((($": 10595, + "214": 10596, + "943001": 10597, + "ActiveDirectory": 10598, + "ActiveView": 10599, + "ICY": 10600, + "MyProcess": 10601, + "MyCustom": 10602, + "SaveAs": 10603, + "bix": 10604, + "dialDLL": 10605, + "gta": 10606, + "ĠBlock": 10607, + "ĠBotnet": 10608, + "ĠBEGIN": 10609, + "ĠBYPASS": 10610, + "ĠBinary": 10611, + "Ġunset": 10612, + "Ġunlock": 10613, + "Ġuninstall": 10614, + "Ġuniq": 10615, + "ĠAtomicUser": 10616, + "ĠAtomicTask": 10617, + "ĠAtomicTaskModifed": 10618, + "Ġadmincountdmp": 10619, + "ĠEnableModuleLogging": 10620, + "ĠEnableTran": 10621, + "ĠEnableScriptBlockLogging": 10622, + "ĠEnableLUA": 10623, + "ĠNote": 10624, + "ĠNoRun": 10625, + "ĠNoFind": 10626, + "ĠNoDesktop": 10627, + "ĠNoClose": 10628, + "ĠNoLogOff": 10629, + "ĠNoTray": 10630, + "ĠNoFileMenu": 10631, + "ĠNoSetTask": 10632, + "ĠNoControlPanel": 10633, + "ĠNoPropertiesMy": 10634, + "debugging": 10635, + "angeMe": 10636, + "}\")).": 10637, + "}\")'&&": 10638, + "acceptance": 10639, + "accesschk": 10640, + "Ġsystemd": 10641, + "Ġsystemstate": 10642, + "spooler": 10643, + "spoolvuln": 10644, + "mailbox": 10645, + "NETCore": 10646, + "InternetShortcut": 10647, + "InternetLocations": 10648, + "$_\\": 10649, + "$_\",": 10650, + "));\\\\": 10651, + "8080": 10652, + "80530": 10653, + "LaunchApplication": 10654, + "MailNick": 10655, + "MaxSize": 10656, + "QBhX": 10657, + "QBtAGUA": 10658, + "QBXAG": 10659, + "QByAG": 10660, + "SPORT": 10661, + "disabled": 10662, + "disables": 10663, + "puk": 10664, + "xsize": 10665, + "xsPV": 10666, + "Ġ<$": 10667, + "ĠLite": 10668, + "ĠLIK": 10669, + "ĠLsaDb": 10670, + "ĠCreates": 10671, + "ĠGroupMembership": 10672, + "Ġsubmit": 10673, + "enterprise": 10674, + "Autoload": 10675, + "AutoExec": 10676, + "LogonServer": 10677, + "Ġ@{\"": 10678, + "Ġ@{};": 10679, + "ConnectionState": 10680, + "OnlineManagement": 10681, + "securityContext": 10682, + "securitycent": 10683, + "securityCenter": 10684, + "UpdateDeploy": 10685, + "\")))": 10686, + "\"))": 10688, + "ECK": 10689, + "MDM": 10690, + "MDNS": 10691, + "OLD": 10692, + "WSReset": 10693, + "filterwarnings": 10694, + "filterfw": 10695, + "firmware": 10696, + "ialize": 10697, + "issuer": 10698, + "wbcat": 10699, + "ĠVSS": 10700, + "Ġalpine": 10701, + "Ġaltit": 10702, + "ĠTestUser": 10703, + "Ġkeymgr": 10704, + "Ġ\"(?<": 10705, + "Ġ\"(.{$": 10706, + "stopevent": 10707, + "encrypt": 10708, + "delims": 10709, + "Ġclone": 10710, + "Ġclipboard": 10711, + "Ġclients": 10712, + "allowRun": 10713, + "allowAccessFor": 10714, + "ĠDisableNotification": 10715, + "ĠDisableAnti": 10716, + "ĠDisableRegistry": 10717, + "ĠDisableCMD": 10718, + "ĠDisableLock": 10719, + "ĠDisableChange": 10720, + "ĠDisableRestr": 10721, + "ĠDisableTaskmgr": 10722, + "Ġpassphrase": 10723, + "closed": 10724, + "evilreg": 10725, + ")';$": 10726, + ")').": 10727, + ")'\";;": 10728, + ")(!(": 10729, + ")(?:[": 10730, + "02443": 10731, + "7250": 10732, + "ABhAHQ": 10733, + "ABCDE": 10734, + "ABuAG": 10735, + "BinaryPathName": 10736, + "BlockBlock": 10737, + "IFRy": 10738, + "SES": 10739, + "SEARCH": 10740, + "SVC": 10741, + "UTE": 10742, + "WDBLD": 10743, + "WallPaper": 10744, + "WmiMethod": 10745, + "aWYgcm": 10746, + "fix": 10747, + "privs": 10748, + "rdCk": 10749, + "},>,`\"": 10750, + "Ġtelnet": 10751, + "Ġtested": 10752, + "ĠExfil": 10753, + "ĠExchange": 10754, + "ĠExclusion": 10755, + "ĠExplicit": 10756, + "ĠCommandLineTemplate": 10757, + "ĠCommandLineEventConsumer": 10758, + "Ġ\"#\\!/": 10759, + "orgValue": 10760, + "orgLegalNoticeText": 10761, + "orgLegalNoticeCaption": 10762, + "encodehex": 10763, + "itchd": 10764, + "WindowTitle": 10765, + "sessionGop": 10766, + "InfoTip": 10767, + "\";};;": 10768, + "\";};;;": 10769, + "properties": 10770, + "ĠIPC": 10771, + "ResponseText": 10772, + "\":[\"": 10773, + "\":[{\"": 10774, + "=$|[^": 10775, + "=$!;": 10776, + "AUOptions": 10777, + "AUABhAHQ": 10778, + "Bydj": 10779, + "IIS": 10780, + "KCkK": 10781, + "MSRV": 10782, + "MSXML": 10783, + "OTM": 10784, + "PROCE": 10785, + "PROXY": 10786, + "TRAN": 10787, + "TRUE": 10788, + "WaitForPend": 10789, + "ZWqGX": 10790, + "events": 10791, + "eventName": 10792, + "eventlog": 10793, + "eventvwr": 10794, + "xdWVzd": 10795, + "}:%": 10796, + "ĠNetWire": 10797, + "ĠSecurityHe": 10798, + "ĠSecurityLay": 10799, + "Ġmodifyvm": 10800, + "Ġsshd": 10801, + "ContextType": 10802, + "ContextMenu": 10803, + "Ġ'#'": 10804, + "Ġ'$($": 10805, + "connectport": 10806, + "connectaddress": 10807, + "ĠDisconnect": 10808, + "ĠDiskCleanup": 10809, + "ĠDisallowRun": 10810, + "httponly": 10811, + "httpLogging": 10812, + "httplogging": 10813, + "STARTING": 10814, + "STARTUP": 10815, + "buildcache": 10816, + "RuntimeEnvironment": 10817, + "\"'&&": 10818, + "08007": 10819, + "2465": 10820, + ";[^/": 10821, + "AAAA": 10822, + "AAYQB": 10823, + "AAQAA": 10824, + "AAQBhX": 10825, + "AGUAL": 10826, + "AHcAaQB": 10827, + "AHealth": 10828, + "MachineList": 10829, + "OSArch": 10830, + "ParentPID": 10831, + "ParentContainer": 10832, + "__};": 10833, + "avProtection": 10834, + "azon": 10835, + "blE": 10836, + "blkvsc": 10837, + "gpp": 10838, + "gpresult": 10839, + "gpBE": 10840, + "ieuinit": 10841, + "kuberne": 10842, + "prefix": 10843, + "samfile": 10844, + "samrat": 10845, + "ttl": 10846, + "ttt": 10847, + "}`\"\"": 10848, + "}`\",": 10849, + "}`\"`": 10850, + "}`\"`\"`\")\";$": 10851, + "Ġ65535": 10852, + "ĠNamedPipe": 10853, + "ĠLogical": 10854, + "Ġrules": 10855, + "Ġcertutil": 10856, + "commondatastorage": 10857, + "keepVersions": 10858, + "veryone": 10859, + "ĠChromium": 10860, + "ĠCharSet": 10861, + "ĠChangeMe": 10862, + "RoamingClientConfigUpdater": 10863, + "Ġ\\\"\\\"": 10864, + "Ġ\\\"\\\";": 10865, + "Ġchanging": 10866, + "Ġchanges": 10867, + "Ġprojects": 10868, + ";\"@;#": 10869, + "&`\"`\",": 10870, + "&`\"`\"`\",": 10871, + "){[": 10872, + "-]*": 10873, + "-][^": 10874, + "1486": 10875, + "471": 10876, + "4776": 10877, + "50396": 10878, + "8364": 10879, + "9600": 10880, + "AMSI": 10881, + "CHAR": 10882, + "CHECK": 10883, + "Cmdlet": 10884, + "GPG": 10885, + "GPPPassword": 10886, + "IMEWDBLD": 10887, + "PortNumber": 10888, + "PostContext": 10889, + "TrustRelation": 10890, + "bGEv": 10891, + "bGUg": 10892, + "bdWH": 10893, + "csproduct": 10894, + "csrutil": 10895, + "dGxl": 10896, + "dGltZW": 10897, + "dspath": 10898, + "dsquery": 10899, + "jobs": 10900, + "killall": 10901, + "pbpaste": 10902, + "pful": 10903, + "pfctl": 10904, + "powerview": 10905, + "powerSQL": 10906, + "parameters": 10907, + "vboxguest": 10908, + "vboxsf": 10909, + "zLlBJ": 10910, + "ĠuAction": 10911, + "ĠuParam": 10912, + "ĠuBlock": 10913, + "Ġregular": 10914, + "ĠProcessName": 10915, + "ĠProcessId": 10916, + "ĠProcessors": 10917, + "ĠProcessCreationIncludeCmdLine": 10918, + "Ġosascript": 10919, + "Ġvbext": 10920, + "enabled": 10921, + "namespaces": 10922, + "Attributes": 10923, + "Ġseconds": 10924, + "ĠsameSite": 10925, + "CreationTime": 10926, + "ShareAccess": 10927, + "ShareFinder": 10928, + "SharedAccess": 10929, + "shadowcopy": 10930, + "InstalledSDB": 10931, + "Authenticode": 10932, + "Authenticate": 10933, + "CheckIf": 10934, + "CheckShareAccess": 10935, + "=\"$($": 10936, + "=\"$!\"&&": 10937, + "ldapdomaindump": 10938, + "Ġspecified": 10939, + "AADIntADUser": 10940, + "AADIntBack": 10941, + "AADIntSAMLToken": 10942, + "guestAccount": 10943, + "responsebody": 10944, + ")[-": 10945, + "*\\.": 10946, + "0123456789": 10947, + "531": 10948, + ";&$": 10949, + "DumpWCM": 10950, + "MonitorProcess": 10951, + "NonPublic": 10952, + "PassView": 10953, + "SHARED": 10954, + "Signature": 10955, + "SignerCertificate": 10956, + "UNICOD": 10957, + "VENTVWR": 10958, + "ZaffHS": 10959, + "\\\";\\": 10960, + "ciX": 10961, + "cabtest": 10962, + "xlcig": 10963, + "Ġ41": 10964, + "Ġ41943": 10965, + "ĠRansom": 10966, + "Ġrmdir": 10967, + "Ġrsaut": 10968, + "Ġscanning": 10969, + "Ġscheduled": 10970, + "Ġupdated": 10971, + "injectionLocal": 10972, + "legit": 10973, + "ntlmusers": 10974, + "anydesk": 10975, + "totalclosed": 10976, + "ReportingMode": 10977, + "chromeexec": 10978, + "Ġsysrc": 10979, + "Ġsysadminctl": 10980, + "Ġsaved": 10981, + "...&&#{": 10982, + "Ġdisplayname": 10983, + "Ġ};};&": 10984, + "Ġ};};[": 10985, + "Ġ};};'@": 10986, + "(\"{`": 10987, + "Ġshares": 10988, + "Ġshadows": 10989, + "Ġshadowstorage": 10990, + "CreateProcessWith": 10991, + "CreateProcessFromParent": 10992, + "ĠARTUser": 10993, + "DeviceGuard": 10994, + "autoit": 10995, + "autoDelete": 10996, + "permissions": 10997, + "ldifde": 10998, + "HTAUri": 10999, + "ZXNzaW": 11000, + "HelpText": 11001, + "MsolUser": 11002, + "DnsNameList": 11003, + "),)\";$": 11004, + "),'~')|": 11005, + "/'.\\/": 11006, + "@('{": 11007, + "Alerts": 11008, + "BIg": 11009, + "Backstab": 11010, + "ClearLogs": 11011, + "Generation": 11012, + "Generalrecon": 11013, + "IHBzLn": 11014, + "IHNoZW": 11015, + "NSAVE": 11016, + "NlKCkK": 11017, + "SysWow": 11018, + "Sysinternal": 11019, + "SyncAppvPubl": 11020, + "WithLogged": 11021, + "ZoneTemperature": 11022, + "bruteuser": 11023, + "bruteforce": 11024, + "cbc": 11025, + "factory": 11026, + "hkWr": 11027, + "iBW": 11028, + "kernel": 11029, + "kittenz": 11030, + "tbLZU": 11031, + "week": 11032, + "wmiObject": 11033, + "wmiobject": 11034, + "yBTeXN": 11035, + "}/\";$": 11036, + "ĠEOF": 11037, + "ĠEstablished": 11038, + "ĠEveryone": 11039, + "ĠEVENTVWR": 11040, + "ĠPaths": 11041, + "ĠWindowsAud": 11042, + "ĠUnreach": 11043, + "ĠAutoExec": 11044, + "ĠAutodialDLL": 11045, + "stors": 11046, + "storvsc": 11047, + "origins": 11048, + "ProgIds": 11049, + "PromptForCredential": 11050, + "Ġtcpdump": 11051, + "StatusCode": 11052, + "ĠDCSync": 11053, + "ĠDCShadow": 11054, + "ShowUI": 11055, + "ShowKeyMgr": 11056, + "Ġperform": 11057, + "AzureADUserPassword": 11058, + "AzureADServicePrincipalKeyCredential": 11059, + "Ġ\\\\\\\"": 11060, + "Ġ\\\\?\\": 11061, + "Ġ\\\\$(#{": 11062, + "BootExecute": 11063, + "Ġconnectport": 11064, + "Ġconnectaddress": 11065, + "TemplatePE": 11066, + "AllowSecondaryAuthentication": 11067, + "AllowTSConnections": 11068, + "AllowExternalDevice": 11069, + "IPCERT": 11070, + "LevelOverride": 11071, + "activate": 11072, + "ĠHideClock": 11073, + "ĠHideFileExt": 11074, + "zLnBocC": 11075, + "AuthenticationType": 11076, + ",\"<\",\"#{": 11077, + "2339": 11078, + "243": 11079, + "595": 11080, + "59595": 11081, + "979": 11082, + "=*-*": 11083, + "AZAAg": 11084, + "AZQAg": 11085, + "BrowserCollect": 11086, + "CFpuk": 11087, + "CRven": 11088, + "Capacity": 11089, + "EmpireProject": 11090, + "Factory": 11091, + "Factor": 11092, + "FaCdd": 11093, + "Height": 11094, + "Headers": 11095, + "JyxVQS": 11096, + "LastWriteTime": 11097, + "LastAccessTime": 11098, + "MTgEt": 11099, + "MTsgV": 11100, + "Psiphon": 11101, + "RIA": 11102, + "VBProject": 11103, + "VBComponents": 11104, + "]${_})": 11105, + "]'(": 11106, + "]'').": 11107, + "bkf": 11108, + "domu": 11109, + "hZbOs": 11110, + "kKcHMu": 11111, + "lukebag": 11112, + "libaudit": 11113, + "mVsSV": 11114, + "mtYn": 11115, + "overrides": 11116, + "snaps": 11117, + "sniff": 11118, + "snitchd": 11119, + "samples": 11120, + "waitone": 11121, + "zdWJwcm": 11122, + "}};};": 11123, + "})))\"": 11124, + "Ġ726564": 11125, + "Ġyyy": 11126, + "Ġlocked": 11127, + "Ġlocated": 11128, + "Ġmsonline": 11129, + "Ġaccesses": 11130, + "Ġaccessed": 11131, + "Ġ\"{}\";": 11132, + "statuspolicy": 11133, + "Ġ===": 11134, + "desktop": 11135, + "desktopimgdownldr": 11136, + "localectl": 11137, + "headless": 11138, + "ConsoleOutput": 11139, + "Ġ'%'\"": 11140, + "Ġ'(?<": 11141, + "Ġ'(&(": 11142, + "Ġ'*'\"": 11143, + "Ġ'*:\\'": 11144, + "Ġsimmutable": 11145, + "Ġsimulation": 11146, + "Ġsimilar": 11147, + ");{;$": 11148, + "otherchecks": 11149, + "CurrentUserObject": 11150, + "Shadowcopy": 11151, + "NetEventPacketCapture": 11152, + "Ġinteractive": 11153, + "extractme": 11154, + "Ġpfctl": 11155, + "specific": 11156, + "maxDownloads": 11157, + "Ġreadme": 11158, + "AzureADApplicationKeyCredential": 11159, + "ĠMSFT": 11160, + "ĠMSAcpi": 11161, + "transfers": 11162, + "evtx": 11163, + "manipulated": 11164, + "Ġ\"\\\\.\\#{": 11165, + "----\"|": 11166, + "ĠLastWriteTime": 11167, + "Ġjournalctl": 11168, + "}','~')|": 11169, + "pYyBSZWQg": 11170, + "GPOAudit": 11171, + "GPOComputerAdmin": 11172, + "GPORemoteAccessPolicy": 11173, + "TransportType": 11174, + "dotnetfun": 11175, + "iWindowPosX": 11176, + "iWindowPosDX": 11177, + "iWindowPosDY": 11178, + "ATOMICREDT": 11179, + "\"][": 11180, + "\"],\"": 11181, + "()),": 11182, + "())')&&": 11183, + "())};[": 11184, + "7712": 11185, + "78243": 11186, + "AaAAg": 11187, + "ASCIIEncoding": 11188, + "BUG": 11189, + "Evasive": 11190, + "Finished": 11191, + "HJZe": 11192, + "HJvY": 11193, + "IiTu": 11194, + "IiAtdm": 11195, + "MacroSheet": 11196, + "Macadem": 11197, + "QUIC": 11198, + "QUIRE": 11199, + "QgLX": 11200, + "RURn": 11201, + "RtlCreate": 11202, + "SKzg": 11203, + "SKIPCERT": 11204, + "SUUsk": 11205, + "Suppress": 11206, + "SuperHidden": 11207, + "SimonTath": 11208, + "TSM": 11209, + "VIDE": 11210, + "Wireshark": 11211, + "Workbook": 11212, + "Workstation": 11213, + "XJrZXI": 11214, + "XNjQ": 11215, + "XNliBpe": 11216, + "ZGxlcig": 11217, + "\\/]*\\": 11218, + "]*\\.\"": 11219, + "browserpwn": 11220, + "cvzf": 11221, + "dCA": 11222, + "fakedomain": 11223, + "listenport": 11224, + "pki": 11225, + "priority": 11226, + "Ġqc": 11227, + "Ġqfe": 11228, + "Ġanonymo": 11229, + "ĠInc": 11230, + "ĠInbound": 11231, + "Ġallprofiles": 11232, + "ĠInstallutil": 11233, + "Ġusernames": 11234, + "Ġstrings": 11235, + "ĠUseLogonCredential": 11236, + "ĠUseActionCenter": 11237, + "ĠAtomicTestFileT": 11238, + "Ġroles": 11239, + "errorreporting": 11240, + "Ġ\".*\"": 11241, + "Ġ\".*\\.": 11242, + "}\"\"\"))));'": 11474, + ">));'&&": 11475, + "AIABuAG": 11476, + "AQjm": 11477, + "AQQByAG": 11478, + "BzIC": 11479, + "Bitmap": 11480, + "BitsTrans": 11481, + "CMdw": 11482, + "CbOsx": 11483, + "CbDefense": 11484, + "CoreServices": 11485, + "DHP": 11486, + "Dnscat": 11487, + "DNSServer": 11488, + "DNSExfiltr": 11489, + "FXvGP": 11490, + "FfcP": 11491, + "FnZW": 11492, + "FuUnhrd": 11493, + "FuZGxlcig": 11494, + "GXihUQJ": 11495, + "GnH": 11496, + "ISNU": 11497, + "Ikhl": 11498, + "JIjeS": 11499, + "JztzZXJ": 11500, + "KQppb": 11501, + "KVLJdH": 11502, + "KvNor": 11503, + "Kzu": 11504, + "LsN": 11505, + "LsGy": 11506, + "LuLu": 11507, + "NBNS": 11508, + "NBwt": 11509, + "OGKvNor": 11510, + "Order": 11511, + "Owner": 11512, + "OwningProcess": 11513, + "PLACEMEa": 11514, + "QoKQppb": 11515, + "RhbdWH": 11516, + "RhbGxfb": 11517, + "RydWUsIHN": 11518, + "SGCCciX": 11519, + "SGFuZGxlcig": 11520, + "SSOR": 11521, + "Snaff": 11522, + "Sites": 11523, + "Svchost": 11524, + "SkipCertificateCheck": 11525, + "SQLite": 11526, + "TIMEOUT": 11527, + "UIDYu": 11528, + "UsoDLL": 11529, + "UsoClientDLL": 11530, + "VboxC": 11531, + "VboxDrv": 11532, + "WXYZ": 11533, + "WxZaffHS": 11534, + "YnByb": 11535, + "aXR": 11536, + "aXQoKQppb": 11537, + "aiWx": 11538, + "bCcpCgo": 11539, + "bCGnH": 11540, + "bwlimit": 11541, + "czssnTe": 11542, + "cztpbXBvcnQg": 11543, + "crypto": 11544, + "dHA": 11545, + "dafthack": 11546, + "drivers": 11547, + "drivetype": 11548, + "eEwo": 11549, + "finder": 11550, + "finally": 11551, + "generic": 11552, + "generaldomain": 11553, + "hXv": 11554, + "hlIEF": 11555, + "hyZXEs": 11556, + "hAHQAZQAg": 11557, + "jAHIAZQB": 11558, + "jQIdPT": 11559, + "jmDde": 11560, + "jZXNzLlBJ": 11561, + "jZXNzLnBocC": 11562, + "kuyuqow": 11563, + "lastlog": 11564, + "lastlogin": 11565, + "mhWT": 11566, + "mhGXihUQJ": 11567, + "mofcomp": 11568, + "mwcname": 11569, + "mwcpath": 11570, + "nbtstat": 11571, + "nft": 11572, + "nfHLL": 11573, + "pJS": 11574, + "pVP": 11575, + "potam": 11576, + "potato": 11577, + "ronous": 11578, + "slxOw": 11579, + "tYXJrZXI": 11580, + "tvkSe": 11581, + "tvJztzZXJ": 11582, + "tAGUAIAB": 11583, + "ujBHD": 11584, + "vaRIA": 11585, + "wIChXaW": 11586, + "wRvkWi": 11587, + "wRllOC": 11588, + "wgb": 11589, + "zVAgSZaGV": 11590, + "zcvf": 11591, + "{};}": 11592, + "}%\")": 11593, + "}%%'\"": 11594, + "ĠREALTIME": 11595, + "ĠREQUIRE": 11596, + "Ġverify": 11597, + "Ġverified": 11598, + "Ġopmode": 11599, + "Ġoperation": 11600, + "ĠAssumes": 11601, + "ĠAssuming": 11602, + "Ġasktgt": 11603, + "Ġasktgs": 11604, + "ĠAppleShow": 11605, + "Ġvmm": 11606, + "Ġvmw": 11607, + "Ġvariable": 11608, + "Ġvariables": 11609, + "Ġanymore": 11610, + "ĠVideoBiosVersion": 11611, + "ĠVideoModeDescription": 11612, + "ĠQUIC": 11613, + "ĠQUERY": 11614, + "Ġ\"^[": 11615, + "Ġ=\"`\"": 11616, + "Ġtotal": 11617, + "Ġtotally": 11618, + "ĠtrustRoot": 11619, + "Ġtrustdmp": 11620, + "Ġclosed": 11621, + "NamedPipeSystem": 11622, + "InfDefaultInstall": 11623, + "InjectView": 11624, + "InjectContext": 11625, + "Ingestion": 11626, + "Ingestors": 11627, + "InboxRule": 11628, + "Ġ'[[:": 11629, + "ExtPt": 11630, + "Exfiltration": 11631, + "Ġ(&(\"{": 11632, + "GetCurrentDomain": 11633, + "};&$": 11634, + "ĠsvcVersion": 11635, + "Ġsvchost": 11636, + "Ġfollowing": 11637, + "Ġfollowed": 11638, + "ĠDEFEND": 11639, + "ĠDEBUG": 11640, + "Ġ1337": 11641, + "Ġ1700": 11642, + "Ġbucket": 11643, + "Ġbuckets": 11644, + "NetIPAddress": 11645, + "NetIPInterface": 11646, + "execstoppost": 11647, + "Manipulated": 11648, + "Ġ2016": 11649, + "ĠInterfaceAlias": 11650, + "Ġextensions": 11651, + "Ġprinter": 11652, + "Ġprintenv": 11653, + "Ġpwdhistorylength": 11654, + "Ġpwdproperties": 11655, + "ĠPROVIDERORDER": 11656, + "ĠPROVIDE": 11657, + "AppRoles": 11658, + ")))}))": 11659, + "(\"\\\")[-": 11660, + "(\"\\\\\");$": 11661, + "ĠmySecret": 11662, + "ExecStopPost": 11663, + "ĠReportingMode": 11664, + "CreateThreadNative": 11665, + "ĠAntiVirusProduct": 11666, + "();@('%": 11667, + "();@('^": 11668, + "ĠMaintenance": 11669, + "ĠMaxMpxCt": 11670, + "ĠMaxCapacity": 11671, + "ĠMonitorProcess": 11672, + "LocationsInPV": 11673, + "NoAutoUpdate": 11674, + "NoAutoReboot": 11675, + "ActivateMicrosoftApp": 11676, + "InterfaceAlias": 11677, + "afeLocationsInPV": 11678, + "ĠSaveNothing": 11679, + "ĠWallpaper": 11680, + "ĠWallPaper": 11681, + "Ġcomputername": 11682, + "Ġsetupapi": 11683, + "crontabs": 11684, + "FromStringA": 11685, + "HTTPS": 11686, + "monitors": 11687, + "}){@('{": 11688, + "ĠHello": 11689, + "ĠHelpText": 11690, + "Transcription": 11691, + "cmVxPXVybGxpYjI": 11692, + "Federation": 11693, + "Federated": 11694, + "SecondaryAuthenticationFactor": 11695, + "\",\"--\",\"/": 11696, + "MailboxPermission": 11697, + "MailboxAuditBypass": 11698, + "Ġ<<<": 11699, + "0242": 11700, + "ASRRules": 11701, + "swapon": 11702, + "swapoff": 11703, + "SmbShare": 11704, + "SmbMapp": 11705, + "ĠMicrosoftRedirectionProgram": 11706, + "ĠMicrosoftRedirectionURL": 11707, + "AuditLogIngestion": 11708, + "AuditBypassEnabled": 11709, + "ĠRenamed": 11710, + "CreateProcessSystemBind": 11711, + "ĠAutoShareServer": 11712, + "ĠAutoShareWk": 11713, + "+/])\";$": 11714, + "+/])(?:[": 11715, + "HistorySavePath": 11716, + "HistorySaveStyle": 11717, + "Ġsimulates": 11718, + "Evilreg": 11719, + "EvilStartup": 11720, + "Blbihj": 11721, + "BlbihyZXEs": 11722, + "EtwThread": 11723, + "EtwpCreate": 11724, + "RlbnY": 11725, + "ĠProxyServer": 11726, + "ĠProxyEnable": 11727, + "ĠScreenSaveActive": 11728, + "ĠScreenSaveTimeout": 11729, + "RpZnlpbmcgcmMuY": 11730, + "RpZnlpbmcgcmMub": 11731, + "BIOSVersion": 11732, + "PfxFileName": 11733, + "PfxCertificate": 11734, + "SensorService": 11735, + "XBvcnQgdXJsbGliM": 11736, + "yZWFkKCk": 11737, + "yZWFkKCkKcHMu": 11738, + "CreateRemoteThreadNative": 11739, + "IGdyZXAi": 11740, + "IGdyZXAgTG": 11741, + "cmxsaWIyLlByb": 11742, + "cmxsaWIyLmluc": 11743, + "MaxConnectionsPerServer": 11744, + "aWNlLmNyZWF": 11745, + "CFBundleVersion": 11746, + "CFBundleShortVersionString": 11747, + "hZGRfaGVhZGVyKCdDb": 11748, + "hZGRfaGVhZGVyKCdVc": 11749, + "sensitivefiles": 11750, + "\"::(\"{": 11751, + "%\"==\"": 11752, + "'\\\"\";": 11753, + ")-$($": 11754, + "+=$_.": 11755, + "+)\").": 11756, + ",\\\"$(": 11757, + "/.../": 11758, + "/:$//'": 11759, + "/[^-][^": 11760, + "/-/|/'": 11761, + "0640": 11762, + "0361": 11763, + "05972": 11764, + "1153778": 11765, + "18694": 11766, + "16384": 11767, + "2017": 11768, + "280635": 11769, + "283339": 11770, + "3880": 11771, + "40458400": 11772, + "45836819": 11773, + "4945441": 11774, + "5344661034": 11775, + "5081": 11776, + "650520": 11777, + "617279": 11778, + "7885": 11779, + "78609": 11780, + "783635": 11781, + "80450396": 11782, + "8207480": 11783, + "91253": 11784, + "9565": 11785, + "934313": 11786, + ":]]'": 11787, + ":~-": 11788, + ";__|;": 11789, + "=?\"": 11790, + "=@();$": 11791, + "=^|[^": 11792, + "AvdG": 11793, + "AAtAE": 11794, + "AAcgBvAG": 11795, + "AmsiUtils": 11796, + "AltWinSock": 11797, + "Ammyy": 11798, + "AYQBtAGUAIAB": 11799, + "BPg": 11800, + "BQYMtZ": 11801, + "BrAGUAL": 11802, + "BsaWtlIE": 11803, + "BDXqwE": 11804, + "BhdGggIi": 11805, + "BwIAAAA": 11806, + "Cqqiwq": 11807, + "CrowdStrike": 11808, + "Cannot": 11809, + "Camera": 11810, + "CureP": 11811, + "CACHE": 11812, + "CryptoPolicy": 11813, + "Cryptography": 11814, + "DMAQjm": 11815, + "Derive": 11816, + "DonaldTru": 11817, + "Droplet": 11818, + "DRIVE": 11819, + "Dotnetsearch": 11820, + "EmNz": 11821, + "EyAAQAA": 11822, + "EarlyBird": 11823, + "EsxCli": 11824, + "FGHIJK": 11825, + "FPPng": 11826, + "FbD": 11827, + "FydC": 11828, + "Firepwd": 11829, + "FIDO": 11830, + "FCLOSE": 11831, + "Fliy": 11832, + "Failures": 11833, + "Favorite": 11834, + "FbdgpBE": 11835, + "FZaNmt": 11836, + "Factivity": 11837, + "FOPEN": 11838, + "FsdWUg": 11839, + "FpVK": 11840, + "GWzVAgSZaGV": 11841, + "Geo": 11842, + "GhostTask": 11843, + "GzipFile": 11844, + "Graphics": 11845, + "GGSxPGih": 11846, + "HfVj": 11847, + "Hitolufo": 11848, + "Hypervis": 11849, + "HALT": 11850, + "Ilfo": 11851, + "Issuer": 11852, + "Impersonate": 11853, + "JMaXR": 11854, + "JSVjQIdPT": 11855, + "JFfmtYn": 11856, + "JpXGN": 11857, + "KRShowKeyMgr": 11858, + "KToKIC": 11859, + "KpyYw": 11860, + "KTYeEwo": 11861, + "KDzKv": 11862, + "KHGGRx": 11863, + "Left": 11864, + "LxdhZbOs": 11865, + "LUNvbnRlbn": 11866, + "LNiHfVj": 11867, + "LjAwNC": 11868, + "LCJzZXNzaW": 11869, + "LIBRARIES": 11870, + "MvRHl": 11871, + "Morerecon": 11872, + "MimiPeng": 11873, + "MAMgBfAH": 11874, + "MAZQBzAH": 11875, + "MAIAAtAE": 11876, + "Never": 11877, + "NhbCcpCgo": 11878, + "NqKj": 11879, + "NtQue": 11880, + "NiccXnb": 11881, + "OhujBHD": 11882, + "OinT": 11883, + "Oefcacy": 11884, + "OIIOFA": 11885, + "ODAnO": 11886, + "PQRST": 11887, + "PWGc": 11888, + "PiAvdG": 11889, + "PRELOAD": 11890, + "PptVBAaddin": 11891, + "Printing": 11892, + "POLICY": 11893, + "Privesc": 11894, + "PushNotifications": 11895, + "PKzIiTu": 11896, + "PuTTY": 11897, + "POWERSHELL": 11898, + "QZhAJ": 11899, + "QhwRllOC": 11900, + "QvNy": 11901, + "QxMDM": 11902, + "QEMU": 11903, + "QCPCS": 11904, + "QzVmhWT": 11905, + "RcbdoaEp": 11906, + "RBCD": 11907, + "RSKp": 11908, + "RQJqWS": 11909, + "RWXinjectionLocal": 11910, + "SiO": 11911, + "Surname": 11912, + "SesUz": 11913, + "Signon": 11914, + "Saving": 11915, + "SslStream": 11916, + "Scenarios": 11917, + "Tbml": 11918, + "TmLxdhZbOs": 11919, + "TxL": 11920, + "TyPe": 11921, + "TorExe": 11922, + "TERMSRV": 11923, + "TruncationLength": 11924, + "TSVPU": 11925, + "TkKjXEo": 11926, + "TECTURE": 11927, + "TKYP": 11928, + "UVWXYZ": 11929, + "Ucjh": 11930, + "UfL": 11931, + "UxKTYeEwo": 11932, + "UDisablementCommand": 11933, + "UuidFromStringA": 11934, + "VaoD": 11935, + "VhcmNoKC": 11936, + "Void": 11937, + "VicHJvY": 11938, + "VGVhbSI": 11939, + "VbaProject": 11940, + "Vzcy": 11941, + "Width": 11942, + "WulXNliBpe": 11943, + "WrmgDP": 11944, + "WCMDump": 11945, + "WKQHIHj": 11946, + "WvZAU": 11947, + "WNhdGlvb": 11948, + "XZbF": 11949, + "XCBTbml": 11950, + "XHwtkRVM": 11951, + "Yntj": 11952, + "YOUR": 11953, + "YAbwBrAGUAL": 11954, + "YEHPX": 11955, + "YUDSNOE": 11956, + "ZRerjmDde": 11957, + "].\\.)[": 11958, + "]),@('": 11959, + "]*/;|__": 11960, + "^\"]*')&&": 11961, + "_\")}": 11962, + "aREPLACEMEa": 11963, + "awareness": 11964, + "aWRlbn": 11965, + "bhdump": 11966, + "baloon": 11967, + "besimorh": 11968, + "bareos": 11969, + "bWQsIHNoZW": 11970, + "cifs": 11971, + "cAdQBtAGUA": 11972, + "cThreadEx": 11973, + "dpbi": 11974, + "dRekhNZ": 11975, + "dRLjh": 11976, + "drtm": 11977, + "dseditgroup": 11978, + "distinguishedName": 11979, + "dKaC": 11980, + "dYiSUUsk": 11981, + "fkCRven": 11982, + "finger": 11983, + "fruit": 11984, + "faults": 11985, + "flavor": 11986, + "fbbf": 11987, + "fRlQpJ": 11988, + "fFmkNu": 11989, + "gatherNetwork": 11990, + "gInBzIC": 11991, + "gPSB": 11992, + "gsecdump": 11993, + "gdGhlIEF": 11994, + "gorhill": 11995, + "gdXJsbGliMi": 11996, + "gKsymmhd": 11997, + "hiIk": 11998, + "hlldz": 11999, + "hJIboWsx": 12000, + "iJAailslxOw": 12001, + "iKTsKcHJveHk": 12002, + "javaw": 12003, + "jNwhkWr": 12004, + "jYWwgPiAvdG": 12005, + "krnl": 12006, + "kxwn": 12007, + "kzG": 12008, + "kickstart": 12009, + "kTRlIH": 12010, + "kTGsXc": 12011, + "kAABSU": 12012, + "listening": 12013, + "lmaWNhdGlvb": 12014, + "lSedRLjh": 12015, + "lAHAAYQB": 12016, + "lzLmV": 12017, + "lLEq": 12018, + "lglOefcacy": 12019, + "littlesnitchd": 12020, + "lIxsdRekhNZ": 12021, + "ljJrY": 12022, + "mstsc": 12023, + "mowdbd": 12024, + "mysecpol": 12025, + "mirrorbl": 12026, + "mimurl": 12027, + "mimiload": 12028, + "metrics": 12029, + "nircmd": 12030, + "nimgrab": 12031, + "nishang": 12032, + "nWaiting": 12033, + "nmemberOf": 12034, + "nWHMoMY": 12035, + "nEeDMAQjm": 12036, + "oxMS": 12037, + "oopBPg": 12038, + "popd": 12039, + "position": 12040, + "pointer": 12041, + "pdGNoIi": 12042, + "prtprocs": 12043, + "petitpotam": 12044, + "pGIflS": 12045, + "pnputil": 12046, + "qemu": 12047, + "qeEuvy": 12048, + "sandbox": 12049, + "sAMAccountType": 12050, + "safedump": 12051, + "tons": 12052, + "thePath": 12053, + "tufnEeDMAQjm": 12054, + "tBAQ": 12055, + "tiedump": 12056, + "tkZLVMuMuf": 12057, + "tqcBuBIg": 12058, + "uptime": 12059, + "uADMAMgBfAH": 12060, + "uICplrCTP": 12061, + "uAHYAbwBrAGUAL": 12062, + "uPXQzVmhWT": 12063, + "uHNmAy": 12064, + "uUmVxdWVzd": 12065, + "vacuum": 12066, + "vZGlmaWNhdGlvb": 12067, + "wificreds": 12068, + "wazuh": 12069, + "wKSBsaWtlIE": 12070, + "wOyBydj": 12071, + "wQshiBW": 12072, + "waithandle": 12073, + "wuauclt": 12074, + "xordump": 12075, + "xmtMoX": 12076, + "yaml": 12077, + "zones": 12078, + "zwnpVP": 12079, + "zAHQAIABuAG": 12080, + "zujfRlQpJ": 12081, + "zHcgJx": 12082, + "zbIrJFfmtYn": 12083, + "zhVcTKYP": 12084, + "}=)?(?=$|[^": 12085, + "}(==)?|[": 12086, + "Ġroute": 12087, + "Ġassumes": 12088, + "Ġheap": 12089, + "Ġwordpad": 12090, + "Ġamazon": 12091, + "ĠToastEnabled": 12092, + "Ġagain": 12093, + "Ġ}&&[": 12094, + "ĠLoavProtection": 12095, + "ĠThen": 12096, + "Ġapply": 12097, + "ĠSTRING": 12098, + "Ġquit": 12099, + "Ġmdatp": 12100, + "Ġefi": 12101, + "Ġusn": 12102, + "Ġmaxsize": 12103, + "ĠCommandline": 12104, + "ĠAutomatic": 12105, + "ĠExecuted": 12106, + "ĠScriptText": 12107, + "Ġvia": 12108, + "ĠFound": 12109, + "ĠNEQ": 12110, + "ĠLOGIN": 12111, + "ĠFullAccess": 12112, + "Ġhelpful": 12113, + "ĠLoginHook": 12114, + "ĠInstallUtilPath": 12115, + "Ġvalues": 12116, + "Ġ445": 12117, + "Ġmemory": 12118, + "Ġieadvpack": 12119, + "ĠModify": 12120, + "ĠProgressPreference": 12121, + "ĠPromptOnSecureDesktop": 12122, + "Ġvirtualization": 12123, + "Ġignoreallfailure": 12124, + "ĠAuthenticationLevelOverride": 12125, + "Ġoverwriting": 12126, + "Ġmaxpwdage": 12127, + "ĠKEYWORD": 12128, + "ĠScriptingEngine": 12129, + "ĠorganizationalPerson": 12130, + "Ġ9090": 12131, + "Ġaccross": 12132, + "ĠHIGH": 12133, + "realname": 12134, + "renameFile": 12135, + "resume": 12136, + "recording": 12137, + "Ġ\":\\\";": 12138, + "Ġ\":$\"": 12139, + "Ġ\")'&&": 12140, + "Ġ\")[^\"]*')&&": 12141, + "Ġ\"------------\"|": 12142, + "leetspeak": 12143, + "stripchart": 12144, + "stQtTmLxdhZbOs": 12145, + "icinga": 12146, + "ictedAdmin": 12147, + "icweJ": 12148, + "etQECfkCRven": 12149, + "orEnforcedCode": 12150, + "alMovement": 12151, + "arbitrary": 12152, + "enigma": 12153, + "adidnsdump": 12154, + "addefaultdomainpasswordpolicy": 12155, + "itanceType": 12156, + "anchors": 12157, + "ingFinalizers": 12158, + "WinLogonTokenSystem": 12159, + "WinHTTPrequest": 12160, + "WinSxS": 12161, + "setenforce": 12162, + "useraccountcontrol": 12163, + "userdnsdomain": 12164, + "Ġcopied": 12165, + "Ġcookies": 12166, + "Ġcronjobs": 12167, + "Ġcrontab": 12168, + "ĠcButtons": 12169, + "ĠcGluZyAxMjcuMC": 12170, + "Ġcleared": 12171, + "Ġcorporation": 12172, + "escape": 12173, + "README": 12174, + "REMARK": 12175, + "InheritanceType": 12176, + "Incisive": 12177, + "Integrity": 12178, + "ueApcThreadEx": 12179, + "regasm": 12180, + "registration": 12181, + "Ġ'',[": 12182, + "ateOnDesktopSwitch": 12183, + "ationCallback": 12184, + "vemlsbGEv": 12185, + "GetHostAddresses": 12186, + "GetAllTrustRelation": 12187, + "GetResponseStream": 12188, + "GetRuntimeDirectory": 12189, + "GetField": 12190, + "ypwmFZaNmt": 12191, + "asyncwaithandle": 12192, + "Ġsafeboot": 12193, + "Ġsmbstatus": 12194, + "Ġsyssetup": 12195, + "ToWindowsUpdateInternetLocations": 12196, + "mockbin": 12197, + "ĠfAllowToGetHelp": 12198, + "ĠfDenyTSConnections": 12199, + "ĠfSingleSessionPer": 12200, + "ĠfuWinIni": 12201, + "redVanity": 12202, + "AtomicSnake": 12203, + "raWUnLCJzZXNzaW": 12204, + "LMNOPQRST": 12205, + "LMIIgnition": 12206, + "ObjectInstallAction": 12207, + "ObjectCategory": 12208, + "325217": 12209, + "profiler": 12210, + "ForwardTo": 12211, + "UserDnsDomain": 12212, + "UserHunter": 12213, + "ĠDROP": 12214, + "ĠDOTNET": 12215, + "ĠDoesNotRequirePreAuth": 12216, + "ĠDriverVersion": 12217, + "ĠDontShowUI": 12218, + "ĠDISABLE": 12219, + "ĠDISKDRIVE": 12220, + "ipleTSSessions": 12221, + "idWlsZF": 12222, + "REGSVR": 12223, + "emptypasswords": 12224, + "itySupported": 12225, + "Ġbusybox": 12226, + "Ġbrowsers": 12227, + "Ġbootstatuspolicy": 12228, + "VersionIndependentProgID": 12229, + "verifyctl": 12230, + "WriteAllBytes": 12231, + "clHIGaL": 12232, + "ThermalZoneTemperature": 12233, + "domainpassspray": 12234, + "STlzljJrY": 12235, + "CompletedHosts": 12236, + "CommunitySupported": 12237, + "getglobalstate": 12238, + "ADPrincipalGroupMembership": 12239, + "ADReplAccount": 12240, + "servicebinarypath": 12241, + "quarantine": 12242, + "Ġworkstation": 12243, + "1234567890": 12244, + "AdABlAHAAYQB": 12245, + "AdABoAG": 12246, + "threats": 12247, + "NetSupport": 12248, + "sharphound": 12249, + "efrFnLNiHfVj": 12250, + "efsApi": 12251, + "opendns": 12252, + "lsSJyuICplrCTP": 12253, + "ryizoopBPg": 12254, + "Ġ010100001971": 12255, + "Ġinsterted": 12256, + "Ġinside": 12257, + "Ġincluding": 12258, + "ĠCleartext": 12259, + "ĠCalculator": 12260, + "`\")\"'": 12261, + "('}')[": 12262, + "('=')[": 12263, + "('',(": 12264, + "Association": 12265, + "Ġ;'@;$": 12266, + "Ġdistinguishedname": 12267, + "Ġdetails": 12268, + "InstallScreenSaver": 12269, + "InstallHelper": 12270, + "InstallHinfSection": 12271, + "startswith": 12272, + "IDontExist": 12273, + "PasswordVaultCredentials": 12274, + "USERDNSDOMAIN": 12275, + "}'));\")&&": 12276, + "msdcs": 12277, + "Ġauditd": 12278, + "Ġausearch": 12279, + "Ġavailable": 12280, + "DisplayAlerts": 12281, + "socks": 12282, + "CljtYau": 12283, + "Ġexfiltration": 12284, + "Ġexchaddresses": 12285, + "Ġprivileges": 12286, + "Ġpcwutl": 12287, + "AzAutomationRunbook": 12288, + "AzEventHub": 12289, + "makecab": 12290, + "Ġnosimmutable": 12291, + "Ġnumbered": 12292, + "Ġneighbour": 12293, + "setnotifycmdline": 12294, + "setsecurewebproxy": 12295, + "AddToHistoryHandler": 12296, + "ĠPetitPotam": 12297, + "ĠPOSIX": 12298, + "ĠPermissions": 12299, + "ĠPretending": 12300, + "ĠPurelocker": 12301, + "RunHandlerComServer": 12302, + "udXJsb": 12303, + "webexception": 12304, + "webbrowserpassview": 12305, + "LogicalDisk": 12306, + "AppCertDlls": 12307, + "decompile": 12308, + "dirlister": 12309, + "AzureAdmins": 12310, + "AzureRmAccount": 12311, + "Asynchronous": 12312, + "Ġremoved": 12313, + "Ġrecoveryenabled": 12314, + "Ġreceived": 12315, + "ServerXmlHttp": 12316, + "ServerXMLHTTP": 12317, + "(\".\");$": 12318, + "(\"\\\\?\\": 12319, + "forwarding": 12320, + "Ġ./*&&": 12321, + "ĠTracking": 12322, + "ĠTerminateOnDesktopSwitch": 12323, + "ĠisHttpOnly": 12324, + "AzureADServiceAppRoleAssignment": 12325, + "CONNECTION": 12326, + "beginConnect": 12327, + "nsAMAccountName": 12328, + "ScriptletURL": 12329, + "Ġdelims": 12330, + "AccountLockFailures": 12331, + "cpcDHps": 12332, + "CLASSES": 12333, + "CLEARTEXT": 12334, + "CLREfvwQshiBW": 12335, + "CreateFromDirectory": 12336, + "AccessVBOM": 12337, + "AccessRights": 12338, + "OnCalendar": 12339, + "OnuvFbD": 12340, + "winPEAS": 12341, + "DisableRemoteDesktopAnti": 12342, + "DisableInternetFilesInPV": 12343, + "DisableAttachements": 12344, + "DisableUnsafeLocationsInPV": 12345, + "crackmapexec": 12346, + "foregroundcolor": 12347, + "EDgoaxr": 12348, + "WebConfigurationProperty": 12349, + "WebBrowserPassView": 12350, + "WebGlobalModule": 12351, + "DetectorId": 12352, + "1657085": 12353, + "ĠMINUTE": 12354, + "ĠMachineGuid": 12355, + "ĠMultiString": 12356, + "ĠMEMPHYSICAL": 12357, + "Fokoy": 12358, + "Descending": 12359, + "Ġlarger": 12360, + "Ġlistenport": 12361, + "ĠlpvParam": 12362, + "Ġlambda": 12363, + "LOGONSERVER": 12364, + "()]}};&": 12365, + "period": 12366, + "permutations": 12367, + "CopyFromScreen": 12368, + "DoNotConnectToWindowsUpdateInternetLocations": 12369, + "Ġcontrollers": 12370, + "AdminAuditLogConfig": 12371, + "RemoveDefinitions": 12372, + "NoSaveCache": 12373, + "UnifiedAuditLogIngestion": 12374, + "Activator": 12375, + "akteullen": 12376, + "ĠSQBuAHYAbwBrAGUAL": 12377, + "ĠSCRNSAVE": 12378, + "ĠSECURITYPOLICY": 12379, + "ĠSMBIOSBIOSVersion": 12380, + "ARCHITECTURE": 12381, + "lockscreenurl": 12382, + "ĠcomsxRes": 12383, + "ĠsetZeroData": 12384, + "Keychains": 12385, + "Keystrokes": 12386, + "attached": 12387, + "Ġ385201": 12388, + "Downgrade": 12389, + "ncmVwIC": 12390, + "phantom": 12391, + "usebackq": 12392, + "StreamReader": 12393, + "StreamWriter": 12394, + "20295": 12395, + "AllScreens": 12396, + "AllChecks": 12397, + "jsKVUE": 12398, + "ATHRemoteFXvGP": 12399, + "dscrptsc": 12400, + "installedOn": 12401, + "*\");{(\"[*]\"": 12402, + "ImmutableID": 12403, + "ImmersiveShell": 12404, + "MprLogonScript": 12405, + "})*(?:[": 12406, + "ĠOUTPUT": 12407, + "ĠOrigin": 12408, + "shareenumeration": 12409, + "ExecuteShortcutCommand": 12410, + "ClientAccessible": 12411, + "NDJpsqnzwE": 12412, + "VMFirmware": 12413, + "cmDwhy": 12414, + "ĠStartMenuLogOff": 12415, + "TokenManipulation": 12416, + "RemoteCertificateValidationCallback": 12417, + "09560902443": 12418, + "2781761": 12419, + "2768196": 12420, + "OpenWithProgIds": 12421, + "OpenCalcTask": 12422, + "ggfCBncmVwIC": 12423, + "ĠFOUND": 12424, + "ĠGOTO": 12425, + "ĠGlobalFlag": 12426, + "ĠUbnutu": 12427, + "ĠUserInitMprLogonScript": 12428, + "reregserver": 12429, + "vcGVuZXIocHJveHk": 12430, + "MyCustomRegKey": 12431, + "ĠEnableTranscripting": 12432, + "ĠNoTrayContextMenu": 12433, + "ĠNoSetTaskbar": 12434, + "ĠNoPropertiesMyDocuments": 12435, + "}\")'&&$": 12436, + "Ġsystemstatebackup": 12437, + "spoolvulnscan": 12438, + "805306368": 12439, + "MailNickName": 12440, + "xsPVRydWUsIHN": 12441, + "ĠLIKE": 12442, + "ĠLsaDbExtPt": 12443, + "securitycenter": 12444, + "UpdateDeploymentProvider": 12445, + "Ġaltitude": 12446, + "Ġ\"(?<=^|[^": 12447, + "ĠDisableNotificationCenter": 12448, + "ĠDisableAntiSpyware": 12449, + "ĠDisableRegistryTools": 12450, + "ĠDisableLockWorkstation": 12451, + "ĠDisableChangePassword": 12452, + "ĠDisableRestrictedAdmin": 12453, + "72506": 12454, + "ABCDEFGHIJK": 12455, + "IFRyaWRlbn": 12456, + "aWYgcmUuc": 12457, + "},>,`\"#{": 12458, + "ĠExchangeOnlineManagement": 12459, + "ĠExclusionPath": 12460, + "ĠExplicitly": 12461, + "sessionGopher": 12462, + "AUABhAHQAaAAg": 12463, + "PROCESSOR": 12464, + "TRANSPORT": 12465, + "WaitForPendingFinalizers": 12466, + "ZWqGXB": 12467, + "ĠSecurityHealth": 12468, + "ĠSecurityLayer": 12469, + ";[^/]*/;|__": 12470, + "AHcAaQBuADMAMgBfAH": 12471, + "OSArchitecture": 12472, + "ParentContainerDn": 12473, + "kubernetes": 12474, + "samratashok": 12475, + "bGUgU": 12476, + "dGxlXCBTbml": 12477, + "AuthenticodeSignature": 12478, + "AuthenticateAsClient": 12479, + "CheckIfInstallable": 12480, + "AADIntADUserNTHash": 12481, + "AADIntBackdoor": 12482, + "UNICODE": 12483, + "Ġ4194304": 12484, + "Ġrsautl": 12485, + "CreateProcessWithPipe": 12486, + "IHBzLnN": 12487, + "NlKCkKaWYgcmUuc": 12488, + "Sysinternals": 12489, + "SyncAppvPublishingServer": 12490, + "WithLoggedOnUsers": 12491, + "tbLZUefrFnLNiHfVj": 12492, + "weekly": 12493, + "ĠWindowsAudioDevice": 12494, + "ĠUnreachable": 12495, + "AllowSecondaryAuthenticationDevice": 12496, + "AllowExternalDeviceSignon": 12497, + "=*-*-*": 12498, + "AZAAgAC": 12499, + "BrowserCollector": 12500, + "FaCddxmtMoX": 12501, + "JyxVQSk": 12502, + "lukebaggett": 12503, + "mVsSVWrmgDP": 12504, + "snapshots": 12505, + "Ġ72656463616": 12506, + "Ġyyyy": 12507, + "Ġ'(?<=\"": 12508, + "NetEventPacketCaptureProvider": 12509, + "pYyBSZWQgVGVhbSI": 12510, + "ATOMICREDTEAM": 12511, + "HJZehgs": 12512, + "IiAtdmFsdWUg": 12513, + "MacroSheets": 12514, + "MacademiaNut": 12515, + "QgLXBhdGggIi": 12516, + "RURnpJS": 12517, + "RtlCreateUserThread": 12518, + "SKzgryizoopBPg": 12519, + "SKIPCERTCHECK": 12520, + "SimonTatham": 12521, + "Workbooks": 12522, + "\\/]*\\//--/": 12523, + "Ġanonymously": 12524, + "ĠUseActionCenterExperience": 12525, + "errorreportingfaults": 12526, + "SetupInfObjectInstallAction": 12527, + "obfuskittiedump": 12528, + "bGxvIGZyb": 12529, + "IGZvciBDcmVhdGluZ": 12530, + "AEwAaQBzAHQAIABuAG": 12531, + "AEAAQBhXtvkSe": 12532, + "BlbmVyKG": 12533, + "CnBzID": 12534, + "CCLCSWRPWPDTLOCRRC": 12535, + "IsNullOrWhiteSpace": 12536, + "TGJkbix": 12537, + "VyLUFnZW": 12538, + "WtXbLKqD": 12539, + "dzrGny": 12540, + "nchangetype": 12541, + "pvqFCYyiJAailslxOw": 12542, + "pubprn": 12543, + "pOwphPXVybGxpYjIudXJsb": 12544, + "qxQoLR": 12545, + "vyvZuHNmAy": 12546, + "wMDQucmMuY": 12547, + "wpbKlpGIflS": 12548, + "}}]}}'": 12549, + "ĠScreenSaverIsSecure": 12550, + "Ġlockoutobservationwindow": 12551, + "ĠPortableVBoxDRV": 12552, + "Ġshutdownwithoutlogon": 12553, + "AaQBNAGUAdABoAG": 12554, + "SimulateLateralMovement": 12555, + "ĠAllowMultipleTSSessions": 12556, + "ĠAllowEncryptionOracle": 12557, + "WhiteChocolateMacademiaNut": 12558, + "WhiteOakSecurity": 12559, + "):\\/\\/[": 12560, + ")\\\"}|{": 12561, + "=='));\\\\\\\"": 12562, + "AQQByAGcAdQBtAGUA": 12563, + "BitsTransfer": 12564, + "CbOsxSensorService": 12565, + "DNSExfiltrator": 12566, + "FuUnhrdmszST": 12567, + "ISNUMBER": 12568, + "IkhlbGxvIGZyb": 12569, + "KVLJdHphY": 12570, + "LsGyFokoy": 12571, + "RhbdWHp": 12572, + "SGFuZGxlcigpOwpvID": 12573, + "Snaffler": 12574, + "UIDYuMTsgV": 12575, + "UsoClientDLLSystem": 12576, + "aXQoKQppbXBvcnQgdXJsbGliM": 12577, + "czssnTeGvy": 12578, + "cztpbXBvcnQgcmUsIHN": 12579, + "generaldomaininfo": 12580, + "hAHQAZQAgAC": 12581, + "jAHIAZQBhAHQAZQAgAC": 12582, + "jZXNzLlBJUEUpCm": 12583, + "jZXNzLnBocCc": 12584, + "kuyuqowve": 12585, + "mhGXihUQJQPNk": 12586, + "nfHLLicweJ": 12587, + "tYXJrZXIudHh": 12588, + "wRvkWiZRerjmDde": 12589, + "ĠAppleShowAllFiles": 12590, + "ĠDEFENDER": 12591, + "ĠmySecretPassword": 12592, + "NoAutoRebootWithLoggedOnUsers": 12593, + "cmVxPXVybGxpYjIuUmVxdWVzd": 12594, + "MailboxAuditBypassAssociation": 12595, + "SmbMapping": 12596, + "ĠAutoShareWks": 12597, + "BlbihjbWQsIHNoZW": 12598, + "BlbihyZXEsdGltZW": 12599, + "EtwpCreateEtwThread": 12600, + "RpZnlpbmcgcmMubG": 12601, + "yZWFkKCkKcHMuc": 12602, + "IGdyZXAiCnBzID": 12603, + "IGdyZXAgTGl": 12604, + "/[^-][^\\/]*\\//--/": 12605, + "/-/|/'&&": 12606, + "534466103440": 12607, + "804503962": 12608, + "AAcgBvAGMAZQBzAH": 12609, + "AYQBtAGUAIABjAHIAZQBhAHQAZQAgAC": 12610, + "BQYMtZAS": 12611, + "BDXqwEfoZZ": 12612, + "BwIAAAAkAABSU": 12613, + "DonaldTrump": 12614, + "EyAAQAAAEAAQBhXtvkSe": 12615, + "FPPngEmNz": 12616, + "Favorites": 12617, + "FbdgpBEq": 12618, + "GWzVAgSZaGVCFpuk": 12619, + "GGSxPGihT": 12620, + "HypervisorEnforcedCode": 12621, + "JSVjQIdPTXZbF": 12622, + "KToKICAgc": 12623, + "KpyYwV": 12624, + "LUNvbnRlbnQgLXBhdGggIi": 12625, + "MvRHlDY": 12626, + "MimiPenguin": 12627, + "NtQueueApcThreadEx": 12628, + "NiccXnbHJZehgs": 12629, + "OhujBHDm": 12630, + "PKzIiTuFfcP": 12631, + "QZhAJBnn": 12632, + "RQJqWSGk": 12633, + "SesUzKVLJdHphY": 12634, + "TkKjXEoWulXNliBpe": 12635, + "VhcmNoKCJMaXR": 12636, + "WKQHIHjkzG": 12637, + "XHwtkRVMLBsp": 12638, + "besimorhino": 12639, + "dYiSUUsklSedRLjh": 12640, + "gatherNetworkInfo": 12641, + "gKsymmhdkTGsXc": 12642, + "iKTsKcHJveHkgPSB": 12643, + "jNwhkWrBa": 12644, + "kTRlIHmowdbd": 12645, + "lglOefcacyYEHPX": 12646, + "lIxsdRekhNZjNwhkWrBa": 12647, + "mirrorblast": 12648, + "nWHMoMYV": 12649, + "pdGNoIiwgb": 12650, + "qeEuvyV": 12651, + "tufnEeDMAQjmLku": 12652, + "tkZLVMuMufmn": 12653, + "vZGlmaWNhdGlvbicpCg": 12654, + "wKSBsaWtlIEdlY": 12655, + "wOyBydjoxMS": 12656, + "zbIrJFfmtYnj": 12657, + "Ġignoreallfailures": 12658, + "stQtTmLxdhZbOsNDJpsqnzwE": 12659, + "etQECfkCRvenkTRlIHmowdbd": 12660, + "vemlsbGEvNS": 12661, + "GetAllTrustRelationships": 12662, + "ypwmFZaNmtL": 12663, + "ĠfSingleSessionPerUser": 12664, + "LMNOPQRSTUVWXYZ": 12665, + "AdABlAHAAYQBkAC": 12666, + "lsSJyuICplrCTPGGSxPGihT": 12667, + "DisableRemoteDesktopAntiAlias": 12668, + "DisableAttachementsInPV": 12669, + "UnifiedAuditLogIngestionEnabled": 12670, + "ĠSQBuAHYAbwBrAGUALQBXAG": 12671, + "ATHRemoteFXvGPUDisablementCommand": 12672, + "vcGVuZXIocHJveHkpOwp": 12673, + "ABCDEFGHIJKLMNOPQRSTUVWXYZ": 12674, + "IFRyaWRlbnQvNy": 12675, + "AUABhAHQAaAAgAHcAaQBuADMAMgBfAH": 12676, + ";[^/]*/;|__;": 12677, + "tbLZUefrFnLNiHfVjNi": 12678, + "mVsSVWrmgDPKHGGRx": 12679, + "IiAtdmFsdWUgIkhlbGxvIGZyb": 12680, + "IGZvciBDcmVhdGluZyBTeXN": 12681, + "AQQByAGcAdQBtAGUAbgB": 12682, + "aXQoKQppbXBvcnQgdXJsbGliMjsKVUE": 12683, + "wRvkWiZRerjmDdehJIboWsx": 12684, + "cmVxPXVybGxpYjIuUmVxdWVzdChzZXJ": 12685, + "BlbihjbWQsIHNoZWxsPVRydWUsIHN": 12686, + "AAcgBvAGMAZQBzAHMAIAAtAE": 12687, + "EyAAQAAAEAAQBhXtvkSeH": 12688, + "HypervisorEnforcedCodeIntegrity": 12689, + "LUNvbnRlbnQgLXBhdGggIiRlbnY": 12690, + "TkKjXEoWulXNliBpelsSJyuICplrCTPGGSxPGihT": 12691, + "gKsymmhdkTGsXcDXir": 12692, + "stQtTmLxdhZbOsNDJpsqnzwEUfL": 12693, + "AUABhAHQAaAAgAHcAaQBuADMAMgBfAHAAcgBvAGMAZQBzAHMAIAAtAE": 12694 + }, + "merges": [ + "e r", + "Ġ -", + "i n", + "r e", + "t e", + "o n", + "Ġ \"", + "# {", + "a t", + "l e", + "r o", + "s t", + "Ġ /", + "i c", + "e t", + "e c", + "o r", + "m e", + "Ġ Ġ", + "n t", + "a l", + "u t", + "s s", + "o m", + "Ġ $", + "i le", + "Ġ #{", + "at h", + "a me", + "e x", + "i on", + "te m", + "a r", + "s er", + "c e", + "o w", + "e n", + "f ile", + "Ġ =", + "& &", + "u r", + "a d", + "d e", + "i t", + "l o", + "a n", + "} \"", + "o l", + "o f", + "l l", + "P ath", + "P ro", + "in g", + "n ame", + "a ss", + "h o", + "W in", + "y s", + "c t", + "r i", + "of t", + "s e", + "; $", + "d ow", + "ex e", + "u ser", + "e w", + "Ġ\" #{", + "h e", + "ys tem", + "Ġ t", + "p ath", + "p ut", + "Ġ c", + "0 0", + "N ame", + "ec t", + "Ġ |", + "e s", + "or d", + "a c", + "dow s", + "S t", + "C on", + "R E", + "I n", + "Win dows", + "H K", + "er t", + "p t", + "u e", + "p s", + "ec ho", + "w ord", + "re g", + "j ect", + "\" ;", + "Ġ '", + "c o", + "s oft", + "a m", + "d er", + "I tem", + "c om", + "ar t", + ": \\", + "ic ro", + "ĠĠ Ġ", + "icro soft", + "E x", + "ass word", + "i f", + "M icrosoft", + "om ic", + "c on", + "b ject", + "o ut", + "u n", + "a te", + "at ion", + "an d", + "i l", + "S ystem", + "v ic", + "s c", + "i st", + "k e", + "Ġ (", + "Ġ >", + "t o", + "v e", + "a in", + "i s", + "u b", + "G et", + "R e", + "y p", + "a re", + "ce ss", + "a s", + "c h", + "er s", + "A t", + "} ;", + "Ġ s", + "T o", + ") ;", + "d o", + "N ew", + "m o", + "Ġ f", + "a g", + "re d", + "out put", + "m p", + "a b", + "Ġ {", + "vic e", + "At omic", + "p y", + "F ile", + "re nt", + "ur rent", + "r a", + "t er", + "al l", + "al ue", + "ol der", + "S et", + "p assword", + "yp e", + "ad d", + "u p", + "ri pt", + "p l", + "te nt", + "i r", + "L M", + "O bject", + "r ing", + "lo ad", + "3 2", + "or t", + "o t", + "HK LM", + "C urrent", + "p ro", + "F or", + "U ser", + "h t", + "p ert", + "om ain", + "S er", + "Ġ\" $", + "ab le", + "w are", + "n et", + "m and", + "Ġ D", + "en v", + "Pro pert", + "lo g", + "i p", + "ĠĠ ĠĠ", + "i d", + "n ew", + "C re", + "nt i", + "S ec", + "u re", + "S h", + "u ll", + "RE G", + "V alue", + "v o", + "ri te", + "Propert y", + "it h", + "T ype", + "S oft", + "Ġ add", + ": /", + "Ġ 1", + "e m", + "l y", + "Soft ware", + "s u", + "} &&", + "Ġ- -", + "ct ion", + "ht t", + ") .", + ":/ /", + "6 4", + "Ġt he", + "ers ion", + "T e", + "it y", + "In vo", + "O ut", + ": :", + "htt ps", + "Ġ b", + "Ġ REG", + "con tent", + "L o", + "o st", + "V ersion", + "c ur", + "de nti", + "denti al", + "v er", + "x t", + "he ll", + "For ce", + "Invo ke", + "W rite", + "c l", + "ol ic", + "T h", + "a p", + "Ġ [", + "me nt", + "sc ript", + "F older", + "i re", + "c al", + "d omain", + "S T", + "i es", + "s Folder", + "St art", + "u l", + "C om", + "O R", + "P olic", + "a y", + "Atomic sFolder", + "b in", + "Current Version", + "H ost", + "g et", + "g ith", + "gith ub", + "1 5", + "E M", + "u nt", + "ra w", + "o de", + "Path To", + "PathTo AtomicsFolder", + "A D", + "] ::", + "d u", + "ser vice", + "1 0", + "C U", + "q u", + "at a", + "em b", + "E n", + "r c", + "Ġ w", + "or y", + "St ring", + "1 2", + "A d", + "O F", + "t h", + "N et", + "s h", + "user content", + "ag e", + "github usercontent", + "In st", + "N T", + "s ystem", + "m d", + "Con t", + "e f", + "ur ity", + "Item Property", + "Cre dential", + "o p", + "te st", + "Ġ> >", + "Pro cess", + "( $", + "in e", + "ex ec", + "OR D", + "e nt", + "l s", + "r y", + "s Sh", + "Ġ 0", + "Ġ in", + "i m", + "su do", + "E R", + "W ORD", + "emb ly", + "A RE", + "T W", + "a se", + "t xt", + "Ġ %", + "Polic ies", + "S OF", + "e b", + "TW ARE", + "SOF TWARE", + "Ġ C", + "et c", + "Ġ New", + "A p", + "o re", + "% \\", + "Sec urity", + "D WORD", + "i g", + "; ;", + "` \"", + "ar y", + "Cont ro", + "( '", + "M an", + "Ġ{ ;", + "A ss", + "i me", + "Ġ ;", + ". .", + "Ġ d", + "co unt", + "p ort", + "com mand", + "Inst all", + "in d", + "Contro l", + "u s", + "re p", + "e l", + "m in", + "Ġ Write", + "ay load", + "d ll", + "r in", + "st art", + "ow er", + "Ass embly", + "c ol", + "o bject", + "I D", + "A c", + "S ER", + "Ġ 2", + "Te st", + "P assword", + "ĠĠĠĠ ĠĠĠ", + "ro up", + ") \"", + "H I", + "c md", + "U SER", + "te d", + "/ #{", + "i ve", + "c red", + "ho st", + "S c", + "} '", + "Ġ Get", + "to col", + "Ser vice", + "A r", + "m s", + "Ġt o", + "co de", + "} \\", + "Ġ I", + "Ġ g", + "lo cal", + "Ġt h", + "Ġ a", + "Ġ Out", + "ex t", + "D is", + "n load", + "n ull", + "}\" ;", + "ac k", + "py th", + "pyth on", + "P ower", + "s o", + "Ġ echo", + "w n", + "Ġ &&", + "Pro tocol", + "6 3", + "C l", + "ro r", + "ct ory", + "user name", + "\" #{", + "Ġ ex", + "ic ation", + "HK CU", + "S hell", + "r un", + "t mp", + "Ġ p", + "at omic", + "ire ctory", + "Ar g", + "mo te", + "1 1", + "A z", + "i ent", + "s p", + "E r", + "Ġ System", + "tem p", + "Er ror", + "A ction", + "re ate", + "E Y", + "f older", + "m a", + "n al", + "ar get", + "du le", + "ss ion", + "ac h", + "co py", + "User s", + "qu er", + "u ment", + "Ġ n", + "Ġ( $", + "ul t", + "3 6", + "s et", + "Ġ ]", + "P wn", + "r u", + "st ring", + "Win Pwn", + "HK EY", + "Ad d", + "s rc", + "Ġ P", + "un d", + "Com mand", + "e q", + "f ig", + "ist ry", + "E X", + "c at", + "Ġ #", + "mp ort", + "EM P", + "S e", + "T EMP", + "en der", + "as k", + "Security Protocol", + "R un", + "u d", + "il d", + "ke y", + "A ut", + "C h", + "P S", + "o s", + "Ġ };", + "a ce", + "c k", + "w eb", + "ĠD ef", + ".. \\", + "b o", + "g r", + "v ert", + "Lo g", + "T ext", + "\\ ..\\", + "ro m", + "Con vert", + "Ap p", + ") )", + "I d", + "a ult", + "Ġ password", + "Install er", + "P ar", + "t arget", + "re mote", + "dow nload", + "pt ion", + "Ġth en", + "_ .", + "d ec", + "d ir", + "e d", + "n ect", + "w d", + "in put", + "as h", + "ter nal", + "I L", + "P ayload", + "o in", + "Ġ user", + "Ex ternal", + "Ġf i", + "Az ure", + "\" ;$", + "= '", + "A s", + "T ime", + "Ġ re", + "file name", + "ap p", + "gr am", + "Payload s", + "External Payloads", + "' );", + "A T", + "M E", + "S Y", + "00 00", + "pro cess", + "el se", + "8 8", + "Ġ st", + "ct ive", + "vic es", + "pl ication", + "Ser ver", + "Error Action", + "( \"", + "D ata", + "c ation", + "f or", + "p ass", + "Ġ +", + "Ġ @", + "Ġ HKLM", + "reg istry", + "Ġ' #{", + "Ex p", + "cl ient", + ": #{", + "L ist", + "R o", + "u m", + "Sec ure", + "HI ST", + "quer y", + "Ġ] ;", + "Installer Assembly", + "e p", + "p rin", + "Ġ .", + "Ġ m", + "ur l", + "CU R", + "code d", + "Cl ass", + "Arg ument", + "' ;", + "c ip", + "h ic", + "i ex", + "q ue", + "v m", + "Ġ net", + "Ġ NT", + "ac count", + "Current Control", + "CurrentControl Set", + "M o", + "en d", + "Con tent", + "mo ve", + ") ;$", + "U se", + "Ġ T", + "Ġ if", + "Ġ is", + "Ġ$ (", + "Ser vices", + "ST EM", + "ĠDef ender", + "Azure AD", + "SY STEM", + "Secure String", + "cip al", + "C O", + "b e", + "Ġ file", + "ic e", + "Ġc reate", + "RE NT", + "CUR RENT", + "= #{", + "l ist", + "at ch", + "st er", + "Ex ec", + "Out put", + "= \"", + "D irectory", + "W ord", + "i b", + "n s", + "v alue", + "in ter", + "put er", + "mo d", + "ag er", + "Man ager", + "Sc ript", + "web client", + "download string", + "IL E", + "hic h", + "g roup", + "u te", + "Ġ de", + "in ation", + "st ination", + "de v", + "an ce", + "il ter", + "age ment", + "exec ut", + "Man agement", + "N ot", + "f f", + "g n", + "o py", + "u al", + "} /#{", + "Ġ }", + "Ġ Convert", + "re am", + "00 3", + "system d", + "Ac count", + "ma ster", + "5 5", + "D omain", + "S Z", + "\\ #{", + "c p", + "s ub", + "w s", + "Ġ \\", + "Ġ of", + "Ġ Re", + "Con nect", + "op en", + "7 3", + "C L", + "C ode", + "I EX", + "N ull", + "v ar", + "et ho", + "ser ver", + "ad min", + "Ġs h", + "Cre ate", + "Ac cess", + "etho d", + "D ef", + "c ert", + "v i", + "Ġ A", + "ur ce", + "Ex ce", + "File Path", + "oin t", + "que st", + "O n", + "g e", + "s ec", + "v b", + "w in", + "Ġ *", + "or k", + "ar ch", + "ol d", + "Pro gram", + "15 4", + "Dis able", + "so le", + "F ILE", + "c r", + "f o", + "h er", + "or er", + "con t", + "Ap plication", + "5 7", + "E D", + "W eb", + "a il", + "a ctive", + "m ac", + "le te", + "en coded", + "pl orer", + "Service P", + "ĠI gn", + "\" )", + "$ (", + "D e", + "L ine", + "P l", + "V i", + "e ll", + "n on", + "Ġ se", + "om ation", + "ow ers", + "log on", + "Ġex it", + "Ġn ot", + "ĠConvert To", + "ĠIgn ore", + "owers hell", + "( );", + "1 6", + "E N", + "I nt", + "Ġ M", + "Ġ else", + "ro ot", + "ing s", + "Aut omation", + "dec ode", + "Argument List", + "F o", + "N E", + "R es", + "S p", + "a ut", + "n e", + "s ing", + "w ork", + "y te", + "Ġ art", + "ec ted", + "ct l", + "ain Text", + "pl ay", + "Lo cal", + "qu i", + "En able", + "As Pl", + "mac ro", + "AsPl ainText", + "9 2", + "A C", + "C ol", + "K e", + "S ID", + "b ash", + "d ata", + "m l", + "p ayload", + "w all", + "con sole", + "12 1", + "2 6", + "8 6", + "B as", + "D es", + "m i", + "t ime", + "{ ;", + "} .", + "Ġ l", + "te am", + "le ep", + "ic Par", + "Ġ$ _.", + "00 1", + "Ex plorer", + "ist ory", + "Lo cation", + "bin ary", + "PS Credential", + "Use Bas", + "icPar sing", + "UseBas icParsing", + "F ilter", + "L O", + "W R", + "\\ \"", + "c lo", + "d ate", + "n o", + "t ype", + "re ss", + "te xt", + "le ase", + "st r", + "Property Type", + "63 8", + "Command Line", + "inter active", + "( )", + "2 15", + "5 638", + "B o", + "c be", + "d ce", + "i z", + "p er", + "ro und", + "ac a", + "reg round", + "Ġs u", + "ire wall", + "rep o", + "Ġg rep", + "36 88", + "oint Manager", + "57 73", + "ServiceP ointManager", + "non interactive", + "215 63", + "dce e", + "3688 21563", + "\" &&", + "' )", + "C opy", + "D o", + "N A", + "T ls", + "b u", + "i mport", + "p owershell", + "s ys", + "}\" ,", + "Ġc on", + "to p", + "ve nt", + "Te am", + "du ct", + "Ad min", + "9 9", + "A L", + "A P", + "P D", + "S I", + "c d", + "t r", + "Ġ 5", + "Ġ h", + "Ġ start", + "on e", + "if ic", + "Re move", + "Atomic Test", + "rin cipal", + "Power Shell", + "SecurityProtocol Type", + "prin t", + "ib r", + "Fo reground", + "Col or", + "\" ,", + "C ert", + "N o", + "o k", + "s id", + "w hich", + "z ip", + "Ġ Set", + "Ġ run", + "Ġ query", + "le ct", + "}\" ;$", + "00 2", + "ĠD ata", + "Ch ild", + "Mo dule", + "CO D", + "Vi ew", + "Foreground Color", + "U n", + "p ad", + "t p", + "w m", + "Ġ new", + "al se", + "script ion", + "EN COD", + "console output", + "ibr ary", + "ENCOD ED", + "( [", + "A ct", + "M ethod", + "l ine", + "n ul", + "t ings", + "Ġ and", + "Ġ output", + "Ġ `\"", + "Ġ python", + "ile nt", + "con fig", + "cred File", + "atomic s", + "HIST FILE", + "Int er", + "wm ic", + "= $(", + "\\ $", + "p le", + "Ġ test", + "ut il", + "ss h", + "Win logon", + "Ġ| |", + "Ġf rom", + "Ġ\"$ (", + "10 36", + "' ,", + "C red", + "G roup", + "M al", + "a f", + "a k", + "f er", + "Ġ S", + "re dential", + "ic k", + "St op", + "is able", + "do c", + "Ġf or", + "File Name", + "Do c", + "NA ME", + "A R", + "I N", + "O ff", + "T ask", + "U p", + "c an", + "i ll", + "l d", + "s v", + "t ra", + "v ir", + "Ġ W", + "te ction", + "at us", + "lo ck", + "Ġc om", + "red can", + "Te mp", + "Exp ected", + "old en", + "qui red", + "LO C", + "ific ate", + "Act ual", + "redcan ary", + "0 4", + "1 9", + "R ec", + "b er", + "b at", + "b ase", + "l i", + "in it", + "te pad", + "on d", + "at or", + "ar p", + "Ġs et", + "pro c", + "Type Name", + "Polic y", + "AT A", + "Ke y", + "AP PD", + "APPD ATA", + "1 3", + ": \"", + "; ;$", + "; };", + "I G", + "L ibrary", + "R O", + "U L", + "a ws", + "d c", + "m k", + "s a", + "u name", + "Ġ Invoke", + "Ġ get", + "Ġ\" \"", + "Ġ\" /", + "ro me", + "ex it", + "Ġb ase", + "cur l", + "USER NAME", + "ud it", + "CL SID", + "vb s", + "her e", + "aut h", + "yte s", + "play Name", + "redcanary co", + "; #", + "> &", + "F ull", + "I mport", + "S leep", + "] \"", + "g rep", + "r m", + "~ /", + "Ġ Y", + "Ġ For", + "Ġ log", + "Ġ ~/", + "in ue", + "at t", + "de f", + "am ple", + "Re quest", + "File s", + "ach ine", + "Se ssion", + "De stination", + "clo ud", + "Ġsu do", + "Child Item", + ": $", + "a un", + "b it", + "c reate", + "d y", + "f alse", + "h istory", + "n ing", + "o g", + "r Code", + "u id", + "w r", + "Ġ 3", + "er rCode", + "re en", + "te ns", + "ĠĠ ĠĠĠ", + "Pro tection", + "Ġc at", + "if y", + "mo dule", + "10 5", + "Arg s", + "sp ace", + "ick et", + "aun ch", + "tens ion", + "D ir", + "R u", + "f il", + "k en", + "o und", + "p w", + "Ġ HKCU", + "Ġ\" *", + "ro le", + "he l", + "he et", + "ub l", + "Re d", + "Ġf ind", + "ĠĠĠĠ ĠĠĠĠĠĠĠ", + "Com puter", + "exec ute", + "ore ach", + "start up", + "so urce", + "Class es", + "Def ault", + "vi der", + "Exce l", + "cr on", + "Web Request", + "LOC AL", + "0 1", + "; &&", + "D ow", + "E L", + "N UL", + "a ve", + "d b", + "d ing", + "i tem", + "n c", + "o b", + "p h", + "r v", + "s heet", + "u se", + "Ġ ,", + "Ġ do", + "Ġ ls", + "ad ing", + "Ġc h", + "ac he", + "St ream", + "com puter", + "and om", + "Object Id", + "Ro le", + "win dows", + "ilent ly", + "$ _.", + ". \";", + "4 0", + "C ell", + "E vent", + "F ind", + "F rom", + "P re", + "P rincipal", + "T he", + "a it", + "f ind", + "k top", + "m al", + "n g", + "n ot", + "u f", + "u st", + "w ind", + "in k", + "te n", + "ar g", + "ar i", + "ow n", + "en ce", + "de nt", + "de stination", + "of f", + "Pro vider", + "Ġc redential", + "Re g", + "cl ass", + "Com p", + "App Data", + "Par am", + "registry Path", + "mk dir", + "Dow nload", + "Cell s", + "wind ir", + ") &&", + "2 0", + "A ll", + "C im", + "D C", + "I T", + "N O", + "U t", + "\\ |", + "j s", + "m er", + "p wd", + "s hell", + "Ġ Win", + "ri ve", + "Con su", + "Sh arp", + "Ġb e", + "cal c", + "im um", + "us r", + "ru le", + "Log in", + "AT H", + "Ro ot", + "InstallerAssembly FileName", + "InstallerAssembly Dir", + "Mal Doc", + "Off ice", + "Ġcom mand", + "Expected Output", + "Actual Output", + "ubl ic", + "Ut il", + "Consu mer", + "G o", + "I P", + "Q u", + "a x", + "c ate", + "c cess", + "d sc", + "e v", + "o urce", + "u ild", + "Ġ en", + "Ġ pro", + "in st", + "ss l", + "ass embly", + "ri v", + "00 6", + "co ding", + "ag es", + "pl ist", + "Inst ance", + ";; #", + "Install Util", + "ms i", + "execut able", + "Exce ption", + "cont ain", + "* \"", + "4 6", + "E ach", + "H T", + "I m", + "I WR", + "I dent", + "M p", + "M AC", + "S ub", + "a udit", + "c ript", + "g olden", + "l t", + "l ag", + "m on", + "m an", + "p en", + "p id", + "s i", + "t ask", + "} )", + "} ;$", + "Ġ &", + "Ġ O", + "Ġ Se", + "ex fil", + "de lete", + "Ġc urrent", + "Con fig", + "reg ion", + "Start up", + "du mp", + ")\" ;$", + "HI NE", + "Dis playName", + "run dll", + "sub scription", + "iz e", + "fer ence", + "arg s", + "MAC HINE", + "5 6", + "> /", + "M ode", + "O M", + "V ari", + "a st", + "i o", + "i wr", + "m at", + "o ol", + "t ual", + "u ch", + "w rite", + "Ġ H", + "Ġ ad", + "Ġ execut", + "Ġ\" =", + "Ġ\" [", + "ar d", + "Pro duct", + "se arch", + "ist r", + "ve l", + "Re al", + "Re ad", + "as quer", + "Sh ort", + "En d", + "En coding", + "Ġw ith", + "Net work", + "sh are", + "Sc he", + "}\\ #{", + "Exec ute", + "Ġde lete", + "ell ow", + "Res ource", + "Des ktop", + "Ġcon fig", + "ĠY ellow", + "og le", + "hel lo", + "* .", + ". ;", + "3 0", + "3 7", + "A n", + "D ll", + "I O", + "V er", + "f ace", + "f oreach", + "k at", + "p am", + "Ġ k", + "Ġ Files", + "re e", + "on ment", + "Ġ\" \\", + "le t", + "ro w", + "st ream", + "ad ow", + "00 4", + "\"; ;", + "if ication", + "are nt", + "do ck", + "Ġf ound", + "Atomic Red", + "pro file", + "10 55", + "12 04", + "im i", + "cred s", + "ĠOut put", + "Cl ient", + "bo x", + "for ce", + "prin cipal", + "Enable d", + "Cert ificate", + "Ġcommand s", + "Im age", + "cript ion", + "ĠSe lect", + "Ġexecut ion", + "istr ator", + "kat z", + "dock er", + "AtomicRed Team", + "2 2", + "@ #{", + "A g", + "H O", + "M emb", + "N D", + "P ID", + "S C", + "S D", + "T r", + "V M", + "a nt", + "c m", + "f ull", + "m asquer", + "s y", + "w ho", + "x ml", + "Ġ Start", + "re ad", + "on se", + "Ġ\" %", + "or age", + "Ġ$ ($", + "ex port", + "en u", + "lo it", + "ct or", + "Ġc atch", + "00 5", + "am i", + "To ken", + "net sh", + "cl u", + "cl sid", + "dule d", + "Ġn o", + "pass wd", + "sec ure", + "154 6", + "154 7", + "ne ss", + "macro code", + "AR T", + "dsc l", + "masquer ading", + "\" ).", + "B ase", + "B ytes", + "L e", + "M in", + "V ir", + "Z X", + "f ter", + "i te", + "l a", + "l er", + "t im", + "u mp", + "v al", + "Ġ it", + "Ġ https", + "Ġ AD", + "Ġ root", + "re ct", + "ec k", + "or rect", + "ex p", + "an s", + "Item Type", + "System Root", + "Re mote", + "Ġs o", + "Ġs p", + "Ġw hich", + "Cont inue", + "(' #{", + "ru st", + "Se arch", + "Ch rome", + "Ġ\\ \\#{", + "Ġse ssion", + "mi ssion", + "no tepad", + "', '", + "Ġfind str", + "Pre ference", + "off ice", + "Ġcredential s", + "Go ogle", + "Sche duled", + "imi katz", + "( \"#{", + "4 4", + "; }", + "M EM", + "Z E", + "[ $", + "b ack", + "c a", + "d f", + "j se", + "Ġ out", + "Ġ local", + "er ber", + "me ss", + "Ġ$ {", + "file s", + "ur ation", + "de d", + "Ġc md", + "con f", + "is h", + "pl ace", + "ir st", + "15 6", + "En vir", + "Ġw e", + "ig n", + "Ġex p", + "Add ress", + "bo se", + "Ġst op", + "Directory Services", + "open ssl", + "Des cription", + "SI ZE", + "Rec ur", + "inst all", + "who ami", + "Envir onment", + "\" }", + ". \\", + "/ *", + "/ &&", + "0 9", + "2 7", + "2 9", + "B uild", + "F e", + "O pen", + "P R", + "P er", + "P ack", + "P Word", + "T er", + "a em", + "a ction", + "d en", + "d Invoke", + "d irectory", + "f tp", + "g g", + "g ory", + "i a", + "l App", + "p ing", + "u me", + "} :#{", + "Ġ F", + "Ġ G", + "Ġ U", + "Ġ e", + "Ġ x", + "Ġ on", + "Ġ name", + "Ġ as", + "Ġ User", + "Ġ HKEY", + "Ġ Protection", + "re lease", + "at ure", + "st at", + "ar ness", + "&& #", + "an g", + "ri b", + "se nt", + "user s", + "Re f", + "yp ass", + "Ġ{ }", + "Ġ{ $_.", + "ra y", + "ra ph", + "pl it", + "pro gram", + "pro duct", + "Propert ies", + "id den", + "ap er", + "sudo ers", + "`\" )\";$", + "Test Args", + "Ġg roup", + "ĠP lease", + "ption al", + "app end", + "Exp and", + "Program s", + "ĠM enu", + "Admin istrator", + "Full Path", + "Ru le", + "uf w", + "ccess full", + "InstallUtil Assembly", + "Ident ity", + "Mode l", + "An dInvoke", + "ĠOutput Assembly", + "Memb er", + "office Product", + "Scheduled Task", + "Recur se", + "Build AndInvoke", + "PR OF", + "aem on", + "ccessfull y", + "BuildAndInvoke InstallUtilAssembly", + "- -", + "B A", + "F irewall", + "M af", + "P ublic", + "R andom", + "X ml", + "a ct", + "h and", + "i am", + "m m", + "m imikatz", + "o unt", + "r er", + "r cl", + "v c", + "Ġ String", + "Ġ value", + "le d", + "le vel", + "ex tension", + "lo se", + "reg sv", + "com p", + "un ction", + "sc ht", + "yp ted", + "ch mod", + "ht a", + "ĠD irectory", + "ĠD Word", + "Sec ond", + "Ġw in", + "ry pt", + "Power Sp", + "Power View", + "ĠP ack", + "ask s", + "ck et", + "app data", + "registry Value", + "HIST IG", + "Ġ. \\", + "ance d", + "ĠRe d", + "cr ypted", + "fo x", + "str atus", + "tr ue", + "PowerShell Maf", + "\", \"", + "li ke", + "att rib", + "def ault", + "ilently Continue", + "Param et", + "NO RE", + "cate gory", + "contain er", + "Vari able", + "HO ME", + "Vir tual", + "rcl one", + "scht asks", + "PowerSp loit", + "HISTIG NORE", + "PowerShellMaf ia", + "\" );", + "' t", + "( (", + ". /", + "2 1", + "9 4", + ": \"#{", + "; #{", + "A ctive", + "E T", + "G V", + "I C", + "M y", + "S ave", + "W ar", + "\\ {", + "a ke", + "b i", + "d i", + "d rive", + "g t", + "g al", + "n ode", + "o red", + "p aper", + "v f", + "Ġ B", + "Ġ un", + "Ġ Atomic", + "Ġ temp", + "Ġ process", + "Ġ admin", + "Ġ Enable", + "Ġ No", + "in al", + "re ak", + "te ul", + "ile d", + "ar k", + "de bu", + "an ge", + "}\" )", + "ol ume", + "Ġt ry", + "ac ce", + "ac cess", + "pt y", + "soft ware", + "Ġs ystem", + "ter ms", + "ir m", + "new Password", + "new Cred", + "su lt", + "Out File", + "ire fox", + "15 55", + "En coded", + "min al", + "Sc reen", + "Power Sharp", + "Ġp rer", + "sp ool", + "ma il", + "set uid", + "Ġre quest", + "Ġre quired", + "Ġst ored", + "InstallerAssembly FullPath", + "Argument s", + "Ġsh ow", + "cont ro", + "NE T", + "Inter net", + "Min imum", + "ĠAD D", + "Fe ature", + "Ter minal", + "regsv r", + "terms rv", + "$ _", + ") );", + ", $", + "8 0", + "8 9", + "; \"", + "F S", + "F WR", + "H el", + "J oin", + "L aunch", + "M L", + "M ail", + "M ax", + "Q B", + "S P", + "d isable", + "f d", + "g ine", + "i v", + "k ip", + "n i", + "p u", + "p teul", + "w c", + "x s", + "x y", + "y an", + "{ $", + "Ġ <", + "Ġ L", + "Ġ j", + "Ġ are", + "Ġ list", + "Ġ Create", + "Ġ Group", + "Ġ att", + "Ġ use", + "in s", + "le ction", + "le ng", + "ex ce", + "ex ample", + "ar am", + "lo b", + "lo ok", + "Ġc an", + "Ġc ode", + "pt ure", + "\"; ;$", + "if i", + "il ver", + "ke d", + "is play", + "Ġs ub", + "up date", + "pl ink", + "ap i", + "ap plication", + "system ctl", + "ent er", + ";; ;", + "Aut o", + "bo dy", + "Log on", + "Ġ@ {", + "CO M", + "ĠRe move", + "Connect ion", + "On ce", + "On line", + "sec urity", + "Ġse d", + "View er", + "Up date", + "sv c", + "tra il", + "Rec on", + "ĠFor Each", + "bit s", + "EL N", + "IT ELN", + "Ag ent", + "gg er", + "debu g", + "acce pteul", + "FWR ITELN", + "Ġatt ack", + "leng th", + "accepteul a", + "\" ))", + "( ).", + ". \"", + "0 11", + "3 4", + "B SD", + "C ut", + "E C", + "F E", + "F ree", + "F irefox", + "M D", + "N P", + "O L", + "O per", + "P word", + "S u", + "U ri", + "W S", + "W Script", + "c script", + "c ted", + "d d", + "d ap", + "f ilter", + "f irm", + "g cloud", + "i al", + "i ss", + "l m", + "o d", + "o ur", + "o ptional", + "r b", + "w b", + "} @#{", + "Ġ V", + "Ġ al", + "Ġ Test", + "Ġ key", + "Ġ Server", + "Ġ Join", + "er y", + "re sh", + "re sult", + "te cted", + "on ate", + "on ly", + "Ġ\" (", + "st op", + "me m", + "en c", + "de l", + "Pro file", + "user principal", + "Ġc l", + "Ġc p", + "Ġc ut", + "Name space", + "St ore", + "un k", + "ate d", + "mo unt", + "Ġf irewall", + "all ow", + "Set tings", + "ĠD isable", + "ĠĠĠĠ ĠĠĠĠĠĠĠĠĠĠĠ", + "nti me", + "Com Object", + "Ġw here", + "Ad Find", + "object category", + "ĠI S", + "Ġp ass", + "11 37", + "set tings", + "ĠDef ault", + "Ġ@ {;", + "inter face", + "Ġde f", + "Not ice", + "ail ure", + "qui et", + "}. #{", + "clo se", + "Bo x", + "sys log", + "Cred s", + "ĠS ilentlyContinue", + ";}; ;$", + "Ġ~/ .", + "Qu ery", + "ev il", + "Mp Preference", + "Config uration", + "Ġad vf", + "Short Cut", + "Network Credential", + "Ver bose", + "row ser", + "Le gal", + "erber os", + "War ning", + "Free BSD", + "userprincipal name", + "Ġadvf irewall", + "Legal Notice", + ") '", + ") (", + "+ +", + "0 2", + "1 105", + "7 2", + "; %", + "A B", + "A S", + "B in", + "B lock", + "G ET", + "I F", + "M s", + "S E", + "S V", + "T ri", + "U T", + "W D", + "W all", + "W mi", + "_ ).", + "a W", + "a ys", + "a script", + "d ge", + "f i", + "f lag", + "m ap", + "n k", + "p riv", + "p arent", + "p onse", + "r d", + "r ame", + "r ac", + "s leep", + "s ize", + "s plit", + "t cp", + "t gt", + "u ac", + "u ps", + "x ll", + "z er", + "} ,", + "Ġ !", + "Ġ te", + "Ġ ;$", + "Ġ Ex", + "Ġ service", + "Ġ Service", + "Ġ open", + "Ġ CommandLine", + "er ro", + "Ġ- >", + "in f", + "Ġ\" #", + "ro ups", + "or g", + "al led", + "en code", + "ur ge", + "it or", + "it ch", + "ll er", + "Win dow", + "se ssion", + "Ġt ype", + "Ġc all", + "Ġc orrect", + "00 01", + "In fo", + "\"; }", + "\"; };", + "Ex tension", + "to uch", + "Ġs ilently", + "Ġs kip", + "ra ction", + "ter n", + "add ress", + "pro pert", + "pro xy", + "Ġb in", + "Ġb ash", + "Lo ad", + "AD SI", + "Ġw as", + "ĠC yan", + "start ing", + "}' ,", + "ĠI P", + "Ġa ws", + "Ġex ist", + "11 19", + "Class Name", + "Ġcreate d", + "Not ification", + "vi ew", + "cont inue", + "Web Client", + "Res ponse", + "macro Code", + "time out", + "iz ation", + "\"&& ./", + "ĠSet tings", + "ust om", + "class es", + "js on", + "Ġno body", + "tim er", + "val id", + "back up", + "ĠPack ages", + "Paramet ers", + "rame work", + "erro raction", + "Ġsilently continue", + "\" :", + "( `\"", + "( );$", + "* *", + "3 19", + "5 4", + "= $", + "A U", + "A AD", + "A fter", + "B y", + "D ate", + "F ramework", + "H t", + "I I", + "K C", + "L L", + "L sa", + "M S", + "M e", + "O T", + "P h", + "P RO", + "R L", + "S py", + "S end", + "T R", + "T ec", + "W ait", + "Z W", + "\\ \\", + "] .", + "a pture", + "c ut", + "e vent", + "g o", + "g ing", + "h v", + "h ile", + "k rb", + "l ow", + "m pt", + "m up", + "m achine", + "p ip", + "r andom", + "s k", + "t n", + "t s", + "t ry", + "v ss", + "x d", + "} :", + "} {", + "Ġ path", + "Ġ 00", + "Ġ id", + "Ġ Net", + "Ġ Security", + "Ġ Shell", + "Ġ eq", + "Ġ As", + "Ġ account", + "Ġ AzureAD", + "Ġ mod", + "Ġ Team", + "Ġ 99", + "Ġ ssh", + "Ġ Stop", + "Ġ iam", + "in vo", + "Ġ\" \\$", + "le ar", + "st orage", + "ic io", + "et ter", + "et onate", + "ut ion", + "ar mup", + "en crypted", + "file path", + "de st", + "dow n", + "Ġt icket", + "Con text", + "Con sent", + "Con firm", + "Ġ' #", + "Ġ' $", + "con nect", + "sc reen", + "ke ys", + "Ġ( [", + "is ten", + "ch unk", + "pro ject", + "ĠD is", + "ĠD WORD", + "log in", + "em pty", + "htt p", + ":// #{", + "ST ART", + "En v", + "Ġw ait", + "port s", + "port ing", + "}' ;", + "Ġto uch", + "local appdata", + "ru te", + "0000 0001", + "for mat", + "um b", + "Not After", + "sub net", + "Def ender", + "old value", + "Program Data", + "154 3", + "ED AC", + "Ġse lect", + "16 13", + "Bo dy", + "bu ild", + "doc ument", + "Full Name", + "Ru ntime", + "Download s", + "Sub string", + "task list", + "ĠH i", + "sy nc", + "Ġlocal group", + "mess age", + "156 2", + "Administrator s", + "Max imum", + "FE EDAC", + "NP PS", + "Oper a", + "Su ccessfully", + "Wall paper", + "propert y", + "Ht tp", + "Tec h", + "krb tgt", + "icio us", + "FEEDAC DC", + "\" '", + "\" );$", + "' \"", + "0 8", + "2 46", + "2 56", + "3 89", + "; .", + "; [", + "? {", + "A A", + "A G", + "A H", + "A nti", + "C N", + "C OR", + "C lose", + "D E", + "D ns", + "M achine", + "O S", + "P arent", + "S af", + "V olume", + "Z ip", + "[ ]", + "_ _", + "a v", + "a w", + "a z", + "a ption", + "a vi", + "b l", + "c ache", + "g p", + "h avi", + "i e", + "k ub", + "l nk", + "o u", + "p Y", + "p re", + "p as", + "p ack", + "q li", + "r f", + "r le", + "r sa", + "s w", + "s am", + "s ilver", + "t t", + "t ing", + "t icket", + "v anced", + "} `\"", + "Ġ 6", + "Ġ `", + "Ġ Name", + "Ġ domain", + "Ġ exec", + "Ġ Log", + "Ġ app", + "Ġ registry", + "Ġ Comp", + "Ġ rule", + "Ġ empty", + "re quired", + "re place", + "te ctor", + "on itor", + "Ġ\" `", + "le an", + "st ore", + "st ru", + "or mal", + "ex clu", + "ar ies", + "ad s", + "it ion", + "Ġc ert", + "00 0", + "\"; .\\", + "am ing", + "com mon", + "ke ep", + "Ġ( -", + "Get NetworkCredential", + "ch ange", + "Ġf unction", + "For Each", + "User init", + "net only", + "Ġb reak", + "ver y", + "ul ate", + "15 64", + "AD Search", + "Ġw ill", + "Ġw armup", + "Ad vanced", + "ĠC h", + "ĠC OM", + ".. .\";", + "Ġd id", + "Ġd etonate", + ")\" &&", + "cmd let", + "ms hta", + "ĠI mport", + "Ġth at", + "Ġex port", + "Add ins", + "Run Once", + "bo ard", + "ed ge", + "Ġ@ \";", + "Ro aming", + "um er", + "Ġ. /", + "Ġm achine", + "Ġm ust", + "Ġm iss", + "ĠT icket", + "Exec ution", + "Script s", + "Ġ} ;$", + "Account Password", + "Ġ\\ \"", + "cert util", + "win dow", + "macro File", + "Bo ok", + "Inter op", + "ak di", + "Doc ument", + "IN G", + "ĠW here", + "uname pass", + "105 9", + "aunch ctl", + "ob j", + "Ġch ang", + "mal icious", + "Provider s", + "Reg istry", + "Qu it", + "Ġpro ject", + "Expand Property", + "PROF IL", + "Second s", + "Encoded Command", + ";\" @", + "our nal", + "mem ber", + "Tri gger", + "rd rle", + "zer o", + "Ġte e", + "Ġskip ping", + "havi or", + "qli te", + "stru ctor", + "exclu ded", + "cmdlet s", + "edge Path", + "Ġmiss ing", + "akdi ag", + "rdrle akdiag", + "\" $", + "\" :\"", + "& `\"", + "' ;$", + "' ).", + ") {", + ") \";", + "* :", + "- ]", + "1 4", + "3 5", + "4 7", + "5 0", + "8 3", + "9 1", + "9 6", + ": ;", + "= /", + "= `", + "A M", + "A ND", + "C H", + "C P", + "C md", + "C ount", + "D P", + "D rive", + "E dge", + "F irst", + "G P", + "H and", + "I ST", + "I ME", + "L etter", + "M P", + "P ort", + "P ost", + "P os", + "R T", + "S m", + "T rust", + "W M", + "\\ `\"", + "] {", + "` &&", + "b G", + "b d", + "c s", + "c redential", + "d G", + "d s", + "d is", + "d ns", + "f ish", + "g ue", + "g ed", + "h arness", + "j ob", + "k ill", + "l ate", + "m ethod", + "m ark", + "n l", + "o es", + "p b", + "p f", + "p ac", + "p olic", + "p ower", + "p oint", + "p aram", + "p od", + "s end", + "s qlite", + "v ersion", + "v box", + "w w", + "w atch", + "x ls", + "y es", + "y nc", + "z L", + "Ġ u", + "Ġ reg", + "Ġ Microsoft", + "Ġ Invo", + "Ġ Process", + "Ġ EX", + "Ġ os", + "Ġ Installer", + "Ġ vb", + "Ġ Office", + "Ġ assembly", + "re sp", + "on ent", + "ut down", + "en g", + "en er", + "en se", + "en able", + "ad si", + "de tector", + "an el", + "ol low", + "name space", + "ri ver", + "he nt", + "Ġc opy", + "00 7", + "ect l", + "Con structor", + "In put", + ":\\ *.", + "if fer", + "ist er", + "ist ore", + "to ken", + "ch m", + "ch own", + "At t", + "Ġs ec", + "Ġs ame", + "To Consumer", + "mo de", + "Ġf ailure", + "Ġ{ };", + "Atomic User", + "File System", + "ra p", + "password s", + "new Value", + "new value", + "Cre ation", + "Sh are", + "Ġb y", + "Th umb", + "Com ms", + "AD FS", + "10 7", + "En gine", + "12 22", + "th en", + "sh adow", + "Inst alled", + "ls a", + "ls ass", + "Ġd iffer", + "HI S", + "host name", + "Sc an", + "Ar ch", + "Ġth row", + "Ġa fter", + "}\"; ;$", + "Protocol s", + "Ġp urge", + "cat ch", + "Run Services", + "Aut hent", + "Ch eck", + "App Id", + "ed it", + "Ġre t", + "ME NT", + "88 8", + "cation Method", + "Ġm atch", + "Ġm ethod", + "ĠT HIS", + "be at", + "=\" $", + "Ġde tected", + "execut or", + "Not ify", + "ff er", + "Account Name", + "ws hell", + "CL C", + "var i", + "decode d", + "Sp ray", + "Local Machine", + "Ġl dap", + "Ġl aunchctl", + "Filter ToConsumer", + "bu ffer", + "Ġh as", + "Ġh istory", + "Ġh arness", + "Child Path", + "Un istore", + "Mal doc", + "ld ap", + "Policy Ref", + "cloud watch", + "Excel Reg", + "Role Member", + "Download String", + "rule s", + "Ġen able", + "*\" };", + "HT ML", + "search er", + "Resource Access", + "30 319", + "IO N", + "22 888", + "Tr ue", + "Tr ans", + "clu de", + "Ġsp ec", + "df b", + "Ġexp ected", + "29 8", + "Ġx xd", + "ĠOutputAssembly Directory", + "ĠOutputAssembly FileName", + "registryValue Name", + "Ġun load", + "ĠGroup PolicyRef", + "exce lApp", + "resh Time", + "Ġpass wd", + "Ġdef ault", + "uac me", + "Ġbin Path", + "AAD Int", + "NPPS py", + "kub ectl", + "lean up", + "ĠCOM MENT", + ";\"@ ;}", + "Hand ler", + "\\`\" &", + "gue st", + "pac ked", + "ĠInvo cationMethod", + "resp onse", + "onent s", + "adsi searcher", + "Thumb print", + "Ġdiffer ent", + "ExcelReg Path", + "HTML Application", + "ĠGroupPolicyRef reshTime", + "! (", + "! /", + "' ;;", + ") [", + ") \\", + "* \\", + ", #{", + "/ $", + "0 12", + "5 3", + "9 0", + "; &", + "; @", + "A udit", + "B e", + "B ypass", + "C ustom", + "D ump", + "E nt", + "F OR", + "G raph", + "H E", + "H ound", + "K erberos", + "L D", + "L ower", + "L eng", + "M onitor", + "N on", + "O ld", + "O rac", + "P ass", + "R Y", + "R DP", + "S H", + "S ilent", + "S ign", + "T cp", + "U N", + "V E", + "Y ou", + "Z a", + "\\ \";", + "\\ *.", + "] ).", + "_ ';", + "a es", + "a wn", + "b ot", + "b ytes", + "c i", + "c te", + "c ab", + "c orrect", + "d mp", + "e qu", + "e us", + "f s", + "g uid", + "h h", + "h ash", + "k ir", + "l ink", + "m c", + "o ok", + "p e", + "r ue", + "t al", + "u ff", + "v is", + "w ith", + "x l", + "x lApp", + "Ġ 4", + "Ġ :", + "Ġ R", + "Ġ r", + "Ġ ps", + "Ġ sc", + "Ġ PathToAtomicsFolder", + "Ġ Manager", + "Ġ Account", + "Ġ 86", + "Ġ import", + "Ġ here", + "Ġ update", + "Ġ obj", + "in ject", + "in fo", + "re ssion", + "re move", + "re ts", + "on g", + "le g", + "et s", + "or un", + "nt lm", + "al c", + "al con", + "en ame", + "&& /", + "ur n", + "ur er", + "an y", + "name d", + "Ġc ount", + "St orage", + "In proc", + "Ex it", + "Ex tra", + "Ex ample", + "Ex change", + "con n", + "il ity", + "to tal", + "is o", + "is ite", + "ub eus", + "Re lease", + "Re porting", + "ch rome", + "ch eck", + "Ġs ys", + "Ġs ave", + "To Lower", + "do h", + "do t", + "New Password", + "Ġf irst", + "red team", + "For ms", + "User Name", + "able s", + "ip board", + "Ġb uild", + "cl i", + "Th read", + "AD User", + "AD AccountPassword", + "10 6", + "10 27", + "12 3", + "age nt", + "Credential s", + "test dir", + "Process Exit", + "ry ption", + "Ġin t", + "Ġin correct", + "ĠC ert", + "`\" \";$", + ".. .", + "Ġd ir", + "Ġd isable", + "Ġd isplay", + "rin t", + "col lection", + "object Class", + "USER PROF", + "Ġg oes", + "Ġth is", + "Dis k", + "Error Code", + "ĠP anel", + "EX E", + "os k", + "os ascript", + "Ġ}; };", + "Convert To", + ")) ;$", + "Ġuser add", + "Ġst ore", + "Ġst ream", + "(\" {", + "Ġ]; &&", + "Mo d", + "Ġfile s", + "ĠConvert From", + "sub domain", + "Ġ\\ ;", + "Ġ\\ ;&&", + "Ġsh are", + "Ġsh adow", + "Create Object", + "Create Process", + "Def init", + "ĠA RT", + "ServiceP rincipal", + "De vice", + "logon server", + "Res ult", + "Sp ec", + "aut o", + "per mission", + "bu cket", + "Team Viewer", + "ĠSet up", + "Ġrun ning", + "Method Name", + "HISTFILE SIZE", + "Inter nal", + "doc x", + "Task s", + "ld if", + "RO OT", + "Ġlog s", + "def ense", + "cloud trail", + "105 3", + "space end", + "Ġls ass", + "Principal Name", + "uf act", + "Reg ister", + "Cim Method", + "Cim Session", + "Cim Instance", + "riv es", + "contain s", + "HT A", + "Short cut", + "let ter", + "SC II", + "Ġno tepad", + "ZX N", + "exp and", + "ca le", + "mess ages", + "Per mission", + "hand ler", + "mm y", + "Virtual Box", + "}\") {;", + "Ġsystem ctl", + "PowerSharp Pack", + "PowerSharp Bin", + "Ġprer eq", + "Ġprer equ", + "termsrv Dll", + "Hel p", + "look up", + "ifi ed", + "svc host", + "bits admin", + "Ms ol", + "Wmi Object", + "Extension s", + "Notification s", + "invo cation", + "Tech ni", + "Dns Name", + "ĠComp onents", + "Ġchang ed", + "Arch ive", + "Ġspec ify", + "Be havior", + "Leng th", + "Old Password", + "Orac le", + "Silent ProcessExit", + "_'; ;$", + "cte t", + "kir bi", + "with spaceend", + "Inproc Server", + "testdir withspaceend", + "USERPROF ILE", + "Definit ion", + "ufact urer", + "PowerSharpBin aries", + "Ġprerequ isite", + ") ,", + ") ).", + "/ '", + "/ .", + "1 003", + "6 55", + "8 1", + ": _).", + "= \"#{", + "? \\", + "@ ('", + "A l", + "A cl", + "A CL", + "A IN", + "B I", + "B ack", + "B vc", + "C E", + "C lear", + "C aption", + "D B", + "D aemon", + "F alse", + "F lag", + "G R", + "G uid", + "G ener", + "I H", + "I f", + "M at", + "M ar", + "N S", + "N l", + "N ormal", + "O ST", + "O ctet", + "P at", + "P art", + "R aw", + "S w", + "S ys", + "S co", + "S ize", + "S ync", + "T arget", + "T CP", + "U A", + "W ith", + "W PD", + "Z one", + "\\ ;", + "b lob", + "b rute", + "c b", + "c he", + "c sc", + "d mi", + "e ed", + "f a", + "f rom", + "g istry", + "h c", + "h k", + "h ive", + "h anced", + "i B", + "i pt", + "i um", + "j ack", + "k er", + "k it", + "l ibrary", + "l aunch", + "m b", + "m y", + "m icrosoft", + "m sc", + "m atch", + "o Stream", + "p ol", + "r ic", + "s or", + "t b", + "t run", + "t ree", + "u x", + "u ard", + "w e", + "w ar", + "w ll", + "w mi", + "y B", + "} /", + "Ġ 8", + "Ġ E", + "Ġ Path", + "Ġ Windows", + "Ġ );", + "Ġ server", + "Ġ Admin", + "Ġ Un", + "Ġ rm", + "Ġ Variable", + "Ġ schtasks", + "Ġ application", + "Ġ Auto", + "Ġ ?{", + "Ġ zero", + "in ets", + "re at", + "re source", + "te ll", + "te ch", + "on t", + "at er", + "at ic", + "le ted", + "st a", + "st or", + "st uff", + "or ig", + "Ġ$ _", + "ser vices", + "}\" };", + "}\" );", + "Path to", + "Pro g", + "Pro ject", + "Pro mpt", + "ho me", + "ri m", + "user add", + "user pass", + "user profile", + "he d", + "Ġt ime", + "Ġt cp", + "Ġt rue", + "St atus", + "In clude", + "ps exec", + "co very", + "am AccountName", + "vic tim", + "sc r", + "Ġ> /", + "is hed", + "Get Type", + "Re mo", + "Re start", + "as ion", + "To Base", + "mp ire", + "net stat", + "ĠD C", + "log s", + "log host", + "ip Add", + "Sh ow", + "Ġ1 0", + "Ġb atch", + "Ġb ypass", + "Th is", + "Th ru", + "Ġ[ -]", + "ire s", + "Start Up", + "du mmy", + "En hanced", + "sh al", + "sh ark", + "NT RO", + "Ġin to", + "im g", + "im age", + "ĠC opy", + "Contro ller", + "Man ufacturer", + "Ġ; {;", + "Ġd sc", + "Ġd ata", + "Ġd one", + "us ion", + "cred stuff", + "Cl ipboard", + "run as", + "Ġp w", + "Ġp er", + "11 15", + "11 40", + "sp awn", + "arget Instance", + "set hc", + "ĠP rincipal", + "Ġ}; }", + "bo ot", + "rom ium", + "Ġpassword s", + "ption s", + "dec md", + "Time Providers", + "app le", + "app cmd", + "SY SV", + "HIST CO", + "HIST SIZE", + "ĠT argetInstance", + "AzureAD User", + "AzureAD ServicePrincipal", + "mod ify", + "Ġ\\ \\", + "ĠRe gistry", + "cert ificate", + "Ġ* .", + "ail y", + "Sp ace", + "Bo ot", + "Ġsu ccessfully", + "Ġcon nect", + "Ġh idden", + "print f", + "Ġ`\" $", + "Group Member", + "vir us", + "vir tual", + "ĠW Script", + "lock out", + "Temp late", + "bat startup", + "ond s", + "proc exp", + ":\" ([", + "vbs startup", + "]\" $_", + "ĠFor mat", + "Ġ\"* **", + "Ġch mod", + "Event Consumer", + "Comp at", + "Param Vari", + "All ow", + "ATH HTMLApplication", + "IP C", + "ev asion", + "ssl Stream", + "Ident ifi", + "task kill", + "OM AIN", + "Resource s", + "Ġk list", + "Le vel", + "jse startup", + "ign ore", + "Per f", + "act iv", + "hand le", + "Virtual ization", + "Ġtemp admin", + "Ġrequest s", + "Launch Daemon", + "xs l", + "COM Object", + "Connection s", + "ĠV BA", + "LegalNotice Text", + "LegalNotice Caption", + "KC d", + "random Bytes", + "Ġ99 99", + "ĠHi de", + "krbtgt SID", + "Saf e", + "tt y", + "Ġcert ificate", + "umer ate", + "Interop Services", + "PROFIL ER", + "polic y", + "pod man", + "zL n", + "ĠEX IST", + "Input Object", + "Authent ication", + "vari ation", + "Monitor ing", + "Pass Thru", + "leg ate", + "orun s", + "Exchange Online", + "Release ComObject", + "HTA FilePath", + "Mat che", + "Mar shal", + "Pat tern", + "Sco pe", + "WPD T", + "ipt ables", + "Ġ?{ $_.", + "inets rv", + "Pathto AtomicsFolder", + "ipAdd r", + "NTRO L", + "credstuff userpass", + "SYSV OL", + "HISTCO NTROL", + "]\"$_ \").", + "ParamVari ation", + "Identifi er", + "LaunchDaemon s", + "Matche s", + "! ]", + "\" %", + "( -", + "( #{", + "( \\\"", + "+ /", + ", \"", + "/ \"$", + "2 3", + "2 4", + "5 9", + "9 7", + ": %", + "; \"#{", + "= *", + "> >", + "A N", + "A Z", + "B ind", + "B rowser", + "C F", + "C R", + "C m", + "C ap", + "C ook", + "D LL", + "D CLC", + "D OMAIN", + "E S", + "E ST", + "E mpire", + "F a", + "G A", + "H e", + "H istory", + "I Server", + "J y", + "K S", + "L E", + "L in", + "L ast", + "M T", + "M u", + "M ap", + "M FilePath", + "O P", + "P Y", + "P s", + "P rint", + "R C", + "R I", + "S A", + "S o", + "S amAccountName", + "T P", + "T able", + "T MP", + "U RL", + "V B", + "V al", + "V ER", + "V IServer", + "W O", + "] $", + "] '", + "a ad", + "a use", + "b k", + "b as", + "b yte", + "c u", + "c yp", + "c urrent", + "c ap", + "d a", + "d om", + "d one", + "d river", + "f name", + "f unction", + "f alcon", + "h Z", + "h ru", + "i Window", + "k K", + "k erberos", + "l Y", + "l u", + "l im", + "l ib", + "m V", + "m t", + "m ut", + "n ings", + "n objectClass", + "o ver", + "o ast", + "p i", + "p ost", + "p ublic", + "p pid", + "p df", + "s n", + "s on", + "s ample", + "t ar", + "v sc", + "v able", + "w ait", + "w ays", + "z d", + "z ill", + "} #{", + "} };", + "} ))", + "Ġ )", + "Ġ 7", + "Ġ ^", + "Ġ y", + "Ġ lo", + "Ġ File", + "Ġ unt", + "Ġ ms", + "Ġ atomic", + "Ġ Add", + "Ġ Word", + "Ġ Connect", + "Ġ NUL", + "Ġ Environment", + "Ġ access", + "Ġ _).", + "Ġ view", + "Ġ keys", + "Ġ __", + "re q", + "re cur", + "re ading", + "re boot", + "Ġ\" {", + "ro k", + "st atus", + "st hru", + "or iz", + "nt ax", + "ut l", + "ss age", + "ex plorer", + "ce nt", + "en gine", + "Ġ= =", + "ad user", + "de o", + "de s", + "de sk", + "it le", + "lo cale", + "}\" '", + "}\" .", + "}\" ;;", + "Pro files", + "ri g", + "se lect", + "user mod", + "he ad", + "he el", + "Ġt ask", + "put ers", + "Ġc ache", + "Ġc leanup", + "Ġc alc", + "Con sole", + "Windows PowerShell", + "Windows Update", + "pt t", + "\"; #", + "\"; &", + "\"; ;#", + "Ġ' %", + "Ġ' '", + "Ġ' (", + "Ġ' *", + ":\\ \\", + "Ex port", + "ation s", + "System Re", + "ist ing", + "Ġ( !(", + "to console", + "Get String", + "Re quired", + "ch ild", + "ch romium", + "ers isten", + "Ġs im", + "To Load", + "); {", + "); ;$", + "ag ne", + "output file", + "ra ct", + "ir y", + "ot her", + "Current User", + "pro p", + "pro ps", + "log file", + "log toconsole", + "id ump", + "Sh adow", + "REG ION", + "Ġ1 2", + "Ġb ytes", + "ver bose", + "ire ction", + "domain contro", + "AD Internal", + "10 1", + "10 46", + "qu es", + "Ġw heel", + "Net Event", + "sh utdown", + "system root", + "Ġin st", + "Ġin ter", + "ĠC apture", + "ig h", + "ig ht", + "`\" ,", + "`\" `", + "Ġd on", + "Ġd aily", + "us ing", + "Assembly Name", + "Password Profile", + "Service Dll", + "Ġto o", + "Ġg olden", + "local host", + "Ġa ut", + "ext ract", + "Ġp f", + "Ġp aram", + "11 10", + "Az Account", + "sp ec", + "ma x", + "Log ging", + "Ġre ad", + "AT OM", + "um ber", + "vm ware", + "Mo ve", + "AzureAD Application", + "Directory Search", + "Script Engine", + "Create Instance", + "Def end", + "ĠA ND", + "ĠA WS", + "ĠA ADInternal", + "On e", + "On ly", + "sec edit", + "vb a", + "arch ive", + "fo und", + "her text", + "De legate", + "Vi deo", + "16 12", + "16 09", + "ĠM S", + "aut oruns", + "work ing", + "Local User", + "Ke ys", + "Ġl ong", + "() '", + "() );", + "() )\"&&", + "') |", + "NA RY", + "tr ans", + "Cert Store", + "No Restart", + "Un it", + "tp Server", + "AR GET", + "tra p", + "LOC R", + "IG Z", + "auth oriz", + "Destination Path", + "hel per", + "Computer Name", + "Default s", + "LOCAL APPDATA", + "EL L", + "Ġls mod", + "ache util", + "Find One", + "From Base", + "own er", + "Comp iled", + "ĠWin Defend", + "ATH Compiled", + "ev t", + "Ġen crypted", + "inst ance", + "audit pol", + "man ip", + "ĠO pen", + "exfil path", + "Ġad ded", + "Real time", + "Network Provider", + "Ġ\"\\ \\", + "Image Path", + "sy ntax", + "Preference s", + "erber oast", + "Ġexp iry", + "Pack age", + "ĠG olden", + "Properties ToLoad", + "-- --", + "GV u", + "drive Letter", + "ĠB yte", + "contro l", + "Feature Name", + "Hel lo", + "ĠL ast", + "Ġj ust", + "Ġj ournal", + "Ġuse d", + "lob al", + "EC T", + "Firefox Creds", + "enc ryption", + "Ġcl ass", + "flag s", + "Ġ! =", + "ĠEx port", + "Window St", + "}', '", + "Me ssage", + "Ph ant", + "Ph ish", + "Send Keys", + "pip e", + "pip es", + "ĠDis playName", + "pY yB", + "pas sthru", + "required Graph", + "Execution Policy", + "Book mark", + "CH MFilePath", + "GP O", + "`&& $", + "rap hic", + "newValue Name", + "Ġret urn", + "Trans port", + "Sign ed", + "fs util", + "named pipes", + "Extra ct", + "dot net", + "106 9", + "Disk Image", + "Techni ques", + "BI NARY", + "Sw itch", + "Zone Map", + "hk lm", + "ĠAdmin s", + "orig inal", + "Ġ$_ ;", + "GetType From", + "aad Application", + "bas ename", + "cyp hertext", + "falcon d", + "iWindow Pos", + "zill a", + "Ġunt il", + "SystemRe store", + "child item", + "ersisten ce", + "domaincontro ller", + "ATOM IC", + "DirectorySearch er", + "ĠAADInternal s", + "Delegate Execute", + "CertStore Location", + "ARGET PID", + "authoriz ed", + "ATHCompiled Help", + "FirefoxCreds Location", + "requiredGraph Access", + "Bookmark s", + "\" ]", + "\" ')", + "% ;", + "' re", + "' &&", + "( ))", + "( ([", + ". $", + "/ %", + "1 7", + "1 000", + "2 54", + "3 9", + "4 9", + "5 2", + "5 09", + "6 0", + "6 2", + "6 01", + "7 7", + "7 8", + ": #", + ": (", + "A a", + "A ID", + "A SCII", + "B C", + "B E", + "B U", + "B lo", + "C enter", + "D S", + "D at", + "D word", + "D ays", + "E v", + "F A", + "F in", + "G I", + "G roups", + "H H", + "H J", + "H ash", + "H idden", + "I i", + "K EY", + "L dap", + "M C", + "M ac", + "M ill", + "M AND", + "M cs", + "N ode", + "N umber", + "O N", + "O f", + "O w", + "O ptional", + "O rig", + "P V", + "P X", + "P ip", + "P wd", + "P owershell", + "P UT", + "P AND", + "Q L", + "Q U", + "Q g", + "R U", + "R V", + "R t", + "R ubeus", + "R AID", + "S K", + "S U", + "S up", + "S im", + "S el", + "S EL", + "S plit", + "T N", + "T S", + "T en", + "T ARGETPID", + "U g", + "U l", + "U s", + "V ID", + "V BA", + "W I", + "W ow", + "W ire", + "W ork", + "X J", + "X N", + "Z G", + "[ ^", + "\\ /", + "] ;$", + "] ($", + "] *\\", + "] :\"([", + "b b", + "b c", + "b n", + "b rowser", + "c C", + "c v", + "c us", + "c sv", + "d C", + "d n", + "d Time", + "f ake", + "f Signed", + "g a", + "g ra", + "g raph", + "h ing", + "h up", + "h ings", + "h idden", + "i que", + "j sc", + "j ournal", + "k ext", + "k ld", + "l xll", + "l isten", + "m yp", + "m Pwd", + "n n", + "n ected", + "o ve", + "o ot", + "o ul", + "p Z", + "p k", + "p or", + "p ri", + "p grep", + "p ool", + "q win", + "q bot", + "r t", + "s b", + "s x", + "s en", + "s db", + "s lookup", + "t rust", + "u c", + "u es", + "u do", + "u age", + "u init", + "v env", + "w L", + "w er", + "w script", + "w evt", + "y le", + "z ZX", + "z Cm", + "{ \"", + "} :$", + "Ġ q", + "Ġ an", + "Ġ In", + "Ġ At", + "Ġ ab", + "Ġ all", + "Ġ env", + "Ġ script", + "Ġ Install", + "Ġ username", + "Ġ string", + "Ġ url", + "Ġ Use", + "Ġ AtomicTest", + "Ġ Key", + "Ġ role", + "Ġ EL", + "Ġ End", + "Ġ Enabled", + "Ġ ans", + "Ġ Administrator", + "Ġ api", + "Ġ Update", + "Ġ Query", + "Ġ json", + "Ġ valid", + "Ġ http", + "Ġ Administrators", + "Ġ Zip", + "Ġ Execution", + "Ġ vis", + "Ġ SYSVOL", + "Ġ other", + "er ase", + "er ror", + "in i", + "re s", + "re load", + "re set", + "re quest", + "re ference", + "Ġ\" .", + "at tr", + "Ġ/ #{", + "ic al", + "ic ac", + "et er", + "et hings", + "ec es", + "ec onds", + "or s", + "me ga", + "nt ds", + "al t", + "al ity", + "al th", + "tem pt", + "file Name", + "file Content", + "file Extensions", + "Ġ= [", + "ur i", + "ad e", + "ad ump", + "de scription", + "it er", + "it ter", + "lo ud", + "lo cation", + "an ization", + "}\" \"", + "}\" /", + "Pro tected", + "Win Word", + "se d", + "Ġc apture", + "Ġc bd", + "00 9", + "Name Space", + "ect ion", + "es x", + "In it", + "Windows Firewall", + "Windows Optional", + "co ok", + "der Spec", + "com Ms", + "art Screen", + "if name", + "out file", + "ation al", + "il y", + "System Up", + "sc si", + "Ġ( '", + "Ġ( ;", + "ain text", + "is econds", + "Get Bytes", + "ch ain", + "ers on", + "}; #{", + "Ġs hell", + "); #", + "Ġf ull", + "Ġf lag", + "Ġf ake", + "output Zip", + "ab l", + "ab ase", + "ab ility", + "all y", + "all th", + "Set up", + "add s", + "pl aintext", + "Object Guid", + "For mat", + "User Agent", + "User PrincipalName", + "ht ml", + "able Assembly", + "net work", + "ĠD e", + "ĠD omain", + "ĠD im", + "ĠĠĠĠ ĠĠĠĠĠ", + "Soft RAID", + "Ġadd ress", + "em ond", + "}&& $", + "64 32", + "Out look", + "Ġb s", + "Ġb ack", + "Ġb yte", + "Ġb lock", + "Ġb rute", + "cl ip", + "cl usion", + "Ġ[ !]", + "ment s", + "ST OP", + "ul n", + "15 7", + "15 72", + "service Principal", + "10 86", + "qu ality", + "Ġw rite", + "Ġw hile", + "12 0", + "12 7", + "Ad mPwd", + "th ing", + "th resh", + "Net Firewall", + "age Location", + "Process Un", + "ent ry", + "ls et", + "ls adump", + "ĠC lose", + "ĠC enter", + "etc ap", + "%\\ #{", + "Ġ; #", + "Ġd ec", + "ind ex", + ")\" ))", + "cmd key", + "cred z", + "cred NotAfter", + "}' ;$", + "}' \";", + "ms build", + "ĠI N", + "Ġg roups", + "local group", + "Ġa ction", + "ext rac", + "Dis allow", + "Dis connect", + "Power P", + "Ġ&& #", + "Protocol Defaults", + "Ġp ublic", + "Az Role", + "ĠSystem d", + "Ġn slookup", + "ult i", + "Add Days", + "ĠP OST", + "EX PAND", + "key Value", + "Aut h", + "Ġ}; ;", + "bo ok", + "Log Me", + "wd App", + "Ġuser mod", + "Ġre al", + "Ġst ate", + "Ġst atus", + "Ġst atic", + "for m", + "Ġ@ (\"", + "registry Key", + "Exp loit", + "CUR IT", + "account s", + "Mo unt", + "Mo zilla", + "end or", + "Content s", + "Use dTime", + "AzureAD Directory", + "Exec Start", + "Script Block", + "gn ition", + "Account Management", + "Domain Name", + "Ġof f", + "ĠRe quired", + "Access ib", + "Access Manager", + "Access Rule", + "cert NotAfter", + "ĠA ll", + "sec ond", + "sec rets", + "Ġ* **", + "Disable Anti", + "FILE S", + "Application s", + "encoded Data", + "Vi ableAssembly", + "16 10", + "ĠM IME", + "root kit", + "Fo cus", + "NE W", + "Sp ring", + "Local Admin", + "Ke ep", + "time s", + "time st", + "}. \";", + "Ġl ine", + "team view", + "Explorer Sync", + "Filter Args", + "\\\" \"", + "\\\" );", + "no hup", + "CommandLine Paramet", + "CommandLine Switch", + "per l", + "Ġsu ccess", + "SI GI", + "Ġ5 00", + "ific Parent", + "PowerShell CommandLineParamet", + "Un install", + "Ġ`\" #{", + "doc Path", + "Off set", + "IG F", + "RO M", + "UL T", + "Ġ\"\" \"", + "Ġlog in", + "bit map", + "Ġ3 0", + "Computer System", + "item property", + "ob f", + "Ġdo es", + "Ġch own", + "Find All", + "ng rok", + "ten ant", + "Download File", + "ATH ProcessUn", + "ATH PowerShellCommandLineParamet", + "Consumer Args", + "IP ersistence", + "Sub domain", + "Sub scription", + "audit d", + "man age", + "ĠO ptions", + "subscription s", + "Certificate s", + "AtomicRedTeam T", + "VM Host", + "read y", + "ZX I", + "rust desk", + "156 0", + "/* /", + "ĠF F", + "ĠF ROM", + "ĠG raph", + "ĠU RL", + "ang uage", + "sent utl", + "Identity Model", + "vc iB", + "comp ress", + "comp iled", + "ĠPack ageLocation", + "cket s", + "attrib ute", + "Ġadmin istrator", + "ĠEnable Firewall", + "inal Command", + "access Rule", + "Encoded Arguments", + "Ġrequest ing", + "contro lset", + "Minimum ViableAssembly", + "Feature s", + "Launch Agent", + "iv ate", + "Ġare n", + "ĠCreate Object", + "exce lxll", + "example Path", + "Ġsub tree", + "COM MAND", + "od Hound", + "Ġal ways", + "Ġal ready", + "Ġdef ender", + "Query Type", + "++ )", + "AB LE", + "AS S", + "UT F", + "flag Path", + "priv ate", + "\";}; ;$", + "Ġexist s", + "Ġexist ing", + "MS HTAFilePath", + "Spy ware", + "Spy Net", + "hv IGF", + "vss admin", + "Consent Store", + "Consent Prompt", + "chunk Size", + "login window", + "subnet Substring", + "ĠHi jack", + "cache filename", + "pas te", + "sw itch", + "Ġ6 0", + "Ġapp pool", + "Document s", + "&`\" \\", + "Sm artScreen", + "WM I", + "WM IPersistence", + "bG x", + "dis k", + "nl test", + "pf x", + "send back", + "ww w", + "Ġvb Normal", + "Att ach", + "Ġsec urity", + "107 1", + "RunServices Once", + "FilterToConsumer Args", + "FilterToConsumer Bind", + "response Body", + "ĠGroupPolicyRefreshTime Offset", + "LD AP", + "Non Package", + "hash cat", + "Ġr sync", + "Ġsys log", + "Mod ification", + "Behavior Admin", + "655 34", + "Back up", + "Bvc GVu", + "DB Location", + "ker brute", + "my T", + "trun cate", + "resource Access", + "Prog ID", + "Remo vable", + "Enhanced Notifications", + "img Location", + "Ġdsc l", + "Template s", + "Compat Dat", + "activ ator", + "KCd lY", + "ĠHide SC", + "Safe Boot", + "zLn BvcGVu", + "(\\\" $", + "/\"$ {", + "Cap ability", + "Ps Exec", + "current controlset", + "dom a", + "lim it", + "mut able", + "pi eces", + "req Permission", + "cent os", + "NetEvent Session", + "Ġinter face", + "Ġparam eter", + "IGZ vciB", + "manip ulate", + "Ġ\"\\\\ ?\\", + "ĠLast UsedTime", + "Transport Agent", + "Blo odHound", + "HH FilePath", + "Mill iseconds", + "Orig inalCommand", + "Pip e", + "Sel fSigned", + "SEL ECT", + "Ten ant", + "Ul tra", + "gra nt", + "graph SP", + "kld stat", + "oul d", + "qwin sta", + "wevt util", + "zZX J", + "}:$ {", + "ĠAt tempt", + "Ġab ove", + "ĠEL SE", + "Ġans wer", + "ĠZip File", + "Ġvis udo", + "icac ls", + "ethings x", + "Protected View", + "Ġcbd aemon", + "WindowsOptional Feature", + "derSpec ificParent", + "comMs Xml", + "SystemUp Time", + "allth ethingsx", + "thresh old", + "LogMe In", + "CURIT Y", + "Ġ*** \"&&", + "teamview er", + "CommandLineSwitch Type", + "SIGI NT", + "ATHProcessUn derSpecificParent", + "ATHPowerShellCommandLineParamet er", + "LaunchAgent s", + "ConsentPrompt BehaviorAdmin", + "ĠHijack ing", + "ĠvbNormal Focus", + "FilterToConsumerBind ing", + "NonPackage d", + "CompatDat abase", + "zLnBvcGVu KCdlY", + "Capability AccessManager", + "SelfSigned Certificate", + "ĠAttempt ing", + "! \";", + "\" @", + "\" };", + "\" )\"", + "$ ($", + "$ \\#{", + "' s", + ") ]", + ") };", + "* '", + "+ '", + "+ ]", + ", ^", + "/ ;", + "1 8", + "1 00", + "1 120", + "3 1", + "4 3", + "4 8", + "4 55", + "5 8", + "6 1", + "7 0", + "7 9", + "8 7", + ": *", + "; {", + "; );", + "< |", + "= %", + "> %", + "> *\"", + "@ ]", + "A E", + "A y", + "A li", + "A WS", + "B l", + "B AL", + "B rm", + "C C", + "C n", + "C ache", + "C CLC", + "D N", + "D X", + "D Y", + "D k", + "D et", + "D en", + "D ep", + "D rives", + "D RV", + "E t", + "E mail", + "F ri", + "F ault", + "G LO", + "G lobal", + "H a", + "H ard", + "H ollow", + "H Result", + "I E", + "I M", + "I s", + "I Configuration", + "I gnition", + "J script", + "J ob", + "J EC", + "K erberoast", + "L m", + "L an", + "L Bin", + "L ight", + "L anguage", + "M ain", + "M enu", + "M imikatz", + "N y", + "N ext", + "N ING", + "N tpServer", + "O ver", + "O ption", + "P I", + "P U", + "P ot", + "P ATH", + "P WPDT", + "P ASS", + "R l", + "R pZ", + "S R", + "S ing", + "S WR", + "S ample", + "S ilentlyContinue", + "T G", + "T Y", + "T am", + "T IN", + "T ION", + "T EST", + "U E", + "U I", + "U S", + "U AC", + "U MT", + "U RI", + "V y", + "V Box", + "W h", + "W t", + "W er", + "W an", + "W script", + "W get", + "W hile", + "[ \"", + "[ @]", + "\\ *", + "\\ .", + "\\ !/", + "_ $", + "` @#{", + "a u", + "a ir", + "a ud", + "a iled", + "b j", + "b z", + "b on", + "b ak", + "b reak", + "c S", + "c c", + "c f", + "c ar", + "c all", + "c ustom", + "c lear", + "d z", + "d in", + "d ut", + "d ex", + "d ar", + "d ps", + "d ul", + "d aemon", + "d isplay", + "d ater", + "d Pipe", + "e k", + "e der", + "e ve", + "e sentutl", + "f e", + "f ailure", + "g B", + "g L", + "g l", + "g cm", + "g pu", + "g roups", + "h d", + "h dG", + "h ollow", + "h Tasks", + "h alt", + "i h", + "i de", + "i se", + "i sc", + "i mp", + "i os", + "i ence", + "j script", + "j oin", + "k ur", + "k cu", + "l ient", + "l ance", + "l zd", + "m v", + "m it", + "m id", + "m Settings", + "m ulti", + "n Z", + "n an", + "n user", + "n ch", + "n dar", + "o me", + "o dump", + "o decmd", + "p m", + "p v", + "p ar", + "p ub", + "p atch", + "p pam", + "p ci", + "p Ow", + "q n", + "q x", + "r ar", + "r ad", + "r ubeus", + "s d", + "s it", + "s bin", + "s ig", + "s ive", + "s mb", + "t Z", + "t le", + "t Host", + "t ail", + "t mon", + "t cm", + "t ake", + "t rim", + "t shark", + "u sc", + "u sh", + "v y", + "v ault", + "v wr", + "v olume", + "v inject", + "v uln", + "v endor", + "w t", + "w MD", + "w hile", + "w pb", + "w ise", + "y Des", + "y lance", + "z agne", + "{ #", + "} $", + "} }", + "} );", + "} ).", + "Ġ N", + "Ġ v", + "Ġ at", + "Ġ or", + "Ġ tem", + "Ġ Pro", + "Ġ St", + "Ġ load", + "Ġ 32", + "Ġ ip", + "Ġ vo", + "Ġ Software", + "Ġ port", + "Ġ min", + "Ġ object", + "Ġ ID", + "Ġ Password", + "Ġ host", + "Ġ null", + "Ġ Run", + "Ġ ed", + "Ġ Time", + "Ġ Management", + "Ġ text", + "Ġ zip", + "Ġ HISTFILE", + "Ġ module", + "Ġ 40", + "Ġ Find", + "Ġ NO", + "Ġ Resource", + "Ġ Ver", + "Ġ HISTIGNORE", + "Ġ Screen", + "Ġ evil", + "Ġ document", + "Ġ keep", + "Ġ unamepass", + "Ġ mode", + "Ġ Kerberos", + "Ġ Credentials", + "Ġ Show", + "Ġ dummy", + "Ġ lockout", + "Ġ HISTCONTROL", + "Ġ SoftRAID", + "Ġ centos", + "Ġ ConsentPromptBehaviorAdmin", + "er ience", + "in t", + "re t", + "re con", + "re start", + "on ce", + "Ġ\" ,", + "Ġ\" -", + "Ġ\" \"#{", + "Ġ\" ]\"", + "at b", + "at o", + "at ing", + "at ter", + "at ive", + "at ten", + "ro bj", + "st p", + "st able", + "st din", + "Ġ/ /", + "ic ip", + "ic ode", + "et l", + "et ch", + "et beat", + "et ric", + "ec ode", + "ec ause", + "or ity", + "om p", + "ex is", + "en um", + "en rsa", + "en umerate", + "file beat", + "&& #{", + "&& &&", + "it tle", + "}\" &&", + "}\" )&&", + "}\" ));$", + "ol ve", + "ho und", + "Win St", + "ri de", + "ri eve", + "se dge", + "se kur", + "Ġt or", + "Ġt ra", + "Ġt arget", + "Ġt ail", + "Ġc d", + "Ġc loud", + "Ġc ould", + "es c", + "es cription", + "ac y", + "St ric", + "Con nected", + "In s", + "In ve", + "In valid", + "In CE", + "In PV", + "In dex", + "HK CR", + "reg ex", + "\"; >%", + "Ġ' .", + "Ġ' ^", + "Ġ' {", + "Ġ' *:", + "co decmd", + "am si", + "com ple", + "com svc", + "Ex clusion", + "un it", + "un set", + "un install", + "ate Shell", + "ate InCE", + "sc at", + "Ġ( ($", + "Ġ( \"#{", + "ain er", + "Get Object", + "Re qu", + "Re place", + "ch flags", + "At First", + "Ġs up", + "To p", + "); }", + "); };", + "); {$", + "do or", + "mo del", + "Ġf oreach", + "Ġf eder", + "output FilePath", + "ab el", + "Ġ{ $", + "ra se", + "ter m", + "all users", + "Set ting", + "pl ate", + "ir d", + "ir onment", + "ort cut", + "pro tocol", + "User sFolder", + "Ġ\"$ {", + "ĠD isplay", + "ĠD escription", + "log ins", + "ip config", + "ĠĠĠĠ ĠĠĠĠ", + "new Module", + "new ServiceDll", + "Cre ating", + "nti re", + "nti virus", + "Ġ1 5", + "Ġ1 54", + "Ġ1 000", + "Ġ1 62", + "em ail", + "ly Name", + "su ccess", + "Ġb it", + "Ġb ef", + "Ġb ecause", + "cur pid", + "Th reading", + "ul ation", + "Com puters", + "OR T", + "AD GroupMember", + "service account", + "10 9", + "En umerate", + "Ġw or", + "Ġw ho", + "sh red", + "sh ortcut", + "NT DS", + "Cont ainer", + "test er", + "test cat", + "Process Name", + "exec start", + "ORD ER", + "Ġin vo", + "im er", + "ER NAME", + "ER ORDER", + "ĠC lient", + "ore st", + ";; };$", + "Ass ign", + "Ġd irectory", + "Ġd aemon", + "Ġd ial", + "Ġd rives", + "Ġd mid", + "command path", + "us ted", + "el d", + "SER VER", + "Password Spray", + "ted By", + "}' );", + "Service Settings", + "ms html", + "ĠI EX", + "Ġg zip", + "Ġg uard", + "Ġg enrsa", + "Ġth an", + "Ġa ct", + "Ġa ux", + "Dis covery", + "Power CL", + "so cket", + "Protocol Handler", + "run once", + "Ġp am", + "Ġp owershell", + "atomic redteam", + "sp ray", + "ma ke", + "ma vinject", + "Ġn ormal", + "Ġn eed", + "Ġ($ _", + "Add Ins", + "ĠP ort", + "ĠP urge", + "ĠP reference", + "Se en", + "key chain", + "Ch ar", + "PS Path", + "PS Read", + "os query", + "ĠDef ine", + ")) &&", + ")) \\\"\"", + "dec rypt", + "IL TIN", + "Ġuser account", + "Ġre start", + "'); ;", + "AT s", + "Ġ+ =", + "registry Data", + "Exp ect", + "Exp ression", + "Exp erience", + "Ġm atter", + "Ġnet work", + "end lyName", + "Ġif config", + "Ġ$( (", + "SYSTEM ROOT", + "list creds", + "Output Directory", + "=\" /", + "ns lookup", + "Script ing", + "Script Scan", + "Script EventConsumer", + "Ġde s", + "Ġde scription", + "Ġde leted", + "Not hing", + "Account Control", + "Domain Controller", + "Domain PasswordSpray", + "ĠRe al", + "ĠRe ad", + "admin ctl", + "Ġsh utdown", + "Create Shortcut", + "Access Token", + "cert s", + "ĠA ctive", + "ĠA SCII", + "ĠA PI", + "vb script", + "Ġ* /*", + "Disable Block", + "Disable Behavior", + "Disable Realtime", + "Disable ScriptScan", + "fo o", + "Web client", + "$( #{", + "De lete", + "non exis", + "Ġse par", + "(); ;", + "EN ABLE", + "ĠM ac", + "Col lection", + "bash rc", + "ml ink", + "wall paper", + "121 8", + "}. [", + "LO LBin", + "date Path", + "no profile", + "no login", + "per Protection", + "') &&", + "sys ctl", + "Ġcon tent", + "AL L", + "tr ated", + "tr usted", + "Ġh kcu", + "\", $", + "\", \"#{", + "No tepad", + "Ġrun as", + "Ġrun Time", + "Ġ`\" `\"", + "Ġtest user", + "ĠS ub", + "AR D", + "IN JEC", + "vir t", + "ĠW HE", + "Ġset ting", + "Policy Store", + "Key Check", + ":\" \\..\\", + "mk link", + "uname str", + "Ġlog ging", + "Ġlog ged", + "wr iter", + "fil tr", + "Ġ\"* .", + "Ġ\"* /", + "Ġ\"* <|", + "Default Install", + "ph rase", + "Role Name", + ".\"; }", + "Event Log", + "find str", + "mal ware", + "mal cmdlets", + "not ification", + "ten v", + "own ers", + ")&& $", + "All Text", + "NO W", + "shell host", + "Sharp Hound", + "Go AWS", + "dsc acheutil", + "Ġpro tocol", + "Ġpro tection", + "ages Val", + "46 6", + "HT TP", + "man Server", + "}) );", + "ĠO EM", + "exfil trated", + "ool er", + "ĠH at", + "Ġ\"[ +]", + "Read Response", + "Read AllText", + "share d", + "Sche dul", + "Ġconfig uration", + "*. *", + "An yDes", + "Dll Name", + "Ġk ext", + "Ġk ill", + "stream command", + "Certificate Action", + "Memb ers", + "cm stp", + "Token Set", + "Min idump", + "Vir us", + "la zagne", + "Ġit s", + "Ġsp ooler", + "ca pture", + "Ġlocal port", + "Ġlocal host", + "ded it", + "place s", + "Ġexp ires", + "Address es", + "install er", + "Pack agesVal", + "ĠF oreach", + "Ġe grep", + "Ġe ntire", + "Ref lection", + "ScheduledTask Action", + "comp ile", + "Ġwin Http", + "rypt og", + "\"); ;", + "Save To", + "bi os", + "Ġadmin s", + "ĠNo tepad", + "$_ \"", + "ni que", + "pu a", + "pu sh", + "ĠL AN", + "Ġj av", + "ĠCreate d", + "Ġcan not", + "update Wallpaper", + "COM PUT", + "ial Name", + "result s", + "Ġcl ip", + "SE CURITY", + "Wmi Instance", + "priv ile", + "priv esc", + "org anization", + "Info Tech", + "tern ateShell", + "Ġbin path", + "Load With", + "ĠIP Address", + "PRO MP", + "PRO GR", + "TR UN", + "ZW F", + "go ogle", + "Ġmod ified", + "Ġssh pass", + "invo ke", + "Ġticket s", + "property Type", + "Http Browser", + "AG UA", + "AH Q", + "Anti Phish", + "OS Config", + "Saf ari", + "Volume Shadow", + "bl ue", + "bl ack", + "pre load", + "pack etbeat", + "required Resources", + "ĠCh rome", + "ĠCh eck", + "RunOnce Ex", + "ĠTicket s", + "PROFIL ING", + "14 5", + "AM FILES", + "Drive Letter", + "Pos ition", + "credential s", + "mark er", + "nl pb", + "power cat", + "power off", + "send byte", + "vbox manage", + "xls m", + "Ġvb script", + "detector Id", + "token s", + "Ġsec rets", + "newValue Data", + "ADFS Config", + "Ġret rieve", + "RoleMember Email", + "Ġdefault s", + "AADInt ADFS", + ";@ \";>%", + "Ent ity", + "HE AP", + "SH ELL", + "Tcp Client", + "\\*. *\"", + "bot h", + "xl Book", + "Ġsc hTasks", + "Ġobj Shell", + "info tech", + "Storage Handler", + "total open", + "total ports", + "Ġshadow copy", + "Spec ial", + "expand property", + "Msol Service", + "Msol RoleMember", + "Al ternateShell", + "IH N", + "Nl c", + "Part icip", + "Part ialName", + "Target Path", + "msc file", + "war nings", + "ĠUn ique", + "Ġapplication Path", + "tech nique", + "rim ary", + "Ġper mission", + "certificate s", + "virtual box", + "ignore both", + "WPDT SD", + "+/ ]{", + "AZ QB", + "Cook ies", + "DCLC WPDTSD", + "Lin ux", + "Last Index", + "PY T", + "Print Brm", + "So ckets", + "TMP FILE", + "WO W", + "lib exec", + "over write", + "Ġlo op", + "recur se", + "Ġtask Name", + "Console Spray", + "Required ResourceAccess", + "101 0000", + "Ġinst all", + "Ġaut o", + "vba Project", + "found Files", + "Video Controller", + "LOCR RC", + "WindowSt yle", + "GetTypeFrom CLSID", + "Aa QB", + "BU ILTIN", + "Fin der", + "Rt cC", + "Sim ulate", + "VID ERORDER", + "bc dedit", + "cv s", + "kext stat", + "nn ni", + "pk tmon", + "por ted", + "pri se", + "Ġenv ironment", + "ĠAtomicTest T", + "Ġother wise", + "esx i", + "cook ies", + "ĠDe leted", + "Ġbrute force", + "extrac ted", + "Accessib ility", + "ĠAll ow", + "obf usc", + "Ġdoes n", + "disk VolumeShadow", + "Removable Drives", + "ĠHideSC A", + "IGZvciB tb", + "Ultra Viewer", + "LogMeIn Ignition", + ",^ ,#{", + ";); \"@", + "Ali as", + "BAL ROOT", + "Dk mSettings", + "Fri endlyName", + "GLO BALROOT", + "Hard diskVolumeShadow", + "Lan manServer", + "Over ride", + "RpZ nlpb", + "Sing le", + "SWR PWPDT", + "Tam perProtection", + "UAC Bypass", + "Wh ite", + "Wer Fault", + "Wan tedBy", + "[@] }));", + "bon black", + "car bonblack", + "custom shellhost", + "dut y", + "dps Light", + "lzd GV", + "nan odump", + "tHost KeyCheck", + "take own", + "vault cmd", + "Ġtem plate", + "ĠSt able", + "Ġvo id", + "ĠNO T", + "atten d", + "WinSt ations", + "sekur lsa", + "Ġtra ce", + "Ġcloud trail", + "Stric tHostKeyCheck", + "Inve igh", + "Invalid CertificateAction", + "comsvc s", + "ateInCE IP", + "Ġ(($ {#", + "AtFirst Seen", + "Ġbef ore", + "Threading Model", + "Assign ment", + "Ġdial og", + "Ġdmid ecode", + "ServiceSettings Data", + "Ġguard duty", + "PowerCL IConfiguration", + "ĠPreference s", + "osquery d", + "DisableBlock AtFirstSeen", + "DisableBehavior Monitoring", + "DisableRealtime Monitoring", + "DisableScriptScan ning", + "nonexis tent", + "Ġsepar ate", + "INJEC TRUN", + "ĠWHE RE", + "Ġ\"*<| >*\"", + "notification PackagesVal", + "GoAWS ConsoleSpray", + "Schedul er", + "AnyDes k", + "ĠLAN G", + "Ġjav ascript", + "updateWallpaper code", + "COMPUT ERNAME", + "organization al", + "InfoTech StorageHandler", + "LoadWith PartialName", + "PROMP T", + "PROGR AMFILES", + "AntiPhish Rule", + "requiredResources Access", + "Ġretrieve d", + "RoleMemberEmail Address", + "ĠschTasks Cmd", + "AlternateShell Startup", + "Particip ateInCEIP", + "ĠUnique ID", + "LastIndex Of", + "obfusc ated", + "HarddiskVolumeShadow Copy", + "RpZnlpb mc", + "StrictHostKeyCheck ing", + "INJECTRUN NING", + "notificationPackagesVal ues", + "! $", + "! `", + "! \"&&", + "! \"}", + "! '\"", + "! >>", + "\" \"", + "\" -", + "\" :\\", + "\" \";;", + "\" \").", + "# #", + "$ '", + "$ /", + "$ ;", + "$ \\", + "% /#{", + "' '", + "' @", + "' )\"&&", + "' +'", + "' !'\"", + "( <", + "( ?", + ") ?", + ") `", + ") |", + ") :\\", + ") {;", + ") \\\"", + ") `\")\";$", + ") }};", + ") %/#{", + "* ]", + "* ';", + "* \")", + "* *\"", + "* $/", + "+ \")", + "+ \":\\", + "- $", + "- *", + "- $(", + "- ')", + ". %", + ". [", + ". _", + ". `", + ". \"}", + ". \"&&./", + ". *$/", + "/ \"", + "/ /", + "/ $(", + "/ ...", + "0 3", + "0 7", + "0 15", + "1 64", + "1 106", + "2 5", + "2 73", + "2 37", + "3 8", + "3 55", + "3 40", + "4 1", + "4 24", + "5 319", + "5 14", + "6 8", + "6 00", + "7 6", + "7 89", + "8 40", + "8 21", + "9 63", + "9 09", + "9 83", + ": '", + ": [", + "; ]\"", + "; };$", + "= (", + "= -", + "= [", + "= ='", + "= @#{", + "= ((", + "= )?", + "> ));", + "? <", + "@ {", + "A I", + "A Q", + "A V", + "A Ag", + "B L", + "B z", + "B ar", + "B ad", + "B it", + "B und", + "B ud", + "B IO", + "B reak", + "B lob", + "B OL", + "B ios", + "C B", + "C M", + "C b", + "C g", + "C Path", + "C ore", + "C MD", + "C leanup", + "D H", + "D O", + "D b", + "D n", + "D el", + "D river", + "D NS", + "E val", + "F B", + "F L", + "F O", + "F Q", + "F X", + "F f", + "F n", + "F u", + "F am", + "F orest", + "G C", + "G S", + "G X", + "G n", + "G ps", + "G PS", + "G IN", + "G uard", + "H D", + "H k", + "H ex", + "H ELL", + "H ome", + "H ARD", + "I S", + "I U", + "I c", + "I k", + "I p", + "I uc", + "J I", + "J l", + "J z", + "J itter", + "K Q", + "K V", + "K v", + "K z", + "K SP", + "L s", + "L u", + "L ate", + "L ib", + "L ibr", + "L abel", + "M j", + "M AT", + "M atch", + "M IN", + "M ULT", + "N B", + "N C", + "N U", + "N i", + "N ative", + "O G", + "O O", + "O U", + "O r", + "O OF", + "O wn", + "O DB", + "O ptions", + "P E", + "P L", + "P f", + "P n", + "P ri", + "P us", + "P list", + "P riv", + "P ages", + "P PID", + "P ant", + "P aper", + "P WD", + "P OST", + "P UA", + "P ORT", + "P Entity", + "Q J", + "Q o", + "R h", + "R r", + "R y", + "R et", + "R out", + "R IP", + "S G", + "S S", + "S W", + "S a", + "S n", + "S te", + "S en", + "S ource", + "S ite", + "S vc", + "S kip", + "S SH", + "S QL", + "T ak", + "T IME", + "T reat", + "U r", + "U ID", + "U so", + "V T", + "V c", + "V is", + "V box", + "V DE", + "W H", + "W X", + "W r", + "W x", + "W are", + "W OR", + "W ARE", + "W IN", + "W QL", + "X en", + "X ML", + "X LL", + "X Bvc", + "X POST", + "Y n", + "Y y", + "Y es", + "Y QB", + "Z Q", + "Z U", + "Z agne", + "[ -", + "[ $_.", + "[ ;]\"", + "] ;", + "] ;\"", + "] ){", + "] (\"{", + "^ /", + "` $", + "a X", + "a i", + "b C", + "b a", + "b w", + "b or", + "b ad", + "b ert", + "b atch", + "b lock", + "b led", + "c z", + "c le", + "c ce", + "c pt", + "c am", + "c pl", + "c conf", + "c rypt", + "c HJ", + "d D", + "d H", + "d at", + "d ro", + "d it", + "d Value", + "d set", + "d ash", + "d af", + "d riv", + "d uration", + "d ays", + "d helper", + "d XJ", + "e E", + "e e", + "e st", + "e tent", + "f in", + "f lt", + "f irst", + "f mm", + "f inal", + "f irefox", + "f low", + "f etch", + "g s", + "g z", + "g er", + "g it", + "g Pl", + "g plink", + "g ener", + "g ci", + "g wmi", + "g raphic", + "g serviceaccount", + "h X", + "h l", + "h y", + "h at", + "h ip", + "h Server", + "h AHQ", + "i E", + "i ke", + "i as", + "i red", + "i ver", + "i eq", + "i ed", + "i dent", + "i jack", + "j A", + "j E", + "j I", + "j Q", + "j h", + "j m", + "j ZXN", + "j itter", + "k b", + "k i", + "k o", + "k u", + "k dir", + "k config", + "k IF", + "k KC", + "l in", + "l if", + "l net", + "l ast", + "m h", + "m of", + "m icro", + "m age", + "m us", + "m Service", + "m gr", + "m tp", + "m util", + "m wc", + "m sedge", + "n b", + "n f", + "n v", + "n ow", + "n op", + "n el", + "n ail", + "n sent", + "n umer", + "n Qg", + "n Certificates", + "n qx", + "o of", + "o log", + "o ption", + "o db", + "p J", + "p V", + "p X", + "p c", + "p g", + "p r", + "p x", + "p ho", + "p yp", + "p ot", + "p cal", + "p ine", + "p ng", + "q D", + "q user", + "r q", + "r on", + "r an", + "r sp", + "r atus", + "r syslog", + "r sync", + "r ont", + "r usion", + "r pm", + "s S", + "s f", + "s l", + "s py", + "s up", + "s ure", + "s ender", + "s mod", + "s ilent", + "s rm", + "s Enabled", + "s ftp", + "s nk", + "s Consent", + "s bG", + "s etcap", + "s mtp", + "t Y", + "t d", + "t m", + "t v", + "t or", + "t yp", + "t ab", + "t able", + "t ru", + "t itle", + "t AGUA", + "u T", + "u a", + "u i", + "u j", + "u er", + "u ation", + "u gger", + "u ished", + "u Jy", + "u BOL", + "v Z", + "v a", + "v in", + "v ec", + "v ib", + "v pack", + "v pc", + "w E", + "w I", + "w R", + "w g", + "w k", + "w q", + "w ud", + "w here", + "w cm", + "x or", + "x en", + "x wd", + "x sa", + "x Mj", + "x wud", + "y L", + "y y", + "y katz", + "y mm", + "y KCd", + "y nch", + "y mlink", + "y ZWF", + "y cle", + "z V", + "z c", + "z g", + "{ };", + "| ?{", + "| [^", + "} %", + "} |", + "~ ')|", + "Ġ ?", + "Ġ i", + "Ġ le", + "Ġ ic", + "Ġ RE", + "Ġ py", + "Ġ up", + "Ġ Value", + "Ġ 64", + "Ġ ver", + "Ġ Force", + "Ġ Folder", + "Ġ OR", + "Ġ Host", + "Ġ op", + "Ġ Ass", + "Ġ el", + "Ġ Az", + "Ġ Error", + "Ġ Users", + "Ġ 36", + "Ġ ask", + "Ġ App", + "Ġ download", + "Ġ Azure", + "Ġ filename", + "Ġ vm", + "Ġ Services", + "Ġ ib", + "Ġ ance", + "Ġ var", + "Ġ arch", + "Ġ old", + "Ġ Res", + "Ġ Local", + "Ġ SID", + "Ġ PowerShell", + "Ġ arp", + "Ġ Policy", + "Ġ Stream", + "Ġ ObjectId", + "Ġ Event", + "Ġ Provider", + "Ġ dump", + "Ġ args", + "Ġ hello", + "Ġ Expand", + "Ġ Random", + "Ġ Xml", + "Ġ pty", + "Ġ Viewer", + "Ġ length", + "Ġ Configuration", + "Ġ random", + "Ġ ports", + "Ġ FullName", + "Ġ 96", + "Ġ Att", + "Ġ Creation", + "Ġ vari", + "Ġ any", + "Ġ HISTFILESIZE", + "Ġ Enhanced", + "Ġ Manufacturer", + "Ġ HISTSIZE", + "Ġ LegalNoticeText", + "Ġ LegalNoticeCaption", + "Ġ archive", + "Ġ Video", + "Ġ Bookmarks", + "Ġ QU", + "Ġ erase", + "Ġ mega", + "Ġ Spring", + "Ġ Keep", + "Ġ SIGINT", + "Ġ HKCR", + "Ġ Nothing", + "Ġ extracted", + "er e", + "er face", + "er prise", + "Ġ- &&", + "re ce", + "re pro", + "re plication", + "re named", + "on line", + "on sor", + "Ġ\" +", + "Ġ\" ^", + "Ġ\" \")", + "Ġ\" .\"", + "Ġ\" '!'\"", + "at s", + "at son", + "le ls", + "le Cl", + "le gal", + "le sn", + "st ate", + "st ation", + "st Method", + "st abl", + "Ġ/ @", + "ic Extension", + "et ad", + "et it", + "ec ycle", + "or h", + "or ar", + "or Security", + "or ld", + "me md", + "me nc", + "nt o", + "nt erface", + "al i", + "al ware", + "al lels", + "Ġ$ $'", + "ion ing", + "ion System", + "ar ray", + "ser ve", + "ce n", + "en Name", + "en ab", + "en coding", + "file content", + "Ġ= \"", + "Ġ= $", + "&& $", + "&& [", + "ad fs", + "it d", + "lo y", + "an ne", + "}\" -", + "}\" }", + "}\" ))", + "Path Bypass", + "Path sEnabled", + "Pro vis", + "ing Action", + "ing Directory", + "ing Attach", + "ho col", + "Win So", + "ri p", + "ri gger", + "se q", + "se vec", + "exe Path", + "user domain", + "user list", + "he st", + "Ġt ot", + "Ġt op", + "Ġt run", + "Ġt rust", + "Ġt shark", + "Ġt itle", + "Ġc b", + "Ġc n", + "Ġc red", + "Ġc ap", + "Ġc ase", + "Ġc lose", + "Ġc alled", + "Ġc reat", + "Ġc ylance", + "00 1010000", + "Name dPipe", + "Ġ| /", + "ac c", + "ac l", + "ac on", + "St ate", + "St and", + "St ub", + "St ratus", + "In f", + "In ject", + "In File", + "In ge", + "In line", + "In box", + "Windows Ap", + "pt h", + "word path", + "word wll", + "reg edit", + "\"; \"", + "\"; };$", + "Ġ' -", + "Ġ' >", + "Ġ' [", + "co re", + "am p", + ":\\ '", + "Ex e", + "Ex t", + "Ex ts", + "Ex clude", + "Ex isting", + "Ex filtr", + "if t", + "if ed", + "con text", + "out look", + "un load", + "un ted", + "un link", + "un attend", + "ation Time", + "il led", + "sc p", + "sc an", + "sc pu", + "Ġ( \"", + "Ġ( &", + "Ġ( #{", + "Ġ> =", + "to so", + "ve Hk", + "is p", + "is her", + "ub unt", + "ub leCl", + "Get Current", + "Get Cred", + "Get Raw", + "Re stMethod", + "as px", + "ch sh", + "ers onate", + "At Logon", + "}; &", + "}; ;", + "}; [", + "Ġs ure", + "Ġs leep", + "Ġs rm", + "Ġs vc", + "Ġs ilver", + "Ġs etcap", + "Ġs dset", + "To Start", + "To String", + "To Ass", + "To Run", + "); [", + "New Action", + "New Class", + "New line", + "mo use", + "mo unted", + "Ġf tp", + "Ġf ollow", + "Ġf alcon", + "Ġf ailed", + "Ġf illed", + "red irection", + "red hat", + "output directory", + "mp le", + "Ġ{ $_", + "Atomic Cert", + "Atomic Safe", + "File T", + "File name", + "File path", + "Set Wallpaper", + "Set AccessRule", + "password List", + "password Filter", + "add in", + "up g", + "up port", + "up dater", + "pl util", + "ir ationTime", + "Object Del", + "load ing", + "ort hand", + "ot net", + "Current active", + "pro be", + "pro vider", + "pro mpt", + "For AAD", + "User Do", + "User AccountControl", + "Ġ\"$ \"", + "Ġ\"$ ($", + "net Reporting", + "ĠD E", + "ĠD O", + "ĠD word", + "ĠD isc", + "log out", + "log ging", + "log ger", + "ip Addresses", + "new file", + "new LegalNoticeText", + "new LegalNoticeCaption", + "Ġ1 3", + "Ġ1 7", + "Ġ1 00", + "Ġ1 64", + "Ġ1 10", + "Ġ1 11", + "Ġ1 57", + "Ġ1 97", + "ly Tak", + "su id", + "). #{", + "Te XN", + "Ġb u", + "Ġb ut", + "Ġb etter", + "ĠREG IST", + "content s", + "content Type", + "Lo ck", + "Write Time", + "Write Line", + "cl t", + "cl ist", + "cl ang", + "ap is", + "ap hound", + "Ġ[ *]", + "script Path", + "script Content", + "ire Pre", + "Start Directory", + "ul ator", + "ul ated", + "Com menc", + "ay Load", + "bin d", + "Host s", + "15 53", + "15 52", + "raw ing", + "AD Object", + "AD Computer", + "AD ODB", + "]:: #{", + "du ps", + "10 4", + "10 35", + "10 91", + "En gl", + "String s", + "String Set", + "th umb", + "th reading", + "th ird", + "Net IP", + "Net TCP", + "Net Wire", + "sh a", + "NT LM", + "NT Account", + "md ir", + "ef d", + "ItemProperty Value", + "Ġ>> /", + "Process ToStart", + "ine lyTak", + "exec stop", + "ls b", + "ls m", + "Ġin it", + "Ġin sp", + "Ġin valid", + "Ġin smod", + "im mutable", + "ER T", + "TW Enabled", + "Ġ% {", + "eb ugger", + "ĠC N", + "ĠC atch", + "ĠC ache", + "ĠC MD", + "ĠC aption", + "ĠC IM", + "ĠC ryptog", + "%\\ ..\\", + "Security Providers", + "Security Identifier", + "ig est", + "ig hest", + ";; [", + "`\" `\"", + "`\" `\",", + "ary directory", + "ary Authentication", + "(' /", + "(' -')", + "Man ip", + "ime wd", + "Ġ; };", + "Ġd n", + "Ġd ay", + "us d", + "rep air", + "el t", + "dll path", + "object class", + "Ġ2 0", + "Ġ2 00", + "Ġ2 40", + "Password s", + "Password DBLocation", + ")\" \"\";;", + "HI G", + "HI N", + "HI VE", + "ted Data", + "host w", + "}' )", + "}' ).", + "}' )\"", + "}' );$", + "Service ObjectDel", + "ms xsl", + "}\\ \"", + "ĠI mage", + "ĠI nterface", + "Ġg reen", + "Ġg wmi", + "Ġg etent", + "local ip", + "Ġa ntivirus", + "Ġa wk", + "ext List", + "}\"; .\\", + "Power Dump", + "so aphound", + "63 5", + "63 7", + "Ġex tension", + "Ġex tern", + "Shell Execute", + "Shell ServiceObjectDel", + "run me", + "run ning", + "run book", + "Ġp ing", + "Ġp rin", + "Ġp wd", + "Ġp rint", + "Ġp ause", + "Ġp erson", + "Ġp ush", + "11 11", + "11 34", + "11 355", + "Az Domain", + "Az Subscription", + "sp n", + "sp aw", + "ĠSystem Parameters", + "folder array", + "copy Path", + "ument s", + "36 19", + "set up", + "set spn", + "Ġ] &&", + "ru ntime", + "ĠP S", + "ĠP ut", + "ĠP ost", + "ĠP ID", + "ĠP RO", + "ĠP ubl", + "ĠP rimary", + "Command s", + "Command ParamVariation", + "Command ToRun", + "EX EC", + "cat ing", + "Se atb", + "Run dll", + "Run As", + "Run Time", + "Run Key", + "Run HTMLApplication", + "Run Level", + "key ObjectGuid", + "Aut os", + "Ch ange", + "Ch unk", + "Ch anne", + "PS Image", + "PS Drive", + "PS Remo", + "Ġ}; ;#", + "web si", + "web proxy", + "web cam", + "Log Off", + "App Role", + "App Compat", + "App PathBypass", + ")) )", + ")) )&&", + ")) ))&&", + "Par allels", + "target secure", + "input file", + "input FilePath", + "Azure Blob", + "Azure Passwords", + "=' /", + "As Local", + "Time out", + "Ġre q", + "Ġre sult", + "Ġre stor", + "app patch", + "88 4", + "Ġst orage", + "Ġst ats", + "Server Name", + "Server IP", + "(\" \"", + "(\" $", + "(\" \\", + "pass phrase", + "Ġ+ \"%", + "Exp irationTime", + "List s", + "Ro bert", + "query format", + "prin tenv", + "Ġm c", + "Ġm y", + "Ġm asquer", + "Ġm kdir", + "Ġm alware", + "url cache", + "cip her", + "Use EncodedArguments", + "ĠT ry", + "ĠT EST", + "ĠT imer", + "Ġis n", + "AzureAD Tenant", + "be acon", + "Ġfile Object", + "Exec Stop", + "Directory Ent", + "Directory Identifier", + "ib le", + "ns n", + "inter val", + "Manager Backup", + "Ġde let", + "Not In", + "Not Required", + "Not Requ", + "ff lesn", + "gn upg", + "Ġ} }", + "Account Token", + "Domain User", + "Domain Users", + "Domain Profile", + "Domain Trust", + "sub j", + "ĠRe quest", + "ĠRe porting", + "Ġsh red", + "Ġsh orthand", + "Create Remote", + "Create Thread", + "Access Control", + "Access Protection", + "vi des", + "ĠA nti", + "ĠA ES", + "FilePath s", + "On Realtime", + "On AccessProtection", + "sec ret", + "win zip", + "win Http", + "Ġ* &&", + "Ġ* **\"", + "Program Files", + "Disable Int", + "Disable Config", + "Disable IO", + "Disable Scan", + "Disable Keep", + "Disable EnhancedNotifications", + "Disable SR", + "Disable Rout", + "Disable OnAccessProtection", + "cr ond", + "fo dhelper", + "Application Id", + "Application Permission", + "57 7", + "encoded Chunk", + "\") :", + "non e", + "Ġse ssh", + "(); \"", + "(); #", + "(); [", + "(); }", + "(); @('", + "16 9", + "16 02", + "EN D", + "EN V", + "ĠM ain", + "ĠM ax", + "ĠM ake", + "ĠM onitor", + "ĠM ini", + "Ġelse if", + "NE VT", + "Res et", + "Sp oof", + "Local Port", + "Local GroupMember", + "Enable Pus", + "AC E", + "Col lect", + "Ke vin", + "86 8", + "86 9", + "}. $", + "}. *\"", + "Ġl ive", + "Ġl ater", + "Ġl ike", + "Ġl scpu", + "Location s", + "Filter Policy", + "no exit", + "text Extra", + "text Pattern", + "text Matches", + "CommandLine EventConsumer", + "() ).", + "per m", + "per ator", + "Do hServer", + "sys mon", + "sys adminctl", + "sys rq", + "Ġcon text", + "Ġcon toso", + "top ic", + "vent vwr", + "vent ionSystem", + "Admin Logon", + "99 61", + "SI ON", + "Ġ5 12", + "Ġ5 03", + "PowerShell Ic", + "Cert Data", + "Cert Trust", + "No Password", + "No Auto", + "No Newline", + "Module Logging", + "Un icode", + "scription s", + "Act ivate", + "line Option", + "config ure", + "Inter face", + "Inter val", + "\\$ ($", + "ssh d", + "Group Name", + "Group ID", + "Group Id", + "af e", + "ĠS ave", + "ĠS ilver", + "ĠS HELL", + "ĠS upport", + "IN FS", + "Task Mod", + "Task Scheduler", + "Up per", + "ld r", + "tra ct", + "ĠW all", + "ĠW IT", + "ĠW orld", + "Ġcom puter", + "Temp Cred", + "19 81", + "li M", + "Ġset up", + "proc dump", + "Key Credential", + "Key Identifier", + "Key Export", + ":\" %", + ":\" \\", + ";}; ;", + "IG dy", + "dc rypt", + "dc shadow", + "dc ServerName", + "sa ve", + "sa ction", + "sa ver", + "Ġ\"\" $($", + "Ġbase board", + "Full Control", + "def ender", + "Request orSecurity", + "Session s", + "Session ManagerBackup", + "Protection Override", + "pw quality", + "Ġ\"* /.", + "Red irection", + "Computer FQ", + "cron tab", + "01 4", + "nc n", + "nc rypt", + "ph one", + "Ġls a", + "Ġls pci", + "Ġch rome", + "Ġch kconfig", + "computer name", + "Role Definition", + "windows powershell", + ".\"; ;$", + "40 79", + "40 600", + "Event Filter", + "From String", + "Pre ventionSystem", + "ktop img", + "not ice", + "not ran", + "ten ance", + "arg uments", + "off line", + "Comp any", + "Download string", + "20 8", + "20 21", + "Cim V", + "pwd age", + "shell s", + "Sharp web", + "Sharp Up", + "Ġbe en", + "Ġbe havior", + "Go ToAss", + "IP s", + "Ġen c", + "Ġen codecmd", + "Ġen sure", + "Ġpro duct", + "Ġpro mpt", + "Instance Modification", + "HT T", + "HT AS", + "Mp Cmd", + "Mp Engine", + "Mp EnablePus", + "Sub String", + "Sub mit", + "audit ctl", + "audit beat", + "mon itor", + "mon olog", + "man Creds", + "si mple", + "task hostw", + "}) {", + "}) {;", + "ĠO perator", + "ĠSe arch", + "Ġcurrent profile", + "56 789", + "ĠH el", + "ĠH idden", + "ĠH ighest", + "Ġ\"[ [;]\"", + "ard Profile", + "Read Count", + "End Date", + "share s", + "Resource GroupName", + "37 77", + "Dll Import", + "Ġk ind", + "Ġk mutil", + "Ġ\"\\ \\#{", + "Client s", + "Certificate Thumbprint", + "HO N", + "ND LL", + "ND Mu", + "SC RIP", + "SC HTAS", + "SD RC", + "Tr an", + "VM Ware", + "cm V", + "cm xsa", + "full memd", + "sy mb", + "xml file", + "read me", + "Token s", + "Token System", + "clu ster", + "clsid s", + "ness usd", + "ler oot", + "exp ired", + "Remote Computer", + "Remote CertTrust", + "Ġsp ace", + "Ġsp ray", + "Search String", + "office test", + "44 3", + "44 44", + "44 455", + "ca ption", + "ish Pages", + "Address Fam", + "install type", + "/* ;", + "29 1", + "Fe der", + "Ter mService", + "ftp Ur", + "ume s", + "ĠF ax", + "ĠG reen", + "ĠU sing", + "Ġe very", + "Ġe ventvwr", + "Ġx or", + "Ġx clip", + "Ġon ly", + "ĠUser Shell", + "release s", + "&&# ##", + "Ref ObjectId", + "program data", + "Rule s", + "ScheduledTask Principal", + "ScheduledTask Settings", + "ScheduledTask Trigger", + "mm c", + "mimikatz Param", + "comp ression", + "Second aryAuthentication", + "\",\" /", + "\",\" --", + "\"); {", + "94 5", + "Active ScriptEventConsumer", + "GV hZ", + "GV yKCd", + "War nings", + "node s", + "ĠB ypass", + "ĠB rowser", + "Ġun link", + "Ġtemp orar", + "Ġadmin user", + "ĠEnable Scripts", + "ĠEnable Lin", + "ĠEnable SmartScreen", + "}\") ,", + "Screen Connect", + "NET Framework", + "80 3", + "FS Home", + "Launch INFS", + "ML Token", + "Mail box", + "Mail Message", + "Max Connections", + "SP OOF", + "iv enName", + "yan ki", + "Ġ< <", + "ĠL ong", + "example Name", + "example FullPath", + "ked Connections", + "Ġsub net", + "Ġsub process", + "Ġsub scriptions", + "api Key", + "Auto Run", + "Logon Credential", + "Update dValue", + "\")) ;$", + "\")) {;", + "34 3", + "34 56789", + "MD Ay", + "NP Class", + "OL Spray", + "Oper ational", + "Su bject", + "WScript Shell", + "iss ue", + "wb admin", + "ĠV olume", + "ĠV Box", + "Ġal ias", + "ĠDisable EnhancedNotifications", + "ĠDisable Priv", + "ĠIS A", + "ĠIS O", + "ĠDefault s", + "ĠDefault Install", + "ĠDefault Password", + "ĠDefault UserName", + "ĠDefault DomainName", + "evil screen", + "++ ){", + "02 4", + "72 04", + "AS R", + "Tri m", + "WD WO", + "WD igest", + "aW Nl", + "fi eld", + "parent s", + "tcp dump", + "zer os", + "ĠEx tract", + "ĠService Dll", + "Ġ\"# \"", + "org inal", + "org Wallpaper", + "starting Directory", + "ĠIP v", + "\": {\"", + "(`\" `\"", + "By b", + "By Host", + "By Xml", + "MS OLSpray", + "PRO VIDERORDER", + "Spy netReporting", + "sk ar", + "ĠShell SmartScreen", + "ĠAs ymm", + "Ġaccount s", + "Ġmod probe", + "down ldr", + "Ġ'# !/", + "Ġ'# \\!/", + "connect ion", + "screen capture", + "chunk s", + "ĠDis abl", + "subnet IPs", + "NPPS PY", + "08 99", + "DE FA", + "DE SCRIP", + "Parent Id", + "[] ]$", + "[] ]'", + "az ure", + "cache s", + "gp g", + "gp o", + "ie DBLocation", + "pY jI", + "pre fetch", + "pre serve", + "pack age", + "sw ap", + "sw ift", + "sam l", + "ticket s", + "Ġexec ve", + "ĠLog ged", + "ĠComp ress", + "Advanced Run", + "Advanced Setting", + "RunOnce Key", + "Interop services", + "obj id", + "EncodedCommand ParamVariation", + "member of", + "excluded path", + "excluded Process", + "excluded Exts", + "&`\" `\")\";$", + "35 40600", + "Cmd Line", + "Post s", + "Sm b", + "Sm tpServer", + "ds enab", + "dis playName", + "dis covery", + "dns Server", + "dns Query", + "polic ies", + "xls x", + "ĠMicrosoft Redirection", + "ĠProcess or", + "ĠEX IT", + "Input Provider", + "FileSystem Object", + "FileSystem AccessRule", + "FileSystem Label", + "Creation Include", + "107 0", + "107 4", + "1222 002", + "lsa Key", + "Ġmethod s", + "decoded Text", + "decoded Content", + "Ġldap add", + "ldap add", + "ldap search", + "Trans late", + "AADInt AccessToken", + "ĠGroupPolicyRefreshTime DC", + "53 3", + ";@ ($", + "Audit Log", + "Audit Bypass", + "Custom KeyIdentifier", + "Dump Creds", + "Ent erprise", + "FOR MAT", + "Kerberos RequestorSecurity", + "Non Existing", + "RDP PORT", + "UN CPath", + "bytes Read", + "xl am", + "ĠR ename", + "ĠR SA", + "Ġps r", + "Ġsc robj", + "Ġobj Exec", + "Ġobj ws", + "urn Value", + "Storage Type", + "check s", + "dot m", + "agent d", + "... \";$", + "Ġdisable d", + "EXE Filename", + "CreateProcess System", + "auto suid", + "Internal monolog", + "Register XLL", + "Register ByXml", + "Shortcut Location", + "cale ndar", + "Techni que", + "kirbi file", + "655 35", + "Al ive", + "Acl Object", + "Flag s", + "GR fa", + "Gener ic", + "Gener ated", + "Sys mon", + "Sys WOW", + "cb agentd", + "launch er", + "tb W", + "trun cating", + "we et", + "we ak", + "war ning", + "ĠE TWEnabled", + "ĠUn install", + "ĠAuto Share", + "ĠAuto AdminLogon", + "ont Log", + "home drive", + "Status Bar", + "Ġdsc acheutil", + "Ġper l", + "Ġconnect ion", + "Perf OS", + "Perf Format", + "xsl file", + "Ġ9999 99", + "Ġcertificate s", + "+/ ]", + "CF Bund", + "Cook ieDBLocation", + "DCLC SWRPWPDT", + "Fa iled", + "He ading", + "History Save", + "Mu Y", + "SA MLToken", + "VB Script", + "Val id", + "VER SION", + "cu MC", + "driver query", + "hZ GRfa", + "lu Z", + "lu sh", + "mt ab", + "post Data", + "sample File", + "sample Data", + "})) {", + "Ġ^ |", + "Ġy our", + "Ġy ou", + "Ġatomic redteam", + "ĠNUL L", + "recur sive", + "select ors", + "Ġ'% {", + "isting uished", + "Ġsim ulate", + "Ġ12 8", + "Ġinst ance", + "Ġaut h", + "Ġread y", + "vba Code", + "found FilePaths", + "ĠMS Online", + "trans port", + "trans fer", + "LOCR SDRC", + "syntax List", + "---- ----", + "ĠExport able", + "WindowSt ate", + "Phish ingAttach", + "original Description", + "GetTypeFrom ProgID", + "iWindowPos Y", + "60 55", + "Ev il", + "Ldap Connection", + "Ldap DirectoryIdentifier", + "Mac OS", + "PX Vy", + "RU NDLL", + "TS Connections", + "Ug VDE", + "Us age", + "Us IHN", + "VBA addin", + "VBA Warnings", + "WI yL", + "WI NEVT", + "Work ingDirectory", + "]*\\ .[", + "dn scat", + "jsc name", + "jsc path", + "journal d", + "myp id", + "myp wd", + "rt f", + "sen sor", + "sen sit", + "trust s", + "wL jE", + "ĠInstall Date", + "ĠQuery Language", + "erase dups", + "ical Path", + "ntds util", + "fileExtensions String", + "network setup", + "Ġaddress es", + "emond Clients", + "Ġback door", + "AdmPwd ExpirationTime", + "NetFirewall Rule", + "Ġdec odecmd", + ")\")) {;", + "msbuild name", + "msbuild path", + "ĠIN IT", + "ĠIN FO", + "localgroup member", + "Disallow Run", + "Disallow Exploit", + "PowerP nt", + "PowerP oint", + "AzRole Definition", + "AzRole Assignment", + "Auth Type", + "form ation", + "AzureADDirectory Role", + "AzureADDirectory RoleMember", + "ScriptBlock Logging", + "second Octet", + "second arydirectory", + "DisableAnti Spyware", + "DisableAnti Virus", + "Spring field", + "timest omp", + "timest amp", + "VMHost Service", + "compress level", + "attribute s", + "Ġadministrator s", + "EncodedArguments ParamVariation", + "WMI Object", + "WMI Exec", + "bGx pYjI", + "Attach ments", + "ĠGroupPolicyRefreshTimeOffset DC", + "LDAP Filter", + "Ġsyslog d", + "ĠLastUsedTime Start", + "ĠLastUsedTime Stop", + "Tenant Id", + "\"}; ;$", + "/; \\", + ":* ;", + "Bl bi", + "CC DCLCSWRPWPDT", + "Cn Jl", + "CCLC SW", + "Det ail", + "Den ial", + "Dep loy", + "Et w", + "Next Bytes", + "PU BL", + "Pot ato", + "Rl bn", + "Sample sConsent", + "UMT U", + "aud isp", + "cf g", + "imp act", + "nZ pY", + "tZ C", + "wMD Iuc", + "wpb bin", + "ĠN FSHome", + "ĠPro xy", + "Ġ32 5", + "ĠTime Service", + "Ġzip file", + "Ġ40 96", + "ĠVer ify", + "ĠScreen Save", + "Ġ\"]\" );", + "etric X", + "acy Experience", + "comple ted", + "Ġsup ported", + "Top icExtension", + ");}; ;#", + "Ġfeder ation", + "allusers profile", + "ĠDisplay Version", + "109 8", + "Enumerate AzureBlob", + "Ġwor ked", + "Ġwho ami", + "Ġinvo ke", + "Ġact ivate", + "PSRead lineOption", + "ĠReal Name", + "ĠRead Only", + "ĠActive Directory", + "ĠMac ro", + "Collection s", + "virt io", + "exfiltrated Data", + "Ġkext unload", + "Members hip", + "SaveTo File", + "privile ged", + "ĠIPAddress ToString", + "google apis", + "AADIntADFS Certificates", + "Nlc nZpY", + "PYT HON", + "Simulate UserDo", + "Single User", + "lzdGV tZC", + "obfuscated ps", + "RpZnlpbmc gcm", + "\"- \"", + "+\") '", + "07 104", + "164 9", + "5319 7", + "=(( ([", + "AV Protection", + "Bad Potato", + "Bud dy", + "BIO S", + "Bios Version", + "DO WS", + "Eval uation", + "Forest Trust", + "Gps cript", + "HARD WARE", + "Ip Address", + "KSP ACE", + "Late st", + "Lib Hello", + "Libr aries", + "MULT I", + "OO BE", + "Pf x", + "Pn PEntity", + "Pri ority", + "Plist Buddy", + "Pant her", + "PUA Protection", + "Ret urnValue", + "Sa ver", + "Ste alth", + "Sen sor", + "Treat As", + "Vis ible", + "WOR KSPACE", + "WIN DOWS", + "XBvc nQg", + "cce ncrypt", + "cHJ veHk", + "dro p", + "dXJ sbG", + "flt mc", + "first Octet", + "final path", + "gPl ink", + "ident ity", + "kIF NlcnZpY", + "lin enum", + "lif ecycle", + "micro phone", + "mus ic", + "now rap", + "nail pho", + "nsent er", + "numer ic", + "odb cconf", + "pyp ykatz", + "pcal ua", + "rusion PreventionSystem", + "spy net", + "sup er", + "typ icalPath", + "tru fflesn", + "uJy kK", + "uBOL ite", + "xMj cuMC", + "ymlink Evaluation", + "yZWF kKC", + "|?{ (", + "Ġle ave", + "Ġic on", + "ĠFolder s", + "ĠHost Id", + "Ġel if", + "Ġ36 5", + "Ġib s", + "Ġance stor", + "ĠRes olve", + "ĠLocal AccountToken", + "ĠEvent NameSpace", + "ĠExpand String", + "ĠAtt ack", + "rece iver", + "repro ast", + "stabl ished", + "etad ata", + "Provis ioning", + "hocol ate", + "WinSo ck", + "sevec ek", + "Ġtrun cate", + "Ġcreat ing", + "Stand ardProfile", + "Stub Path", + "Inline ProtocolHandler", + "WindowsAp ps", + "ubunt u", + "ubleCl ick", + "GetCred manCreds", + "GetRaw CertData", + "mounted path", + "Ġftp server", + "AtomicSafe Mode", + "passwordFilter Name", + "Currentactive User", + "ForAAD Graph", + "Ġ197 001010000", + "ĠREGIST RY", + "irePre Auth", + "Commenc ing", + "Engl ishPages", + "thumb nailpho", + "third Octet", + "NetTCP Connection", + "inelyTak ingAction", + "Ġinsp ect", + "ĠCMD S", + "ĠCryptog raphic", + "`\"`\" )`\")\";$", + "('-') );};;#", + "imewd bled", + "ĠImage Path", + "Ġantivirus product", + "ShellServiceObjectDel ayLoad", + "Ġprint f", + "Ġpush d", + "11355 6", + "AzDomain Info", + "spaw nto", + "ĠSystemParameters Info", + "3619 0899", + "ĠPubl isher", + "ĠPrimary GroupID", + "Seatb elt", + "Autos ize", + "Channe ls", + "PSRemo ting", + "websi te", + "AppCompat Flags", + "targetsecure pw", + "AsLocal UNCPath", + "Ġrestor al", + "Robert son", + "Ġmasquer ade", + "AzureADTenant Detail", + "DirectoryEnt ry", + "Ġdelet ion", + "NotRequ irePreAuth", + "ĠRequest ing", + "CreateRemote Thread", + "OnRealtime Enable", + "DisableInt rusionPreventionSystem", + "DisableIO AVProtection", + "DisableScan OnRealtimeEnable", + "DisableKeep Alive", + "DisableRout inelyTakingAction", + "ApplicationPermission s", + "Ġsessh ijack", + "ĠMini Dump", + "textExtra ction", + "PowerShellIc mp", + "TaskMod ifed", + "ĠWIT HIN", + "KeyExport Policy", + "IGdy ZX", + "ComputerFQ DN", + "RoleDefinition Id", + "4079 3", + "ktopimg downldr", + "notran saction", + "GoToAss ist", + "InstanceModification Event", + "MpCmd Run", + "Submit SamplesConsent", + "ĠOperator s", + "NDMu MDAy", + "SCHTAS KS", + "cmxsa WIyL", + "fullmemd mp", + "symb olic", + "expired ate", + "Ġspray ing", + "44455 3540600", + "AddressFam ily", + "ftpUr l", + "Ġevery thing", + "ScheduledTaskSettings Set", + "GVhZ GVyKCd", + "Ġtemporar ily", + "ĠEnableLin kedConnections", + "LaunchINFS ection", + "MaxConnections Per", + "ĠLong PathsEnabled", + "ĠVBox DRV", + "ĠDisablePriv acyExperience", + "evilscreen saver", + "aWNl Lm", + "ĠShellSmartScreen Level", + "ĠAsymm etricX", + "ĠDisabl ing", + "DEFA ULT", + "DESCRIP TION", + "dsenab leroot", + "CreationInclude CmdLine", + "AADIntAccessToken ForAADGraph", + "Enterprise Services", + "KerberosRequestorSecurity Token", + "NonExisting Script", + "RDPPORT Latest", + "Internalmonolog ue", + "PerfFormat tedData", + "CFBund le", + "hZGRfa GVhZGVyKCd", + "LOCRSDRC WDWO", + "PhishingAttach ment", + "PXVy bGxpYjI", + "sensit ive", + "DisallowExploit ProtectionOverride", + "CCDCLCSWRPWPDT LOCRSDRCWDWO", + "CnJl cS", + "CCLCSW LOCRRC", + "PUBL IC", + "ĠNFSHome Directory", + "EnumerateAzureBlob s", + "SimulateUserDo ubleClick", + "dXJsbG liM", + "trufflesn out", + "ĠLocalAccountToken FilterPolicy", + "thumbnailpho to", + "NDMuMDAy ID", + "! '", + "! ;", + "! \\", + "! ($", + "\" .", + "\" /", + "\" =", + "\" >", + "\" |", + "\" \";", + "\" ::", + "\" =\"", + "\" \\#{", + "\" ((", + "\" \":", + "\" )\"&&", + "\" \"%", + "# !/", + "$ )", + "$ ]", + "$ \";", + "% .", + "% /", + "% {", + "% ')", + "% ;\"", + "% '\"", + "% \"=", + "& (", + "& \"#{", + "& \"$", + "' \";", + "' )\"", + "' \\\"", + "' ;;#", + "' ./", + "' \";;$", + "' \";;#", + "' ))\\\"\"", + "' ~')|", + "' /;\\", + "( =", + "( ($", + "( )\"", + "( )\";$", + "( {$", + "( !(", + "( @('", + "( !$", + "( @{", + "( !($", + ") -", + ") }\"", + ") };$", + ") {$", + ") \";};;$", + "* #{", + "* &&", + "* \";", + "* ]\"", + "* ').", + "* /;", + "* ')&&", + "* (?", + "+ $", + "+ =", + "+ `\"", + "+ )\"", + "+ ');", + "+ \");", + ", #", + ", -", + ", `\"", + ", ('", + ", \\\"", + ", \");$", + ", @{", + ", ({$", + "- /", + "- ','", + ". \";$", + ". \\#{", + ". \")", + ". ')", + ". *.", + ". \");", + ". ((", + ". {$", + ". )[", + ". +'", + ". $_\"", + "/ +", + "/ ..", + "/ :$", + "/ *\"", + "/ \"&&./", + "/ /'", + "/ [^", + "/ \\/", + "/ ^/", + "/ -/", + "0 5", + "0 6", + "0 64", + "0 36", + "0 50", + "0 59", + "1 32", + "1 15", + "1 63", + "1 86", + "1 638", + "1 004", + "2 8", + "2 55", + "2 01", + "2 80", + "2 000", + "2 50", + "2 83", + "3 3", + "3 64", + "3 88", + "3 001", + "3 56", + "3 004", + "3 96", + "3 39", + "4 5", + "4 00", + "4 11", + "4 04", + "4 80", + "4 000", + "4 50", + "4 58", + "4 109", + "4 237", + "4 945", + "5 1", + "5 00", + "5 64", + "5 12", + "5 20", + "5 30", + "5 21", + "5 34", + "5 08", + "6 5", + "6 9", + "6 16", + "6 50", + "6 17", + "7 1", + "7 5", + "7 88", + "7 55", + "7 86", + "7 46", + "7 50", + "7 83", + "7 61", + "7 480", + "8 2", + "8 5", + "8 04", + "8 19", + "8 20", + "8 46", + "8 52", + "8 78", + "8 455", + "9 12", + "9 56", + "9 80", + "9 54", + "9 343", + ": <", + ": =", + ": ]", + ": ~", + ": \";", + ": =#{", + ": *:", + ": $(#{", + "; {;", + "; ([", + "; .\\", + "; __", + "< /", + "< \"#{", + "< \",\"#{", + "= .", + "= ?", + "= @", + "= ^", + "= \\\"", + "= ([", + "= {$", + "> \"", + "> $", + "> <", + "> '\"", + "> ,`\"", + "? '", + "? :[", + "@ $(#{", + "@ (@('", + "A J", + "A X", + "A i", + "A v", + "A At", + "A Ac", + "A ud", + "A ail", + "A Bo", + "A IT", + "A msi", + "A lt", + "A ML", + "A FE", + "A MD", + "A AB", + "A VE", + "A mmy", + "A YQB", + "A bw", + "A xMjcuMC", + "B J", + "B M", + "B N", + "B P", + "B Q", + "B R", + "B a", + "B r", + "B u", + "B ut", + "B ER", + "B sp", + "B sa", + "B LD", + "B pe", + "B zLn", + "B nn", + "B DX", + "B hdG", + "B ird", + "B HD", + "B wI", + "B TeXN", + "C S", + "C a", + "C d", + "C i", + "C k", + "C q", + "C t", + "C ro", + "C an", + "C am", + "C ate", + "C all", + "C ure", + "C HI", + "C Script", + "C AC", + "C AL", + "C lock", + "C rypt", + "C dd", + "C apture", + "C go", + "C DE", + "C alc", + "C TP", + "C loud", + "C TION", + "C ryptog", + "C Jz", + "C Yy", + "C hocolate", + "D M", + "D T", + "D l", + "D w", + "D z", + "D er", + "D on", + "D ro", + "D de", + "D Word", + "D IN", + "D rv", + "D An", + "D DE", + "D RI", + "D irection", + "D otnet", + "D rawing", + "D ebugger", + "D cmV", + "E H", + "E a", + "E e", + "E m", + "E o", + "E p", + "E s", + "E y", + "E ar", + "E OF", + "E ART", + "E AM", + "E sx", + "E CURITY", + "E GIN", + "F F", + "F G", + "F P", + "F T", + "F b", + "F i", + "F y", + "F ire", + "F ID", + "F CL", + "F li", + "F mk", + "F oreach", + "F unction", + "F inal", + "F irm", + "F ailure", + "F av", + "F bd", + "F Za", + "F activ", + "F OP", + "F TP", + "F sd", + "F pV", + "F END", + "F lush", + "F CYy", + "G N", + "G T", + "G U", + "G W", + "G c", + "G e", + "G k", + "G y", + "G op", + "G host", + "G zip", + "G GR", + "G If", + "G raphic", + "G ON", + "G ih", + "G vy", + "G GS", + "G ui", + "G ivenName", + "G luZ", + "H N", + "H S", + "H Y", + "H c", + "H f", + "H h", + "H j", + "H l", + "H it", + "H ub", + "H yp", + "H unt", + "H AL", + "H VM", + "H inf", + "H LL", + "H ook", + "H Mu", + "H wt", + "H GGR", + "I A", + "I K", + "I l", + "I r", + "I ss", + "I RE", + "I mp", + "I so", + "I COD", + "I xs", + "I AB", + "I ES", + "I SK", + "I BR", + "J K", + "J M", + "J k", + "J r", + "J x", + "J ps", + "J Script", + "J SV", + "J son", + "J Ff", + "J dH", + "J pX", + "J wcm", + "J Aail", + "K B", + "K G", + "K R", + "K T", + "K Y", + "K a", + "K j", + "K l", + "K To", + "K py", + "K VM", + "K sy", + "K IC", + "K vf", + "K TY", + "K qD", + "K cHJveHk", + "K Dz", + "K HGGR", + "L H", + "L R", + "L U", + "L X", + "L y", + "L ow", + "L ay", + "L ef", + "L VM", + "L xd", + "L START", + "L UN", + "L UA", + "L ater", + "L SA", + "L ittle", + "L Ni", + "L ZU", + "L jA", + "L ku", + "L Bsp", + "L CJz", + "L IBR", + "L JdH", + "L KqD", + "M F", + "M M", + "M Y", + "M v", + "M ub", + "M ult", + "M gr", + "M app", + "M orer", + "M AR", + "M uf", + "M imi", + "M SC", + "M SP", + "M AM", + "M MC", + "M isc", + "M tZ", + "M AZQB", + "M AI", + "M BIOS", + "M etadata", + "M BER", + "N F", + "N Z", + "N e", + "N h", + "N k", + "N q", + "N t", + "N u", + "N w", + "N z", + "N ic", + "N or", + "N ut", + "N ls", + "N NE", + "N ick", + "N CE", + "N mt", + "N sb", + "N hdG", + "O C", + "O W", + "O h", + "O s", + "O y", + "O in", + "O ef", + "O Ke", + "O SI", + "O ak", + "O SE", + "O UT", + "O II", + "O KS", + "O sx", + "O DAn", + "P C", + "P K", + "P Q", + "P T", + "P W", + "P b", + "P e", + "P i", + "P r", + "P t", + "P z", + "P ut", + "P RE", + "P pt", + "P rin", + "P Password", + "P end", + "P EN", + "P lease", + "P ubl", + "P ng", + "P OL", + "P eng", + "P anel", + "P rives", + "P ersistence", + "P erson", + "P ush", + "P FX", + "P Kz", + "P PL", + "P uT", + "P NPClass", + "P BM", + "P Gih", + "P Nk", + "P OW", + "Q S", + "Q Z", + "Q b", + "Q h", + "Q n", + "Q s", + "Q t", + "Q v", + "Q x", + "Q ue", + "Q EM", + "Q sh", + "Q Ag", + "Q EC", + "Q AA", + "Q CP", + "Q Wt", + "Q pJ", + "Q zV", + "Q PNk", + "R P", + "R i", + "R m", + "R n", + "R er", + "R ST", + "R VM", + "R TR", + "R ING", + "R cb", + "R ight", + "R BC", + "R SK", + "R QJ", + "R WX", + "R kb", + "R Hl", + "S b", + "S i", + "S x", + "S ur", + "S es", + "S ort", + "S ig", + "S heet", + "S SP", + "S av", + "S Jy", + "S ection", + "S sl", + "S cen", + "S ymlinkEvaluation", + "S BTeXN", + "T Z", + "T b", + "T m", + "T u", + "T x", + "T y", + "T or", + "T ath", + "T ring", + "T ip", + "T ry", + "T ER", + "T run", + "T ru", + "T cd", + "T ray", + "T AB", + "T SV", + "T kK", + "T itle", + "T ECT", + "T imer", + "T KY", + "U P", + "U V", + "U X", + "U c", + "U e", + "U f", + "U m", + "U x", + "U z", + "U RE", + "U ns", + "U Disable", + "U AL", + "U uid", + "U ZW", + "U sk", + "U mV", + "U DS", + "U uc", + "U QJ", + "V a", + "V e", + "V h", + "V j", + "V o", + "V ic", + "V an", + "V ault", + "V WR", + "V SC", + "V GV", + "V zd", + "V uln", + "V endor", + "V HD", + "V NC", + "V ba", + "V zc", + "V QS", + "W T", + "W i", + "W k", + "W id", + "W ul", + "W ls", + "W Un", + "W rm", + "W rap", + "W Qg", + "W Ug", + "W sx", + "W CM", + "W CMD", + "W KQ", + "W vZ", + "W wg", + "W atson", + "W UsIHN", + "W AIT", + "W Jwcm", + "W NhdG", + "W Qs", + "W Vzd", + "X Y", + "X Z", + "X b", + "X c", + "X aW", + "X AG", + "X CB", + "X nb", + "X Eo", + "X Hwt", + "X LSTART", + "Y N", + "Y Z", + "Y g", + "Y i", + "Y u", + "Y w", + "Y nt", + "Y our", + "Y ES", + "Y PASS", + "Y gcm", + "Y OU", + "Y Abw", + "Y EH", + "Y MtZ", + "Y SBTeXN", + "Y UDS", + "Y Wwg", + "Z A", + "Z F", + "Z Z", + "Z e", + "Z er", + "Z iB", + "Z LVM", + "Z Pr", + "Z Rer", + "[ (", + "[ :", + "[ {\"", + "[ *]\"", + "\\ '", + "\\ \";$", + "\\ ')", + "\\ .\"", + "\\ *\\", + "] )", + "] [", + "] }", + "] \"#{", + "] ([", + "] ;;#", + "] };$", + "] .\\", + "] ));$", + "] ),", + "] }};", + "] ;{", + "] ;;};$", + "] */;", + "^ \"]", + "_ \"", + "_ %", + "_ -", + "_ \")", + "_ })", + "_ '&&", + "_ ';;#", + "a H", + "a L", + "a a", + "a e", + "a RE", + "a pt", + "a ps", + "a ware", + "a ith", + "a ff", + "a WR", + "a GV", + "a Ha", + "a ZQ", + "a Zagne", + "a Ep", + "b F", + "b T", + "b f", + "b h", + "b p", + "b al", + "b ar", + "b de", + "b es", + "b ac", + "b and", + "b are", + "b ag", + "b ef", + "b us", + "b copy", + "b SI", + "b ypass", + "b AU", + "b mV", + "b gB", + "b xor", + "b XBvcnQg", + "b Ir", + "b Os", + "b WQs", + "c O", + "c P", + "c Y", + "c w", + "c er", + "c ord", + "c if", + "c is", + "c Ad", + "c sh", + "c ig", + "c Server", + "c ff", + "c fd", + "c ked", + "c uac", + "c bd", + "c Thread", + "c ryption", + "c fa", + "c ylance", + "c acy", + "c AaQB", + "c DH", + "c hocolate", + "c AX", + "c Bu", + "c HMu", + "c Xnb", + "d j", + "d m", + "d p", + "d w", + "d Re", + "d port", + "d ID", + "d Code", + "d Access", + "d Module", + "d RL", + "d sk", + "d av", + "d aily", + "d lY", + "d rt", + "d sed", + "d clist", + "d ontLog", + "d istinguished", + "d Ka", + "d Tru", + "d WUsIHN", + "d Yi", + "e C", + "e S", + "e g", + "e ab", + "e af", + "e ak", + "e mpire", + "e igh", + "e alth", + "f b", + "f c", + "f k", + "f v", + "f w", + "f ing", + "f un", + "f ers", + "f ore", + "f ru", + "f ault", + "f irewall", + "f db", + "f ree", + "f la", + "f AH", + "f bb", + "f Rl", + "f cc", + "f CB", + "f ba", + "f ront", + "f lush", + "f Fmk", + "g V", + "g W", + "g c", + "g in", + "g ath", + "g es", + "g In", + "g up", + "g PS", + "g sec", + "g zip", + "g ET", + "g DP", + "g dG", + "g cb", + "g lobal", + "g anization", + "g Et", + "g cc", + "g ui", + "g orh", + "g dXJsbGliM", + "g Jx", + "g Ksy", + "g YSBTeXN", + "h D", + "h G", + "h i", + "h j", + "h p", + "h on", + "h ex", + "h ll", + "h ub", + "h unt", + "h rd", + "h JI", + "h Vc", + "h gs", + "h AJ", + "h NZ", + "h bSI", + "i N", + "i i", + "i q", + "i ps", + "i wq", + "i JAail", + "i KT", + "j O", + "j ar", + "j LM", + "j av", + "j tY", + "j Jr", + "j Nw", + "j XEo", + "j YWwg", + "j eS", + "k r", + "k x", + "k z", + "k ec", + "k ID", + "k Se", + "k list", + "k mod", + "k AC", + "k ick", + "k TR", + "k vsc", + "k erberoast", + "k TG", + "k Cleanup", + "k ai", + "k ali", + "k AAB", + "k LH", + "k RVM", + "k Wi", + "k ZLVM", + "k hNZ", + "l S", + "l n", + "l r", + "l z", + "l ation", + "l is", + "l ower", + "l ive", + "l ma", + "l Se", + "l Create", + "l vb", + "l AH", + "l Book", + "l aunchctl", + "l zL", + "l IH", + "l LE", + "l ways", + "l bn", + "l IE", + "l gl", + "l ative", + "l ittle", + "l abel", + "l Byb", + "l BJ", + "l Ixs", + "l ZiB", + "l jJr", + "m n", + "m r", + "m u", + "m st", + "m nt", + "m ow", + "m ys", + "m he", + "m com", + "m un", + "m ers", + "m ir", + "m log", + "m ls", + "m im", + "m imi", + "m Ay", + "m etric", + "m etadata", + "n a", + "n y", + "n put", + "n if", + "n ir", + "n Te", + "n im", + "n sudo", + "n python", + "n cat", + "n gr", + "n um", + "n Output", + "n print", + "n The", + "n ish", + "n map", + "n itch", + "n Wait", + "n Successfully", + "n member", + "n ational", + "n privesc", + "n WH", + "n wq", + "n Rlbn", + "n Ee", + "o D", + "o P", + "o T", + "o c", + "o x", + "o on", + "o ing", + "o se", + "o op", + "o us", + "o Data", + "o reground", + "o Policy", + "o ci", + "o ctet", + "o sed", + "o cHJveHk", + "p E", + "p z", + "p op", + "p wn", + "p os", + "p Text", + "p oin", + "p Create", + "p ress", + "p dG", + "p pb", + "p rt", + "p erson", + "p blue", + "p rimary", + "p Cg", + "p pg", + "p etit", + "p GIf", + "p nput", + "p ose", + "q ow", + "q em", + "q WS", + "q PYT", + "q GX", + "q ZU", + "q eE", + "q wE", + "q FCYy", + "q cBu", + "q iwq", + "r at", + "r pt", + "r ab", + "r ary", + "r ack", + "r admin", + "r util", + "r ange", + "r Logon", + "r pZ", + "r ZXI", + "r Fn", + "r Gn", + "r mdir", + "r CTP", + "r QWt", + "r ganization", + "s B", + "s O", + "s ct", + "s con", + "s and", + "s Ap", + "s ted", + "s key", + "s aut", + "s delete", + "s ign", + "s Xml", + "s SV", + "s AM", + "s Trans", + "s info", + "s Hidden", + "s alt", + "s ection", + "s olve", + "s afe", + "s KcHJveHk", + "s Tring", + "s Xc", + "s gV", + "t i", + "t z", + "t on", + "t ro", + "t ion", + "t it", + "t he", + "t ain", + "t uf", + "t stat", + "t BA", + "t ie", + "t orun", + "t zZXJ", + "t gs", + "t rigger", + "t weet", + "t MF", + "t Um", + "t kZLVM", + "t qcBu", + "u h", + "u v", + "u in", + "u de", + "u Win", + "u pt", + "u AD", + "u ID", + "u ted", + "u um", + "u fo", + "u IC", + "u Block", + "u AG", + "u AH", + "u PX", + "u ational", + "u ally", + "u au", + "u vy", + "u HN", + "u Muf", + "u UmV", + "u qow", + "v W", + "v Y", + "v or", + "v en", + "v ol", + "v ac", + "v ation", + "v il", + "v ers", + "v ail", + "v AG", + "v GP", + "v launch", + "v IGZ", + "v ZG", + "v dC", + "v OKe", + "v Publ", + "v kWi", + "v nif", + "w o", + "w ow", + "w it", + "w get", + "w ific", + "w ard", + "w IC", + "w av", + "w az", + "w KS", + "w AaQB", + "w NC", + "w atson", + "w Oy", + "w Qsh", + "w aith", + "w uau", + "x v", + "x ord", + "x net", + "x copy", + "x mt", + "x Ow", + "x attr", + "x clip", + "x PXVybGxpYjI", + "x Ct", + "x PGih", + "x VQS", + "y b", + "y ss", + "y am", + "y mo", + "y box", + "y AG", + "y Yy", + "y TSConnections", + "y AxMjcuMC", + "y KG", + "y uqow", + "z f", + "z z", + "z on", + "z ST", + "z sh", + "z wn", + "z aW", + "z AH", + "z pf", + "z KS", + "z AHQ", + "z uj", + "z wE", + "z zg", + "z Hc", + "z bIr", + "z hVc", + "{ (", + "{ }", + "{ ;;", + "{ }}", + "{ _})", + "| ;", + "| [", + "| #{", + "| __", + "| /'", + "| %{", + "} &", + "} ?", + "} @", + "} ]", + "} _", + "} :/", + "} );$", + "} =#{", + "} /*", + "} /$", + "} }};", + "} -$", + "} -$(", + "} =)?", + "} (=", + "Ġ _", + "Ġ ro", + "Ġ ass", + "Ġ he", + "Ġ ord", + "Ġ word", + "Ġ am", + "Ġ To", + "Ġ ag", + "Ġ red", + "Ġ }&&", + "Ġ Lo", + "Ġ Th", + "Ġ ap", + "Ġ ST", + "Ġ qu", + "Ġ md", + "Ġ ef", + "Ġ etc", + "Ġ us", + "Ġ USER", + "Ġ }\";", + "Ġ ma", + "Ġ Command", + "Ġ Aut", + "Ġ remote", + "Ġ iex", + "Ġ SYSTEM", + "Ġ Exec", + "Ġ Script", + "Ġ Access", + "Ġ vi", + "Ġ Application", + "Ġ logon", + "Ġ Fo", + "Ġ NE", + "Ġ team", + "Ġ Explorer", + "Ġ LO", + "Ġ one", + "Ġ Foreground", + "Ġ Off", + "Ġ lock", + "Ġ Full", + "Ġ Session", + "Ġ hel", + "Ġ Login", + "Ġ Root", + "Ġ plist", + "Ġ InstallUtil", + "Ġ Startup", + "Ġ iwr", + "Ġ Short", + "Ġ Token", + "Ġ Base", + "Ġ val", + "Ġ Continue", + "Ġ Scheduled", + "Ġ 44", + "Ġ place", + "Ġ openssl", + "Ġ ufw", + "Ġ Encoded", + "Ġ 80", + "Ġ enter", + "Ġ Logon", + "Ġ mem", + "Ġ mount", + "Ġ allow", + "Ġ Notification", + "Ġ Env", + "Ġ message", + "Ġ ie", + "Ġ rsa", + "Ġ Quit", + "Ġ Edge", + "Ġ version", + "Ġ hostname", + "Ġ Scan", + "Ġ edit", + "Ġ LocalMachine", + "Ġ NPPSpy", + "Ġ Mod", + "Ġ oStream", + "Ġ services", + "Ġ }\"};", + "Ġ Prog", + "Ġ Prompt", + "Ġ virus", + "Ġ virtual", + "Ġ ignore", + "Ġ Authentication", + "Ġ over", + "Ġ head", + "Ġ ptt", + "Ġ CurrentUser", + "Ġ using", + "Ġ extract", + "Ġ max", + "Ġ Move", + "Ġ helper", + "Ġ original", + "Ġ ATOMIC", + "Ġ KEY", + "Ġ error", + "Ġ ntds", + "Ġ entry", + "Ġ Exploit", + "Ġ LocalAdmin", + "Ġ ExplorerSync", + "Ġ Job", + "Ġ Connected", + "Ġ model", + "Ġ Computers", + "Ġ Container", + "Ġ make", + "Ġ Expect", + "Ġ Scripting", + "Ġ LOLBin", + "Ġ SharpHound", + "Ġ places", + "Ġ GoAWSConsoleSpray", + "Ġ organizational", + "Ġ 909", + "Ġ acc", + "Ġ mouse", + "Ġ plutil", + "Ġ HIG", + "Ġ END", + "Ġ orginal", + "Ġ memberof", + "Ġ Commencing", + "er a", + "er ation", + "er min", + "er ne", + "er ator", + "er mal", + "er Network", + "er Certificate", + "er mission", + "er ature", + "er vis", + "er Hidden", + "er nel", + "Ġ- \"", + "Ġ- }", + "Ġ- )&&", + "in o", + "in v", + "in ame", + "in ary", + "in key", + "in vert", + "in ternal", + "in ished", + "in formation", + "re al", + "re name", + "re su", + "re ach", + "re ten", + "re porting", + "re store", + "re cord", + "re mcom", + "te e", + "te s", + "te ct", + "te gr", + "te ning", + "te lnet", + "te vil", + "on Tath", + "on ymo", + "Ġ\" ;", + "Ġ\" <", + "Ġ\" \";", + "Ġ\" :\\", + "Ġ\" ;;", + "Ġ\" :$", + "Ġ\" --", + "Ġ\" )'", + "Ġ\" )[", + "Ġ\" --------", + "at p", + "at r", + "at form", + "le n", + "le et", + "le ss", + "le are", + "le Show", + "le TS", + "le ments", + "le ndar", + "ro ss", + "ro ker", + "ro Sheet", + "st ion", + "st ab", + "st rok", + "st ations", + "st rip", + "st Qt", + "Ġ/ '", + "Ġ/ /#{", + "ic it", + "ic ing", + "ic ate", + "ic ted", + "ic we", + "ic ally", + "ic pCg", + "et w", + "et ers", + "et ype", + "et up", + "et ail", + "et Capture", + "et QEC", + "ec on", + "ec pol", + "or En", + "or ite", + "or por", + "me in", + "nt ad", + "al f", + "al g", + "al domain", + "al og", + "al go", + "al DLL", + "al Move", + "al recon", + "al pine", + "al dTru", + "ut c", + "ut u", + "ut able", + "ut logon", + "ss word", + "ss nTe", + "om atic", + "Ġ$ '", + "Ġ$ ?", + "ile ges", + "ex isting", + "ion Local", + "ion policy", + "ar ing", + "ar Set", + "ar ted", + "ar bit", + "ar ant", + "ser vation", + "ce s", + "ce ive", + "ce bc", + "ce dID", + "ow mount", + "en y", + "en ig", + "en umer", + "en codecmd", + "file system", + "file data", + "Ġ= (", + "&& .", + "&& $(", + "&& './", + "ur ly", + "ur andom", + "ad ers", + "ad id", + "ad em", + "ad computer", + "ad default", + "ad recon", + "ad vpack", + "de vice", + "de ed", + "de pen", + "de legate", + "de tect", + "it m", + "it ing", + "it ation", + "it group", + "it ance", + "lo l", + "lo cate", + "an ch", + "an get", + "an ning", + "}\" ).", + "}\" ';", + "}\" );$", + "}\" }';", + "ol s", + "ol ution", + "ol ufo", + "ll ers", + "ll OC", + "Path Name", + "Path Type", + "Pro cServer", + "ing Process", + "ing Server", + "ing Final", + "ass is", + "ass oc", + "ho k", + "ho ice", + "ho ts", + "ho utlogon", + "ho urly", + "Win word", + "Win Logon", + "Win HTTP", + "Win HTT", + "Win Sx", + "Win stations", + "ys ically", + "ct ure", + "ri ke", + "ri des", + "se l", + "se ten", + "user account", + "user dns", + "user PrincipalName", + "user daemon", + "he me", + "he duled", + "Ġt ar", + "Ġt rigger", + "Ġt weet", + "Ġt scon", + "Ġc password", + "Ġc op", + "Ġc pu", + "Ġc ustom", + "Ġc aption", + "Ġc ook", + "Ġc ome", + "Ġc cmstp", + "Ġc ron", + "Ġc ront", + "Ġc But", + "Ġc GluZ", + "Ġc zpf", + "Ġc leare", + "Ġc orpor", + "Ġc hoice", + "00 8", + "00 02", + "00 72", + "Ġ| %", + "Ġ| ;", + "Ġ| ?{", + "es cap", + "es NotRequirePreAuth", + "ac d", + "ac ct", + "ac ity", + "ac mr", + "St uff", + "St atic", + "St yle", + "St dModule", + "St rike", + "RE AD", + "RE DT", + "RE MAR", + "RE fv", + "In i", + "In her", + "In formation", + "In cis", + "In tegr", + "In depen", + "In ProcServer", + "Windows Identity", + "Windows Powershell", + "Windows Sensor", + "ert s", + "pt yp", + "pt ance", + "ue Ap", + "ps cp", + "ps provider", + "word list", + "reg file", + "reg as", + "reg istr", + "reg ister", + "\"; [", + "\"; #{", + "\"; ;;", + "Ġ' /", + "Ġ' }'", + "Ġ' \"#{", + "Ġ' );$", + "Ġ' ',", + "Ġ' ;;$", + "Ġ' };$", + "Ġ' .\\", + "Ġ' __", + "Ġ' ';$", + "Ġ' {\"", + "Ġ' &&[", + "Ġ' /;\\", + "Ġ' _'&&", + "Ġ' &&'./", + "am bd", + "Item s", + "com admin", + "com puters", + "com spec", + "art ment", + ":\\ \"", + "Ex ist", + "assword s", + "if f", + "if m", + "if config", + "Microsoft App", + "con host", + "un c", + "un lock", + "ate On", + "ation Call", + "and le", + "il ar", + "System Information", + "sc robj", + "sc ii", + "sc heme", + "ke bag", + "Ġ( %", + "Ġ( (", + "Ġ( \\", + "Ġ( *.", + "Ġ( !$", + "Ġ> $", + "Ġ> &", + "Ġ> (", + "to v", + "to string", + "ve mls", + "is playName", + "Get Value", + "Get Host", + "Get Text", + "Get Stream", + "Get All", + "Get Token", + "Get Response", + "Get Runtime", + "Get Help", + "Get Clipboard", + "Get Fi", + "Re P", + "Re S", + "Re pl", + "Re load", + "Re str", + "Re boot", + "Re lation", + "yp wm", + "are as", + "as te", + "as ive", + "as ync", + "as reproast", + "as hok", + "ch k", + "ch r", + "ch s", + "ch art", + "ch cp", + "ch address", + "ch attr", + "ch assis", + "At dm", + "}; \"", + "}; #", + "}; (", + "}; ;$", + "}; };", + "}; \"#{", + "Ġs l", + "Ġs ort", + "Ġs rc", + "Ġs af", + "Ġs ize", + "Ġs plit", + "Ġs qlite", + "Ġs mb", + "Ġs ide", + "Ġs ynch", + "Ġs yss", + "Ġs olution", + "To End", + "To History", + "To WindowsUpdate", + "To ols", + "To GetHelp", + "); '", + "); ;", + "); {;", + "); \"&&", + "); ;#", + "do aEp", + "do skey", + "New Name", + "New LocalAdmin", + "mo z", + "mo re", + "mo ck", + "mo vable", + "mo zilla", + "Ġf l", + "Ġf so", + "Ġf ilter", + "Ġf alse", + "Ġf ree", + "Ġf ramework", + "Ġf Allow", + "Ġf Den", + "Ġf etch", + "Ġf orest", + "Ġf Single", + "Ġf oreground", + "Ġf sinfo", + "Ġf uWin", + "Ġf inished", + "ag ic", + "red s", + "red Van", + "ab c", + "ab out", + "Ġ{ .", + "Ġ{ ;$", + "vice ID", + "Atomic Sn", + "Atomic TaskModifed", + "File Stream", + "File Share", + "File Menu", + "File ProtocolHandler", + "File Ext", + "ra WUn", + "ter check", + "all Users", + "all ports", + "all failure", + "Set File", + "Set Value", + "Set Password", + "Set Task", + "password policy", + "password spray", + "add file", + "add User", + "add store", + "up load", + "pl y", + "pl ied", + "pl rCTP", + "pl atform", + "pl icit", + "LM NO", + "LM II", + "Object Install", + "Object Class", + "Object sid", + "Object Cate", + "load File", + "32 4", + "32 521", + "Current Cred", + "pro w", + "pro tection", + "pro fil", + "pro vides", + "pro vlaunch", + "For Credential", + "For Pend", + "For ward", + "User name", + "User List", + "User list", + "User Principal", + "User Dns", + "User Thread", + "User DomainName", + "User Hunt", + "pert y", + "Ser vers", + "Ġ\"$ ([", + "Ġ\"$ _\"", + "able VBox", + "net rc", + "net cat", + "net vsc", + "ĠD ate", + "ĠD RO", + "ĠD rive", + "ĠD OT", + "ĠD etonate", + "ĠD oes", + "ĠD river", + "ĠD ont", + "ĠD IS", + "ĠD rawing", + "ĠD ebugger", + "ĠD ISK", + "log mein", + "ip hon", + "ip leTS", + "ĠĠĠĠ ĠĠ", + "id Wls", + "Sec ret", + "ure lock", + "REG SV", + "Type Definition", + "Ġadd r", + "Ġadd user", + "Ġ1 1", + "Ġ1 20", + "Ġ1 46", + "Ġ1 27", + "Ġ1 024", + "Ġ1 45", + "em ulation", + "em ptyp", + "ly Bird", + "}&& #", + "). \"", + "). $", + ":// \"", + "64 5", + "64 43", + "Ġthe m", + "Ġthe Path", + "Ġthe ir", + "ity Sup", + "Out file", + ":: \"", + ":: '", + "Ġb z", + "Ġb us", + "Ġb rowser", + "Ġb oot", + "Ġb ios", + "Lo v", + "Version s", + "Version String", + "Version Indepen", + "ver ify", + "Write All", + "cl ud", + "cl HIG", + "Th ings", + "Th reat", + "Th ere", + "Th ermal", + "Ġ[ [", + "ment Command", + "ment Provider", + "script file", + "script ing", + "domain s", + "domain pass", + "domain dump", + "domain passwordpolicy", + "ST ap", + "ST DIN", + "ST lz", + "Start Type", + "ul ar", + "Com Server", + "Com ple", + "Com mon", + "Com mun", + "OR CE", + "bin st", + "Host Name", + "get t", + "get String", + "get Bytes", + "get go", + "get owner", + "get global", + "15 0", + "15 1", + "15 5", + "15 56", + "15 59", + "EM Ea", + "AD D", + "AD Domain", + "AD Principal", + "AD ServicePrincipal", + "AD DomainController", + "AD MIN", + "AD Repl", + "service binary", + "10 10", + "10 40", + "10 34", + "10 90", + "10 48", + "10 87", + "qu ires", + "qu kLH", + "qu arant", + "En um", + "En crypt", + "En cryption", + "rc var", + "Ġw script", + "Ġw ork", + "Ġw ant", + "Ġw ould", + "Ġw ere", + "12 3456789", + "12 0002", + "Ad Group", + "Ad Computer", + "Ad AB", + "Ad ABo", + "OF A", + "th ly", + "th ack", + "th read", + "th reat", + "Net Connection", + "Net Sup", + "Net DomainTrust", + "Net ForestTrust", + "sh rc", + "sh arp", + "sh ips", + "sh owmount", + "NT Hash", + "NT VWR", + "system store", + "system info", + "ef eb", + "ef rFn", + "ef sAp", + "op end", + "op erator", + "test bypass", + "Process ID", + "Process Id", + "Process CreationIncludeCmdLine", + "($ _.", + "exec reload", + "ls mod", + "ls SJy", + "ry iz", + "Ġ0 7", + "Ġ0 1010000", + "Ġin put", + "Ġin ster", + "Ġin fo", + "Ġin si", + "Ġin deed", + "Ġin clud", + "im s", + "im al", + "im orh", + "im itation", + "ER Y", + "ER SHELL", + "ARE D", + "eb f", + "eb oot", + "ĠC lear", + "ĠC lean", + "ĠC leanup", + "ĠC alc", + "ĠC ERT", + "Ap artment", + "%\\ %", + "Security Settings", + "Security Center", + ";; ($", + "`\" )\"", + "`\" `\")\";$", + "ary PathName", + "(' $", + "(' ^", + "(' }'", + "(' ='", + "(' ',", + "(' %')", + "(' .')", + "(' \\')", + "Man Creds", + "Ġ{; #{", + "Ass oci", + "Ġ; &", + "Ġ; {", + "Ġ; }", + "Ġ; #{", + "Ġ; &&", + "Ġ; ;$", + "Ġ; '@", + ".. #{", + ".. .;", + ".. ;#{", + "Ġd d", + "Ġd s", + "Ġd x", + "Ġd y", + "Ġd ue", + "Ġd ate", + "Ġd srm", + "Ġd clist", + "Ġd ontLog", + "Ġd istinguished", + "Ġd etail", + "Ġd eny", + "Ġd isplayName", + "count dmp", + "command s", + "command line", + "command torun", + "Install able", + "Install Screen", + "Install Hel", + "Install Hinf", + "Control Panel", + "us ly", + "us kit", + "rep end", + "min idump", + "dll filename", + "start sw", + "Assembly Path", + "col or", + "object s", + "object sid", + "ID ont", + "Ac pi", + "SER T", + "Ġ2 1", + "Ġ2 56", + "Test Guid", + "Test Iso", + "Password NotRequired", + "Password Vault", + ")\" );$", + "HI AZQB", + "HI Hj", + "HI JK", + "cmd line", + "USER DOMAIN", + "USER DN", + "ted Hosts", + "ive Shell", + "host PID", + "}' \"", + "}' ;;", + "}' ));", + "}' ,$", + "}' ;};;$", + "}' )).", + "}' \";;#", + "}' );;$", + "Service AppRole", + "ms v", + "ms dc", + "ms zST", + "}\\ $", + "}\\ \";$", + "}\\ *.*", + "}\\ *#{", + "}\\ ..;#{", + "ĠI F", + "ĠI O", + "ĠI f", + "ĠI t", + "ĠI sHidden", + "ĠI cedID", + "Ġg s", + "Ġg it", + "Ġg cp", + "Ġg pg", + "Ġg oing", + "Ġg rab", + "local user", + "local server", + "Ġa udit", + "Ġa use", + "Ġa vail", + "Ġa scii", + "ext s", + "Dis m", + "Dis play", + "Dis pose", + "}\"; %", + "}\"; }", + "}\"; #{", + "}\"; };", + "ack map", + "Power Up", + "so ck", + "Ġ&& $", + "Ġ&& \";", + "63 68", + "63 616", + "Cl i", + "Cl jtY", + "ror bl", + "Ġex ample", + "Ġex filtr", + "Ġex chaddress", + "Shell s", + "Shell Command", + "Ġp art", + "Ġp ayload", + "Ġp grep", + "Ġp riv", + "Ġp air", + "Ġp bcopy", + "Ġp cw", + "Ġp aste", + "Ġp repend", + "mote Signed", + "11 12", + "Az Automation", + "Az Event", + "Az ADUser", + "Az Ny", + "Az ADServicePrincipal", + "ient s", + "sp onsor", + "sp eak", + "ĠSystem BiosVersion", + "Action Center", + "ma ps", + "ma kec", + "Ġn ow", + "Ġn ul", + "Ġn ext", + "Ġn os", + "Ġn map", + "Ġn umber", + "Ġn eigh", + "36 0", + "36 819", + "set file", + "set not", + "set secure", + "set webproxy", + "Ġ] ];", + "string s", + "Add ing", + "Add FromString", + "Add ToHistory", + "ĠP ATH", + "ĠP ASS", + "ĠP etit", + "ĠP NPClass", + "ĠP OSI", + "ĠP ermission", + "ĠP reten", + "ĠP urelock", + "EX T", + "EX p", + "EMP HY", + "Run Handler", + "Run DLL", + "Run book", + "ud p", + "ud XJ", + "ud Hh", + "key file", + "key log", + "Aut oruns", + "Ch zZXJ", + "Ch XaW", + "PS Session", + "PS Provider", + "os x", + "Ġ}; &", + "Ġ}; };$", + "web Server", + "web exce", + "web browser", + "web request", + "web dav", + "bo ur", + "bo und", + "bo Wsx", + "gr ab", + "Log s", + "Log file", + "Log Path", + "Log Name", + "Log off", + "Log ged", + "Log ical", + "Text File", + "App end", + "App Cert", + "App Activate", + "App vPubl", + ")) {", + ")) |", + ")) )\"", + ")) {;", + ")) )'", + ")) ),", + "Id s", + "Id PT", + "Ġpassword spray", + "target host", + "target ServerIP", + "download Trigger", + "dec odecmd", + "dec omp", + "dir list", + "wd Strike", + "Ġuser s", + "Ġuser enum", + "External Device", + "Azure Admin", + "Azure Stealth", + "Azure Rm", + "=' ;", + "=' ;$", + "=' ))\\\"\"", + "=' *';", + "As Client", + "As ync", + "As Hex", + "As ynch", + "As PPL", + "Ġre plication", + "Ġre move", + "Ġre source", + "Ġre size", + "Ġre hash", + "Ġre covery", + "Ġre lative", + "Ġre solve", + "Ġre ceive", + "Ġre movable", + "Ġre quires", + "'); @(@('", + "0000 00", + "process name", + "Ġst ill", + "Ġst rip", + "Ġst arted", + "Server Xml", + "Server XML", + "(\" (", + "(\" .\"", + "(\" \\\\", + "(\" ,\");$", + "(\" [*]\"", + "cation Length", + "for files", + "for war", + "pass view", + "pass hunt", + "Ġ+ %", + "Ġ@ '", + "Ġ@ (", + "Ġ@ ';", + "Ġ@ ('#{", + "Ġ@ ();$", + "Ġ@ ();;", + "client s", + "List er", + "Ro oT", + "um ing", + "Secure Desktop", + "Secure Boot", + "query type", + "prin tercheck", + "Ġ. (", + "Ġ. ;", + "Ġ. /*", + "Ġ. ('%')", + "Ġm icrosoft", + "Ġm ain", + "Ġm any", + "Ġm sedge", + "Ġm agic", + "'; [", + "'; };$", + "que mu", + "vm m", + "vm w", + "vm bus", + "vm xnet", + "Ġnet stat", + "account policies", + "Mo X", + "Mo MY", + "Content Type", + "Use Rundll", + "Use LogonCredential", + "Use CurrentCred", + "ĠT O", + "ĠT he", + "ĠT CP", + "ĠT rue", + "ĠT ARGETPID", + "ĠT GS", + "ĠT GT", + "ĠT rack", + "ĠT ermin", + "Ġif lag", + "Ġis Secure", + "Ġis Http", + "Ġ$( #{", + "Ġ$( ($", + "AzureAD Domain", + "AzureAD ServiceAppRole", + "CO NNE", + "be gin", + "Ġfile system", + "Ġcreate vm", + "Exec Chrome", + "Exec utable", + "Exec Reload", + "Output Assembly", + "=\" (", + "ns dump", + "ns AM", + "Script let", + "ute s", + "Ġde sk", + "Ġde lim", + "execut ing", + "execut ionpolicy", + "Management Path", + "Management Class", + "Not Connect", + "ff HS", + "systemd rive", + "Account s", + "Account Type", + "Account Enabled", + "Account Lock", + "55 4", + "55 35", + "Domain s", + "Domain Group", + "Domain Policy", + "Domain Share", + "Domain GroupMember", + "Domain GPO", + "SZ WQg", + "SZ aGV", + "cp Cgo", + "cp cDH", + "sub r", + "ws f", + "Ġ\\ /", + "Ġ\\ \"#{", + "ĠRe start", + "ĠRe lease", + "ĠRe place", + "ĠRe moteSigned", + "Connect Async", + "CL AS", + "CL EART", + "CL REfv", + "Code Module", + "Null Or", + "server Path", + "Ġsh own", + "Ġsh aring", + "Create From", + "Create NewLocalAdmin", + "Create TextFile", + "Access For", + "Access Time", + "Access Policy", + "Access VB", + "Access Right", + "Def ense", + "cert ctl", + "cert req", + "ĠA ntivirus", + "ĠA lways", + "ĠA ny", + "On Users", + "On Startup", + "On Logon", + "On Ca", + "On uv", + "On SecureDesktop", + "ge tent", + "sec onds", + "vb d", + "vb nRlbn", + "win rm", + "win PE", + "Ġ* ;", + "Ġ* )\"", + "Ġ* >>", + "Ġ* :*:", + "old checks", + "Disable d", + "Disable Remote", + "Disable Internet", + "Disable Att", + "Disable Notify", + "Disable Notifications", + "Disable Uns", + "Disable SecuritySettings", + "cr x", + "cr mlog", + "cr ackmap", + "fo reground", + "fo ZZ", + "Application Firewall", + "Application Guard", + "57 08", + "ED go", + "Web View", + "Web Exception", + "Web Configuration", + "Web Browser", + "Web Global", + "mac os", + "ĠIgn ition", + "\") ]", + "\") &&", + "\") };", + "\") );{", + "\") [-", + "De tector", + "De pth", + "Line Option", + "logon passwords", + "Ġnot hing", + "(); ;$", + "(); ;[", + "16 7", + "16 54", + "16 5708", + "ĠM IN", + "ĠM achine", + "ĠM MC", + "ĠM ON", + "ĠM ulti", + "ĠM sXml", + "ĠM EMPHY", + "Automation AccountName", + "Fo ko", + "Sp onsor", + "aut omation", + "ne ver", + "Local FilePath", + "Enable Firewall", + "Enable SecureBoot", + "92 1", + "AC EMEa", + "AC DisableNotify", + "data only", + "data storage", + "ml uc", + "26 564", + "86 1", + "86 7", + "86 921", + "Des cen", + "}. %", + "}. $(", + "}. *'", + "}. *').", + "Ġl ow", + "Ġl arg", + "Ġl isten", + "Ġl anguage", + "Ġl pv", + "Ġl ittle", + "Ġl aZagne", + "Ġl ambd", + "Ġl imitation", + "Ġ$_. \"", + "binary cookies", + "LO AD", + "LO GON", + "WR M", + "\\\" )\"", + "\\\" );$", + "no body", + "no tevil", + "ress Preference", + "() {", + "() }", + "() };", + "() )\"", + "() [-", + "() +`\"", + "() ]}};", + "Bo cC", + "Bo chs", + "iz ers", + "per io", + "per mut", + "') ,", + "') )\"&&", + "') );\"&&", + "') ).\"", + "Copy From", + "Do esNotRequirePreAuth", + "Do NotConnect", + "NA GU", + "powershell sensitive", + "sys m", + "sys rc", + "sys call", + "sys vol", + "sys wow", + "}\", #", + "Ġcon sole", + "Ġcon firm", + "Ġcon structor", + "Ġcon nected", + "Ġcon tro", + "Admin AuditLog", + "99 9", + "99 999", + "AL TIME", + "AL Ue", + "PD Q", + "SI CAL", + "Ġ5 4", + "Ġ5 000000", + "Ġh w", + "Ġh ow", + "Ġh ash", + "Ġh ave", + "Ġh igh", + "Ġstart ing", + "Ġstart vm", + "Remove Definition", + "AtomicTest FileT", + "print cmd", + "No Save", + "No KC", + "No ZW", + "No Ii", + "No Wrap", + "zip file", + "ĠSet Wallpaper", + "Module Path", + "Module Name", + "Un ified", + "Un ique", + "Un attend", + "Un block", + "Un privileged", + "Un hrd", + "tp bXBvcnQg", + "Ġnew file", + "Act iv", + "line Hosts", + "Ġ`\" ,", + "Ġ`\" `\")\";$", + "Inter national", + "ple t", + "Ġtest ing", + "Ġtest cat", + "util s", + "ssh pass", + "Winlogon TokenSystem", + "', ([", + "Cred SSP", + "Cred ManCreds", + "Group Membership", + "Mal icious", + "af d", + "ak teul", + "ĠS ort", + "ĠS ET", + "ĠS QB", + "ĠS amAccountName", + "ĠS CR", + "ĠS ymlinkEvaluation", + "ĠS AML", + "ĠS ECURITY", + "ĠS MBIOS", + "ĠS nitch", + "ick Timeout", + "Ġfor mat", + "Ġfor ces", + "AR CH", + "AR CHI", + "AR IES", + "IN SERT", + "Off lineHosts", + "Task mgr", + "Up Cm", + "Up dater", + "Up loading", + "Up loadFile", + "tra ce", + "ĠW ill", + "ĠW armup", + "lock screen", + "Ġcom puters", + "Ġcom spec", + "Ġcom sx", + "Temp erature", + "04 0", + "19 6", + "19 43", + "19 71", + "Rec ent", + "li Bpe", + "Ġset Zer", + "proc s", + "Key chain", + "Key Mgr", + "Key strok", + "13 5", + "13 37", + "13 96", + ":\" $", + ";}; ;#", + ";}; ;[", + "dc sync", + "dc cuac", + "mk temp", + "sa Db", + "sa ntad", + "Ġget accountpolicies", + "Ġ\"\" .", + "Ġ\"/ \"", + "Ġ\"/ ?", + "auth token", + "auth NotRequired", + ";# $", + "]\" '", + "]\" \").", + "ĠY ES", + "Ġlog out", + "Ġlog man", + "att ache", + "def b", + "def s", + "def end", + "Files InPV", + "Session Name", + "Session Per", + "cloud audit", + "cloud front", + "create object", + "create dump", + "dy lib", + "history length", + "wr iting", + "Ġ3 389", + "Ġ3 33", + "Ġ3 852", + "Ġcat alog", + "ify vm", + "ify cmdline", + "module s", + "105 6", + "Dir Lister", + "Ru WRM", + "pw policy", + "role s", + "Computer Admin", + "Computer Status", + "Computer Defaults", + "Excel VBAaddin", + "cron job", + "Dow ngr", + "db d", + "db m", + "db af", + "nc mV", + "ob dev", + "ob servation", + "ph Y", + "ph p", + "ph ant", + "ph PXVybGxpYjI", + "ph ysically", + "use back", + "Ġls of", + "Ġch passwd", + "Ġch ange", + "Ġch flags", + "ache ments", + "Stream Read", + "Stream Wr", + "Event ID", + "From Image", + "From Parent", + "Pre quest", + "Pre authNotRequired", + "Principal Id", + "Principal Context", + "Principal Source", + "The ir", + "The Hash", + "The Things", + "find all", + "ng ivenName", + "not like", + "ten z", + "ari os", + "dent ProgID", + "destination path", + "Provider Path", + "Reg Key", + "class name", + "Comp ress", + "Comp Color", + "Comp onents", + "AppData Low", + ")&& ([", + "20 22", + "20 29", + "All Files", + "All Screen", + "All Check", + "All Lov", + "All TheThings", + "Cim Provider", + "NO E", + "js KV", + "pwd length", + "Sharp View", + "Sharp Cloud", + "Sharp Watson", + "calc ulator", + "ATH Remote", + "Util s", + "IP Address", + "Qu cm", + "Qu ickTimeout", + "ax r", + "cate d", + "dsc rpt", + "Ġen um", + "Ġpro file", + "Ġpro to", + "Ġpro gram", + "Ġpro perty", + "inst alled", + "msi exec", + "executable path", + "contain ers", + "*\" );{", + "Im mutable", + "Im mers", + "Mp rLogon", + "Mp xCt", + "Mp Threat", + "Mp ComputerStatus", + "lt ZW", + "mon thly", + "man ufacturer", + "}) '", + "}) \\", + "}) \";;", + "}) *(?", + "}) @$(#{", + "Ġ& \"$", + "Ġ& (\"{", + "Ġ& \\\"\"", + "ĠO S", + "ĠO U", + "ĠO UT", + "ĠO rig", + "ĠO NCE", + "ĠO PEN", + "ĠO rganization", + "ĠO STap", + "delete User", + "Config Updater", + "Startup Type", + "Startup Items", + "dump ert", + "dump cr", + "56 6", + "56 09", + "Mode Description", + "ast Enabled", + "io file", + "io reg", + "io Device", + "ĠH istory", + "ĠH aHa", + "Ġad vpack", + "Ġexecut ing", + "Ġ\"[ \"", + "Ġ\"[ #{", + "Ġ\"[ !]", + "search Vuln", + "Read Write", + "Read ToEnd", + "Short VersionString", + "Network information", + "share enumer", + "Execute s", + "Execute Shortcut", + "Execute ShellCommand", + "Ġdelete s", + "Ġdelete journal", + "Resource Id", + "Resource AppId", + "Desktop Anti", + "Desktop Switch", + "37 78", + "Dll s", + "Ver b", + "Ver ification", + "Ver ified", + "Ġk erberoast", + "Ġk ali", + "Ġk ernel", + "Ġ\"\\ \\$", + "stream s", + "stream Command", + "\";; ./", + "profile s", + "Client DLL", + "Client Accessib", + "Client ConfigUpdater", + "force dCode", + "Certificate Check", + "Certificate Valid", + "22 19", + "Ag c", + "Ag TG", + "Ag SZaGV", + "HO ST", + "HO OKS", + "ND Jps", + "SD B", + "SD OMAIN", + "Tr ING", + "VM ware", + "VM Firm", + "VM TZ", + "cm UsIHN", + "cm Dw", + "cm NoKC", + "full Name", + "sy mlink", + "ĠStart W", + "ĠStart EXE", + "ĠStart Menu", + "Ġ\"% #{", + "export PFX", + "Token Manip", + "1547 007", + "Base Stream", + "Base Settings", + "Min imal", + "ZX Es", + "ite cture", + "la Zagne", + "tim ers", + "ĠAD FS", + "ĠAD MIN", + "exp ression", + "exp ires", + "exp osed", + "ans om", + "Remote Path", + "Remote Management", + "Remote PC", + "Remote AccessPolicy", + "Remote CertificateValid", + "Ġsp ctl", + "Ġsp read", + "Ġsp awn", + "Search Scope", + "Search RooT", + "Ġsession s", + "',' ^", + "',' #{", + "44 1", + "44 2", + "44 878", + ";} }}", + "[$ $]", + "df ca", + "conf irm", + "ish ingServer", + "156 6", + "156 909", + "Ġexp ression", + "Recur sive", + "Environment s", + "\"} }", + "\"} );", + ".\\ /", + "09 5609", + "27 4", + "27 5", + "27 9", + "27 81", + "27 68", + "29 4", + "29 6", + "Open Read", + "Open With", + "Open URL", + "Open Calc", + "Pack etCapture", + "ftp Server", + "gg ing", + "gg Ii", + "gg fCB", + "ia Nut", + "ĠF alse", + "ĠF OU", + "ĠF ORCE", + "ĠG ET", + "ĠG OT", + "ĠG uard", + "ĠG lobal", + "ĠG UI", + "ĠU P", + "ĠU SE", + "ĠU bn", + "ĠU UID", + "ĠU ACDisableNotify", + "Ġe e", + "Ġe pl", + "Ġe sentutl", + "Ġe stablished", + "Ġe lements", + "Ġx lApp", + "Ġx attr", + "Ġx lBook", + "Ġon start", + "Ġon logon", + "Ġas reproast", + "ĠUser name", + "ĠUser PrincipalName", + "ĠUser Authentication", + "ĠUser Init", + "&&# !/", + "rib utes", + "users dpsLight", + "raph y", + "program files", + "Properties My", + "Member Definition", + "-- /", + "BA SH", + "Firewall Policy", + "Public Profile", + "Xml Document", + "mm hd", + "rer eg", + "vc GVu", + "extension s", + "regsv cs", + "comp lete", + "Ġwin defend", + "fox prow", + "\",\" \",$", + "default s", + "Virtual Address", + "Virtual Screen", + "\"); #", + "\"); }", + "\"); };", + "(( ($", + "21 4", + "94 3001", + "Active Directory", + "Active View", + "IC Y", + "My Process", + "My Custom", + "Save As", + "bi x", + "di alDLL", + "gt a", + "ĠB lock", + "ĠB otnet", + "ĠB EGIN", + "ĠB YPASS", + "ĠB inary", + "Ġun set", + "Ġun lock", + "Ġun install", + "Ġun iq", + "ĠAtomic User", + "ĠAtomic Task", + "ĠAtomic TaskModifed", + "Ġadmin countdmp", + "ĠEnable ModuleLogging", + "ĠEnable Tran", + "ĠEnable ScriptBlockLogging", + "ĠEnable LUA", + "ĠNo te", + "ĠNo Run", + "ĠNo Find", + "ĠNo Desktop", + "ĠNo Close", + "ĠNo LogOff", + "ĠNo Tray", + "ĠNo FileMenu", + "ĠNo SetTask", + "ĠNo ControlPanel", + "ĠNo PropertiesMy", + "debu gging", + "ange Me", + "}\") ).", + "}\") '&&", + "acce ptance", + "access chk", + "Ġsystem d", + "Ġsystem state", + "spool er", + "spool vuln", + "mail box", + "NET Core", + "Internet Shortcut", + "Internet Locations", + "$_ \\", + "$_ \",", + ")); \\\\", + "80 80", + "80 530", + "Launch Application", + "Mail Nick", + "Max Size", + "QB hX", + "QB tAGUA", + "QB XAG", + "QB yAG", + "SP ORT", + "disable d", + "disable s", + "pu k", + "xs ize", + "xs PV", + "Ġ< $", + "ĠL ite", + "ĠL IK", + "ĠL saDb", + "ĠCreate s", + "ĠGroup Membership", + "Ġsub mit", + "enter prise", + "Auto load", + "Auto Exec", + "Logon Server", + "Ġ@{ \"", + "Ġ@{ };", + "Connection State", + "Online Management", + "security Context", + "security cent", + "security Center", + "Update Deploy", + "\")) )", + "\")) ", + "EC K", + "MD M", + "MD NS", + "OL D", + "WS Reset", + "filter warnings", + "filter fw", + "firm ware", + "ial ize", + "iss uer", + "wb cat", + "ĠV SS", + "Ġal pine", + "Ġal tit", + "ĠTest User", + "Ġkey mgr", + "Ġ\"( ?<", + "Ġ\"( .{$", + "stop event", + "enc rypt", + "del ims", + "Ġcl one", + "Ġcl ipboard", + "Ġcl ients", + "allow Run", + "allow AccessFor", + "ĠDisable Notification", + "ĠDisable Anti", + "ĠDisable Registry", + "ĠDisable CMD", + "ĠDisable Lock", + "ĠDisable Change", + "ĠDisable Restr", + "ĠDisable Taskmgr", + "Ġpass phrase", + "close d", + "evil reg", + ")' ;$", + ")' ).", + ")' \";;", + ")( !(", + ")( ?:[", + "02 443", + "72 50", + "AB hAHQ", + "AB CDE", + "AB uAG", + "Bin aryPathName", + "Block Block", + "IF Ry", + "SE S", + "SE ARCH", + "SV C", + "UT E", + "WD BLD", + "Wall Paper", + "Wmi Method", + "aW Ygcm", + "fi x", + "priv s", + "rd Ck", + "}, >,`\"", + "Ġte lnet", + "Ġte sted", + "ĠEx fil", + "ĠEx change", + "ĠEx clusion", + "ĠEx plicit", + "ĠCommandLine Template", + "ĠCommandLine EventConsumer", + "Ġ\"# \\!/", + "org Value", + "org LegalNoticeText", + "org LegalNoticeCaption", + "encode hex", + "itch d", + "Window Title", + "session Gop", + "Info Tip", + "\";}; ;", + "\";}; ;;", + "propert ies", + "ĠIP C", + "Response Text", + "\": [\"", + "\": [{\"", + "=$ |[^", + "=$ !;", + "AU Options", + "AU ABhAHQ", + "By dj", + "II S", + "KC kK", + "MS RV", + "MS XML", + "OT M", + "PRO CE", + "PRO XY", + "TR AN", + "TR UE", + "Wait ForPend", + "ZW qGX", + "event s", + "event Name", + "event log", + "event vwr", + "xd WVzd", + "}: %", + "ĠNet Wire", + "ĠSecurity He", + "ĠSecurity Lay", + "Ġmod ifyvm", + "Ġssh d", + "Context Type", + "Context Menu", + "Ġ'# '", + "Ġ'$ ($", + "connect port", + "connect address", + "ĠDis connect", + "ĠDis kCleanup", + "ĠDis allowRun", + "http only", + "http Logging", + "http logging", + "START ING", + "START UP", + "build cache", + "Runtime Environment", + "\"' &&", + "08 007", + "246 5", + ";[ ^/", + "AA AA", + "AA YQB", + "AA QAA", + "AA QBhX", + "AG UAL", + "AH cAaQB", + "AH ealth", + "Machine List", + "OS Arch", + "Parent PID", + "Parent Container", + "__ };", + "av Protection", + "az on", + "bl E", + "bl kvsc", + "gp p", + "gp result", + "gp BE", + "ie uinit", + "kub erne", + "pre fix", + "sam file", + "sam rat", + "tt l", + "tt t", + "}`\" \"", + "}`\" ,", + "}`\" `", + "}`\" `\"`\")\";$", + "Ġ6 5535", + "ĠName dPipe", + "ĠLog ical", + "Ġrule s", + "Ġcert util", + "common datastorage", + "keep Versions", + "very one", + "ĠCh romium", + "ĠCh arSet", + "ĠCh angeMe", + "Roaming ClientConfigUpdater", + "Ġ\\\" \\\"", + "Ġ\\\" \\\";", + "Ġchang ing", + "Ġchang es", + "Ġproject s", + ";\"@ ;#", + "&`\" `\",", + "&`\" `\"`\",", + "){ [", + "-] *", + "-] [^", + "14 86", + "47 1", + "47 76", + "50 396", + "83 64", + "96 00", + "AM SI", + "CH AR", + "CH ECK", + "Cmd let", + "GP G", + "GP PPassword", + "IME WDBLD", + "Port Number", + "Post Context", + "Trust Relation", + "bG Ev", + "bG Ug", + "bd WH", + "cs product", + "cs rutil", + "dG xl", + "dG ltZW", + "ds path", + "ds query", + "job s", + "kill all", + "pb paste", + "pf ul", + "pf ctl", + "power view", + "power SQL", + "param eters", + "vbox guest", + "vbox sf", + "zL lBJ", + "Ġu Action", + "Ġu Param", + "Ġu Block", + "Ġreg ular", + "ĠProcess Name", + "ĠProcess Id", + "ĠProcess ors", + "ĠProcess CreationIncludeCmdLine", + "Ġos ascript", + "Ġvb ext", + "enable d", + "namespace s", + "Att ributes", + "Ġsec onds", + "Ġsame Site", + "Creation Time", + "Share Access", + "Share Finder", + "Share dAccess", + "shadow copy", + "Installed SDB", + "Authent icode", + "Authent icate", + "Check If", + "Check ShareAccess", + "=\"$ ($", + "=\"$ !\"&&", + "ldap domaindump", + "Ġspec ified", + "AADInt ADUser", + "AADInt Back", + "AADInt SAMLToken", + "guest Account", + "response body", + ")[ -", + "*\\ .", + "012 3456789", + "53 1", + ";& $", + "Dump WCM", + "Monitor Process", + "Non Public", + "Pass View", + "SH ARED", + "Sign ature", + "Sign erCertificate", + "UN ICOD", + "VE NTVWR", + "Za ffHS", + "\\\"; \\", + "ci X", + "cab test", + "xl cig", + "Ġ4 1", + "Ġ4 1943", + "ĠR ansom", + "Ġr mdir", + "Ġr saut", + "Ġsc anning", + "Ġsc heduled", + "Ġupdate d", + "inject ionLocal", + "leg it", + "ntlm users", + "any desk", + "total closed", + "Reporting Mode", + "chrome exec", + "Ġsys rc", + "Ġsys adminctl", + "Ġsave d", + "... &&#{", + "Ġdisplay name", + "Ġ};}; &", + "Ġ};}; [", + "Ġ};}; '@", + "(\"{ `", + "Ġshare s", + "Ġshadow s", + "Ġshadow storage", + "CreateProcess With", + "CreateProcess FromParent", + "ĠART User", + "Device Guard", + "auto it", + "auto Delete", + "permission s", + "ldif de", + "HTA Uri", + "ZXN zaW", + "Help Text", + "Msol User", + "DnsName List", + "), )\";$", + "), '~')|", + "/' .\\/", + "@(' {", + "Al erts", + "BI g", + "Back stab", + "Clear Logs", + "Gener ation", + "Gener alrecon", + "IH BzLn", + "IH NoZW", + "NS AVE", + "Nl KCkK", + "Sys Wow", + "Sys internal", + "Sync AppvPubl", + "With Logged", + "Zone Temperature", + "brute user", + "brute force", + "cb c", + "fa ctory", + "hk Wr", + "iB W", + "ker nel", + "kit tenz", + "tb LZU", + "we ek", + "wmi Object", + "wmi object", + "yB TeXN", + "}/ \";$", + "ĠE OF", + "ĠE stablished", + "ĠE veryone", + "ĠE VENTVWR", + "ĠPath s", + "ĠWindows Aud", + "ĠUn reach", + "ĠAuto Exec", + "ĠAuto dialDLL", + "stor s", + "stor vsc", + "orig ins", + "Prog Ids", + "Prompt ForCredential", + "Ġtcp dump", + "Status Code", + "ĠDC Sync", + "ĠDC Shadow", + "Show UI", + "Show KeyMgr", + "Ġper form", + "AzureADUser Password", + "AzureADServicePrincipal KeyCredential", + "Ġ\\\\ \\\"", + "Ġ\\\\ ?\\", + "Ġ\\\\ $(#{", + "Boot Execute", + "Ġconnect port", + "Ġconnect address", + "Template PE", + "Allow SecondaryAuthentication", + "Allow TSConnections", + "Allow ExternalDevice", + "IPC ERT", + "Level Override", + "activ ate", + "ĠHide Clock", + "ĠHide FileExt", + "zLn BocC", + "Authentication Type", + ",\" <\",\"#{", + "23 39", + "24 3", + "59 5", + "59 595", + "97 9", + "=* -*", + "AZ AAg", + "AZ QAg", + "Browser Collect", + "CF puk", + "CR ven", + "Cap acity", + "Empire Project", + "Fa ctory", + "Fa ctor", + "Fa Cdd", + "He ight", + "He aders", + "Jy xVQS", + "Last WriteTime", + "Last AccessTime", + "MT gEt", + "MT sgV", + "Ps iphon", + "RI A", + "VB Project", + "VB Components", + "]$ {_})", + "]' (", + "]' ').", + "bk f", + "dom u", + "hZ bOs", + "kK cHMu", + "lu kebag", + "lib audit", + "mV sSV", + "mt Yn", + "over rides", + "sn aps", + "sn iff", + "sn itchd", + "sample s", + "wait one", + "zd WJwcm", + "}}; };", + "})) )\"", + "Ġ7 26564", + "Ġy yy", + "Ġlo cked", + "Ġlo cated", + "Ġms online", + "Ġaccess es", + "Ġaccess ed", + "Ġ\"{ }\";", + "status policy", + "Ġ== =", + "des ktop", + "des ktopimgdownldr", + "locale ctl", + "head less", + "Console Output", + "Ġ'% '\"", + "Ġ'( ?<", + "Ġ'( &(", + "Ġ'* '\"", + "Ġ'* :\\'", + "Ġsim mutable", + "Ġsim ulation", + "Ġsim ilar", + ");{ ;$", + "other checks", + "CurrentUser Object", + "Shadow copy", + "NetEvent PacketCapture", + "Ġinter active", + "extract me", + "Ġpf ctl", + "spec ific", + "max Downloads", + "Ġread me", + "AzureADApplication KeyCredential", + "ĠMS FT", + "ĠMS Acpi", + "trans fers", + "evt x", + "manip ulated", + "Ġ\"\\\\ .\\#{", + "---- \"|", + "ĠLast WriteTime", + "Ġjournal ctl", + "}',' ~')|", + "pYyB SZWQg", + "GPO Audit", + "GPO ComputerAdmin", + "GPO RemoteAccessPolicy", + "Transport Type", + "dotnet fun", + "iWindowPos X", + "iWindowPos DX", + "iWindowPos DY", + "ATOMIC REDT", + "\"] [", + "\"] ,\"", + "()) ,", + "()) ')&&", + "()) };[", + "77 12", + "78 243", + "Aa AAg", + "ASCII Encoding", + "BU G", + "Ev asive", + "Fin ished", + "HJ Ze", + "HJ vY", + "Ii Tu", + "Ii Atdm", + "Mac roSheet", + "Mac adem", + "QU IC", + "QU IRE", + "Qg LX", + "RU Rn", + "Rt lCreate", + "SK zg", + "SK IPCERT", + "SU Usk", + "Sup press", + "Sup erHidden", + "Sim onTath", + "TS M", + "VID E", + "Wire shark", + "Work book", + "Work station", + "XJ rZXI", + "XN jQ", + "XN liBpe", + "ZG xlcig", + "\\/ ]*\\", + "]*\\ .\"", + "browser pwn", + "cv zf", + "dC A", + "fake domain", + "listen port", + "pk i", + "pri ority", + "Ġq c", + "Ġq fe", + "Ġan onymo", + "ĠIn c", + "ĠIn bound", + "Ġall profiles", + "ĠInstall util", + "Ġusername s", + "Ġstring s", + "ĠUse LogonCredential", + "ĠUse ActionCenter", + "ĠAtomicTest FileT", + "Ġrole s", + "error reporting", + "Ġ\". *\"", + "Ġ\". *\\.", + "}\"\" \")))); '", + ">)); '&&", + "AI ABuAG", + "AQ jm", + "AQ QByAG", + "Bz IC", + "Bit map", + "Bit sTrans", + "CM dw", + "Cb Osx", + "Cb Defense", + "Core Services", + "DH P", + "Dn scat", + "DNS Server", + "DNS Exfiltr", + "FX vGP", + "Ff cP", + "Fn ZW", + "Fu Unhrd", + "Fu ZGxlcig", + "GX ihUQJ", + "Gn H", + "IS NU", + "Ik hl", + "JI jeS", + "Jz tzZXJ", + "KQ ppb", + "KV LJdH", + "Kv Nor", + "Kz u", + "Ls N", + "Ls Gy", + "Lu Lu", + "NB NS", + "NB wt", + "OG KvNor", + "Or der", + "Own er", + "Own ingProcess", + "PL ACEMEa", + "Qo KQppb", + "Rh bdWH", + "Rh bGxfb", + "Ry dWUsIHN", + "SG CCciX", + "SG FuZGxlcig", + "SS OR", + "Sn aff", + "Site s", + "Svc host", + "Skip CertificateCheck", + "SQL ite", + "TIME OUT", + "UID Yu", + "Uso DLL", + "Uso ClientDLL", + "Vbox C", + "Vbox Drv", + "WX YZ", + "Wx ZaffHS", + "Yn Byb", + "aX R", + "aX QoKQppb", + "ai Wx", + "bC cpCgo", + "bC GnH", + "bw limit", + "cz ssnTe", + "cz tpbXBvcnQg", + "crypt o", + "dH A", + "daf thack", + "driv ers", + "driv etype", + "eE wo", + "fin der", + "fin ally", + "gener ic", + "gener aldomain", + "hX v", + "hl IEF", + "hy ZXEs", + "hAHQ AZQAg", + "jA HIAZQB", + "jQ IdPT", + "jm Dde", + "jZXN zLlBJ", + "jZXN zLnBocC", + "ku yuqow", + "last log", + "last login", + "mh WT", + "mh GXihUQJ", + "mof comp", + "mwc name", + "mwc path", + "nb tstat", + "nf t", + "nf HLL", + "pJ S", + "pV P", + "pot am", + "pot ato", + "ron ous", + "sl xOw", + "tY XJrZXI", + "tv kSe", + "tv JztzZXJ", + "tAGUA IAB", + "uj BHD", + "va RIA", + "wI ChXaW", + "wR vkWi", + "wR llOC", + "wg b", + "zV AgSZaGV", + "zc vf", + "{}; }", + "}% \")", + "}% %'\"", + "ĠRE ALTIME", + "ĠRE QUIRE", + "Ġver ify", + "Ġver ified", + "Ġop mode", + "Ġop eration", + "ĠAss umes", + "ĠAss uming", + "Ġask tgt", + "Ġask tgs", + "ĠApp leShow", + "Ġvm m", + "Ġvm w", + "Ġvari able", + "Ġvari ables", + "Ġany more", + "ĠVideo BiosVersion", + "ĠVideo ModeDescription", + "ĠQU IC", + "ĠQU ERY", + "Ġ\"^ [", + "Ġ=\" `\"", + "Ġtot al", + "Ġtot ally", + "Ġtrust Root", + "Ġtrust dmp", + "Ġclose d", + "NamedPipe System", + "Inf DefaultInstall", + "Inject View", + "Inject Context", + "Inge stion", + "Inge stors", + "Inbox Rule", + "Ġ'[ [:", + "Ext Pt", + "Exfiltr ation", + "Ġ(& (\"{", + "GetCurrent Domain", + "};& $", + "Ġsvc Version", + "Ġsvc host", + "Ġfollow ing", + "Ġfollow ed", + "ĠDE FEND", + "ĠDE BUG", + "Ġ13 37", + "Ġ17 00", + "Ġbu cket", + "Ġbu ckets", + "NetIP Address", + "NetIP Interface", + "execstop post", + "Manip ulated", + "Ġ20 16", + "ĠInterface Alias", + "Ġextension s", + "Ġprin ter", + "Ġprin tenv", + "Ġpwd historylength", + "Ġpwd properties", + "ĠPRO VIDERORDER", + "ĠPRO VIDE", + "AppRole s", + "))) }))", + "(\"\\ \")[-", + "(\"\\ \\\");$", + "Ġmy Secret", + "ExecStop Post", + "ĠReporting Mode", + "CreateThread Native", + "ĠAnti VirusProduct", + "();@(' %", + "();@(' ^", + "ĠMain tenance", + "ĠMax MpxCt", + "ĠMax Capacity", + "ĠMonitor Process", + "Locations InPV", + "NoAuto Update", + "NoAuto Reboot", + "Activate MicrosoftApp", + "Interface Alias", + "afe LocationsInPV", + "ĠSave Nothing", + "ĠWall paper", + "ĠWall Paper", + "Ġcomputer name", + "Ġsetup api", + "crontab s", + "FromString A", + "HTT PS", + "monitor s", + "}){ @('{", + "ĠHel lo", + "ĠHel pText", + "Tran scription", + "cmV xPXVybGxpYjI", + "Feder ation", + "Feder ated", + "SecondaryAuthentication Factor", + "\",\"-- \",\"/", + "Mailbox Permission", + "Mailbox AuditBypass", + "Ġ<< <", + "024 2", + "ASR Rules", + "swap on", + "swap off", + "Smb Share", + "Smb Mapp", + "ĠMicrosoftRedirection Program", + "ĠMicrosoftRedirection URL", + "AuditLog Ingestion", + "AuditBypass Enabled", + "ĠRename d", + "CreateProcessSystem Bind", + "ĠAutoShare Server", + "ĠAutoShare Wk", + "+/] )\";$", + "+/] )(?:[", + "HistorySave Path", + "HistorySave Style", + "Ġsimulate s", + "Evil reg", + "Evil Startup", + "Blbi hj", + "Blbi hyZXEs", + "Etw Thread", + "Etw pCreate", + "Rlbn Y", + "ĠProxy Server", + "ĠProxy Enable", + "ĠScreenSave Active", + "ĠScreenSave Timeout", + "RpZnlpbmcgcm MuY", + "RpZnlpbmcgcm Mub", + "BIOS Version", + "Pfx FileName", + "Pfx Certificate", + "Sensor Service", + "XBvcnQg dXJsbGliM", + "yZWFkKC k", + "yZWFkKC kKcHMu", + "CreateRemoteThread Native", + "IGdyZX Ai", + "IGdyZX AgTG", + "cmxsaWIyL lByb", + "cmxsaWIyL mluc", + "MaxConnectionsPer Server", + "aWNlLm NyZWF", + "CFBundle Version", + "CFBundle ShortVersionString", + "hZGRfaGVhZGVyKCd Db", + "hZGRfaGVhZGVyKCd Vc", + "sensitive files", + "\":: (\"{", + "%\"= =\"", + "'\\\" \";", + ")- $($", + "+= $_.", + "+)\" ).", + ",\\\" $(", + "/.. ./", + "/:$ //'", + "/[^ -][^", + "/-/ |/'", + "064 0", + "036 1", + "059 72", + "115 3778", + "186 94", + "1638 4", + "201 7", + "280 635", + "283 339", + "388 0", + "404 58400", + "458 36819", + "4945 441", + "534 4661034", + "508 1", + "650 520", + "617 279", + "788 5", + "786 09", + "783 635", + "804 50396", + "820 7480", + "912 53", + "956 5", + "9343 13", + ":] ]'", + ":~ -", + ";__ |;", + "=? \"", + "=@ ();$", + "=^ |[^", + "Av dG", + "AAt AE", + "AAc gBvAG", + "Amsi Utils", + "Alt WinSock", + "Ammy y", + "AYQB tAGUAIAB", + "BP g", + "BQ YMtZ", + "Br AGUAL", + "Bsa WtlIE", + "BDX qwE", + "BhdG ggIi", + "BwI AAAA", + "Cq qiwq", + "Cro wdStrike", + "Can not", + "Cam era", + "Cure P", + "CAC HE", + "Crypt oPolicy", + "Cryptog raphy", + "DM AQjm", + "Der ive", + "Don aldTru", + "Dro plet", + "DRI VE", + "Dotnet search", + "Em Nz", + "Ey AAQAA", + "Ear lyBird", + "Esx Cli", + "FG HIJK", + "FP Png", + "Fb D", + "Fy dC", + "Fire pwd", + "FID O", + "FCL OSE", + "Fli y", + "Failure s", + "Fav orite", + "Fbd gpBE", + "FZa Nmt", + "Factiv ity", + "FOP EN", + "Fsd WUg", + "FpV K", + "GW zVAgSZaGV", + "Ge o", + "Ghost Task", + "Gzip File", + "Graphic s", + "GGS xPGih", + "Hf Vj", + "Hit olufo", + "Hyp ervis", + "HAL T", + "Il fo", + "Iss uer", + "Imp ersonate", + "JM aXR", + "JSV jQIdPT", + "JFf mtYn", + "JpX GN", + "KR ShowKeyMgr", + "KTo KIC", + "Kpy Yw", + "KTY eEwo", + "KDz Kv", + "KHGGR x", + "Lef t", + "Lxd hZbOs", + "LUN vbnRlbn", + "LNi HfVj", + "LjA wNC", + "LCJz ZXNzaW", + "LIBR ARIES", + "Mv RHl", + "Morer econ", + "Mimi Peng", + "MAM gBfAH", + "MAZQB zAH", + "MAI AAtAE", + "Ne ver", + "Nh bCcpCgo", + "Nq Kj", + "Nt Que", + "Nic cXnb", + "Oh ujBHD", + "Oin T", + "Oef cacy", + "OII OFA", + "ODAn O", + "PQ RST", + "PW Gc", + "Pi AvdG", + "PRE LOAD", + "Ppt VBAaddin", + "Prin ting", + "POL ICY", + "Prives c", + "Push Notifications", + "PKz IiTu", + "PuT TY", + "POW ERSHELL", + "QZ hAJ", + "Qh wRllOC", + "Qv Ny", + "Qx MDM", + "QEM U", + "QCP CS", + "QzV mhWT", + "Rcb doaEp", + "RBC D", + "RSK p", + "RQJ qWS", + "RWX injectionLocal", + "Si O", + "Sur name", + "Ses Uz", + "Sig non", + "Sav ing", + "Ssl Stream", + "Scen arios", + "Tb ml", + "Tm LxdhZbOs", + "Tx L", + "Ty Pe", + "Tor Exe", + "TER MSRV", + "Trun cationLength", + "TSV PU", + "TkK jXEo", + "TECT URE", + "TKY P", + "UV WXYZ", + "Uc jh", + "Uf L", + "Ux KTYeEwo", + "UDisable mentCommand", + "Uuid FromStringA", + "Va oD", + "Vh cmNoKC", + "Vo id", + "Vic HJvY", + "VGV hbSI", + "Vba Project", + "Vzc y", + "Wid th", + "Wul XNliBpe", + "Wrm gDP", + "WCMD ump", + "WKQ HIHj", + "WvZ AU", + "WNhdG lvb", + "XZ bF", + "XCB Tbml", + "XHwt kRVM", + "Ynt j", + "YOU R", + "YAbw BrAGUAL", + "YEH PX", + "YUDS NOE", + "ZRer jmDde", + "].\\ .)[", + "]), @('", + "]*/; |__", + "^\"] *')&&", + "_\") }", + "aRE PLACEMEa", + "aware ness", + "aWR lbn", + "bh dump", + "bal oon", + "bes imorh", + "bare os", + "bWQs IHNoZW", + "cif s", + "cAd QBtAGUA", + "cThread Ex", + "dp bi", + "dRe khNZ", + "dRL jh", + "drt m", + "dsed itgroup", + "distinguished Name", + "dKa C", + "dYi SUUsk", + "fk CRven", + "fing er", + "fru it", + "fault s", + "fla vor", + "fbb f", + "fRl QpJ", + "fFmk Nu", + "gath erNetwork", + "gIn BzIC", + "gPS B", + "gsec dump", + "gdG hlIEF", + "gorh ill", + "gdXJsbGliM i", + "gKsy mmhd", + "hi Ik", + "hll dz", + "hJI boWsx", + "iJAail slxOw", + "iKT sKcHJveHk", + "jav aw", + "jNw hkWr", + "jYWwg PiAvdG", + "kr nl", + "kx wn", + "kz G", + "kick start", + "kTR lIH", + "kTG sXc", + "kAAB SU", + "lis tening", + "lma WNhdGlvb", + "lSe dRLjh", + "lAH AAYQB", + "lzL mV", + "lLE q", + "lgl Oefcacy", + "little snitchd", + "lIxs dRekhNZ", + "ljJr Y", + "mst sc", + "mow dbd", + "mys ecpol", + "mir rorbl", + "mim url", + "mimi load", + "metric s", + "nir cmd", + "nim grab", + "nish ang", + "nWait ing", + "nmember Of", + "nWH MoMY", + "nEe DMAQjm", + "ox MS", + "oop BPg", + "pop d", + "pos ition", + "poin ter", + "pdG NoIi", + "prt procs", + "petit potam", + "pGIf lS", + "pnput il", + "qem u", + "qeE uvy", + "sand box", + "sAM AccountType", + "safe dump", + "ton s", + "the Path", + "tuf nEeDMAQjm", + "tBA Q", + "tie dump", + "tkZLVM uMuf", + "tqcBu BIg", + "upt ime", + "uAD MAMgBfAH", + "uIC plrCTP", + "uAH YAbwBrAGUAL", + "uPX QzVmhWT", + "uHN mAy", + "uUmV xdWVzd", + "vac uum", + "vZG lmaWNhdGlvb", + "wific reds", + "waz uh", + "wKS BsaWtlIE", + "wOy Bydj", + "wQsh iBW", + "waith andle", + "wuau clt", + "xord ump", + "xmt MoX", + "yam l", + "zon es", + "zwn pVP", + "zAHQ AIABuAG", + "zuj fRlQpJ", + "zHc gJx", + "zbIr JFfmtYn", + "zhVc TKYP", + "}=)? (?=$|[^", + "}(= =)?|[", + "Ġro ute", + "Ġass umes", + "Ġhe ap", + "Ġword pad", + "Ġam azon", + "ĠTo astEnabled", + "Ġag ain", + "Ġ}&& [", + "ĠLo avProtection", + "ĠTh en", + "Ġap ply", + "ĠST RING", + "Ġqu it", + "Ġmd atp", + "Ġef i", + "Ġus n", + "Ġma xsize", + "ĠCommand line", + "ĠAut omatic", + "ĠExec uted", + "ĠScript Text", + "Ġvi a", + "ĠFo und", + "ĠNE Q", + "ĠLO GIN", + "ĠFull Access", + "Ġhel pful", + "ĠLogin Hook", + "ĠInstallUtil Path", + "Ġval ues", + "Ġ44 5", + "Ġmem ory", + "Ġie advpack", + "ĠMod ify", + "ĠProg ressPreference", + "ĠPrompt OnSecureDesktop", + "Ġvirtual ization", + "Ġignore allfailure", + "ĠAuthentication LevelOverride", + "Ġover writing", + "Ġmax pwdage", + "ĠKEY WORD", + "ĠScripting Engine", + "Ġorganizational Person", + "Ġ909 0", + "Ġacc ross", + "ĠHIG H", + "real name", + "rename File", + "resu me", + "record ing", + "Ġ\":\\ \";", + "Ġ\":$ \"", + "Ġ\")' &&", + "Ġ\")[ ^\"]*')&&", + "Ġ\"-------- ----\"|", + "leet speak", + "strip chart", + "stQt TmLxdhZbOs", + "icing a", + "icted Admin", + "icwe J", + "etQEC fkCRven", + "orEn forcedCode", + "alMove ment", + "arbit rary", + "enig ma", + "adid nsdump", + "addefault domainpasswordpolicy", + "itance Type", + "anch ors", + "ingFinal izers", + "WinLogon TokenSystem", + "WinHTT Prequest", + "WinSx S", + "seten force", + "useraccount control", + "userdns domain", + "Ġcop ied", + "Ġcook ies", + "Ġcron jobs", + "Ġcront ab", + "ĠcBut tons", + "ĠcGluZ yAxMjcuMC", + "Ġcleare d", + "Ġcorpor ation", + "escap e", + "READ ME", + "REMAR K", + "Inher itanceType", + "Incis ive", + "Integr ity", + "ueAp cThreadEx", + "regas m", + "registr ation", + "Ġ'', [", + "ateOn DesktopSwitch", + "ationCall back", + "vemls bGEv", + "GetHost Addresses", + "GetAll TrustRelation", + "GetResponse Stream", + "GetRuntime Directory", + "GetFi eld", + "ypwm FZaNmt", + "async waithandle", + "Ġsaf eboot", + "Ġsmb status", + "Ġsyss etup", + "ToWindowsUpdate InternetLocations", + "mock bin", + "ĠfAllow ToGetHelp", + "ĠfDen yTSConnections", + "ĠfSingle SessionPer", + "ĠfuWin Ini", + "redVan ity", + "AtomicSn ake", + "raWUn LCJzZXNzaW", + "LMNO PQRST", + "LMII gnition", + "ObjectInstall Action", + "ObjectCate gory", + "32521 7", + "profil er", + "Forward To", + "UserDns Domain", + "UserHunt er", + "ĠDRO P", + "ĠDOT NET", + "ĠDoes NotRequirePreAuth", + "ĠDriver Version", + "ĠDont ShowUI", + "ĠDIS ABLE", + "ĠDISK DRIVE", + "ipleTS Sessions", + "idWls ZF", + "REGSV R", + "emptyp asswords", + "itySup ported", + "Ġbus ybox", + "Ġbrowser s", + "Ġboot statuspolicy", + "VersionIndepen dentProgID", + "verify ctl", + "WriteAll Bytes", + "clHIG aL", + "Thermal ZoneTemperature", + "domainpass spray", + "STlz ljJrY", + "Comple tedHosts", + "Commun itySupported", + "getglobal state", + "ADPrincipal GroupMembership", + "ADRepl Account", + "servicebinary path", + "quarant ine", + "Ġwork station", + "123456789 0", + "AdAB lAHAAYQB", + "AdABo AG", + "threat s", + "NetSup port", + "sharp hound", + "efrFn LNiHfVj", + "efsAp i", + "opend ns", + "lsSJy uICplrCTP", + "ryiz oopBPg", + "Ġ01010000 1971", + "Ġinster ted", + "Ġinsi de", + "Ġinclud ing", + "ĠClear text", + "ĠCalc ulator", + "`\")\" '", + "('}' )[", + "('=' )[", + "('', (", + "Associ ation", + "Ġ;'@ ;$", + "Ġdistinguished name", + "Ġdetail s", + "InstallScreen Saver", + "InstallHel per", + "InstallHinf Section", + "startsw ith", + "IDont Exist", + "PasswordVault Credentials", + "USERDN SDOMAIN", + "}')); \")&&", + "msdc s", + "Ġaudit d", + "Ġause arch", + "Ġavail able", + "Display Alerts", + "sock s", + "CljtY au", + "Ġexfiltr ation", + "Ġexchaddress es", + "Ġpriv ileges", + "Ġpcw utl", + "AzAutomation Runbook", + "AzEvent Hub", + "makec ab", + "Ġnos immutable", + "Ġnumber ed", + "Ġneigh bour", + "setnot ifycmdline", + "setsecure webproxy", + "AddToHistory Handler", + "ĠPetit Potam", + "ĠPOSI X", + "ĠPermission s", + "ĠPreten ding", + "ĠPurelock er", + "RunHandler ComServer", + "udXJ sb", + "webexce ption", + "webbrowser passview", + "Logical Disk", + "AppCert Dlls", + "decomp ile", + "dirlist er", + "AzureAdmin s", + "AzureRm Account", + "Asynch ronous", + "Ġremove d", + "Ġrecovery enabled", + "Ġreceive d", + "ServerXml Http", + "ServerXML HTTP", + "(\".\" );$", + "(\"\\\\ ?\\", + "forwar ding", + "Ġ./* &&", + "ĠTrack ing", + "ĠTermin ateOnDesktopSwitch", + "ĠisHttp Only", + "AzureADServiceAppRole Assignment", + "CONNE CTION", + "begin Connect", + "nsAM AccountName", + "Scriptlet URL", + "Ġdelim s", + "AccountLock Failures", + "cpcDH ps", + "CLAS SES", + "CLEART EXT", + "CLREfv wQshiBW", + "CreateFrom Directory", + "AccessVB OM", + "AccessRight s", + "OnCa lendar", + "Onuv FbD", + "winPE AS", + "DisableRemote DesktopAnti", + "DisableInternet FilesInPV", + "DisableAtt achements", + "DisableUns afeLocationsInPV", + "crackmap exec", + "foreground color", + "EDgo axr", + "WebConfiguration Property", + "WebBrowser PassView", + "WebGlobal Module", + "Detector Id", + "165708 5", + "ĠMIN UTE", + "ĠMachine Guid", + "ĠMulti String", + "ĠMEMPHY SICAL", + "Foko y", + "Descen ding", + "Ġlarg er", + "Ġlisten port", + "Ġlpv Param", + "Ġlambd a", + "LOGON SERVER", + "()]}}; &", + "perio d", + "permut ations", + "CopyFrom Screen", + "DoNotConnect ToWindowsUpdateInternetLocations", + "Ġcontro llers", + "AdminAuditLog Config", + "RemoveDefinition s", + "NoSave Cache", + "Unified AuditLogIngestion", + "Activ ator", + "akteul len", + "ĠSQB uAHYAbwBrAGUAL", + "ĠSCR NSAVE", + "ĠSECURITY POLICY", + "ĠSMBIOS BIOSVersion", + "ARCHI TECTURE", + "lockscreen url", + "Ġcomsx Res", + "ĠsetZer oData", + "Keychain s", + "Keystrok es", + "attache d", + "Ġ3852 01", + "Downgr ade", + "ncmV wIC", + "phant om", + "useback q", + "StreamRead er", + "StreamWr iter", + "2029 5", + "AllScreen s", + "AllCheck s", + "jsKV UE", + "ATHRemote FXvGP", + "dscrpt sc", + "installed On", + "*\");{ (\"[*]\"", + "Immutable ID", + "Immers iveShell", + "MprLogon Script", + "})*(? :[", + "ĠOUT PUT", + "ĠOrig in", + "shareenumer ation", + "ExecuteShortcut Command", + "ClientAccessib le", + "NDJps qnzwE", + "VMFirm ware", + "cmDw hy", + "ĠStartMenu LogOff", + "TokenManip ulation", + "RemoteCertificateValid ationCallback", + "095609 02443", + "2781 761", + "2768 196", + "OpenWith ProgIds", + "OpenCalc Task", + "ggfCB ncmVwIC", + "ĠFOU ND", + "ĠGOT O", + "ĠGlobal Flag", + "ĠUbn utu", + "ĠUserInit MprLogonScript", + "rereg server", + "vcGVu ZXIocHJveHk", + "MyCustom RegKey", + "ĠEnableTran scripting", + "ĠNoTray ContextMenu", + "ĠNoSetTask bar", + "ĠNoPropertiesMy Documents", + "}\")'&& $", + "Ġsystemstate backup", + "spoolvuln scan", + "80530 6368", + "MailNick Name", + "xsPV RydWUsIHN", + "ĠLIK E", + "ĠLsaDb ExtPt", + "securitycent er", + "UpdateDeploy mentProvider", + "Ġaltit ude", + "Ġ\"(?< =^|[^", + "ĠDisableNotification Center", + "ĠDisableAnti Spyware", + "ĠDisableRegistry Tools", + "ĠDisableLock Workstation", + "ĠDisableChange Password", + "ĠDisableRestr ictedAdmin", + "7250 6", + "ABCDE FGHIJK", + "IFRy aWRlbn", + "aWYgcm Uuc", + "},>,`\" #{", + "ĠExchange OnlineManagement", + "ĠExclusion Path", + "ĠExplicit ly", + "sessionGop her", + "AUABhAHQ AaAAg", + "PROCE SSOR", + "TRAN SPORT", + "WaitForPend ingFinalizers", + "ZWqGX B", + "ĠSecurityHe alth", + "ĠSecurityLay er", + ";[^/ ]*/;|__", + "AHcAaQB uADMAMgBfAH", + "OSArch itecture", + "ParentContainer Dn", + "kuberne tes", + "samrat ashok", + "bGUg U", + "dGxl XCBTbml", + "Authenticode Signature", + "Authenticate AsClient", + "CheckIf Installable", + "AADIntADUser NTHash", + "AADIntBack door", + "UNICOD E", + "Ġ41943 04", + "Ġrsaut l", + "CreateProcessWith Pipe", + "IHBzLn N", + "NlKCkK aWYgcmUuc", + "Sysinternal s", + "SyncAppvPubl ishingServer", + "WithLogged OnUsers", + "tbLZU efrFnLNiHfVj", + "week ly", + "ĠWindowsAud ioDevice", + "ĠUnreach able", + "AllowSecondaryAuthentication Device", + "AllowExternalDevice Signon", + "=*-* -*", + "AZAAg AC", + "BrowserCollect or", + "FaCdd xmtMoX", + "JyxVQS k", + "lukebag gett", + "mVsSV WrmgDP", + "snaps hots", + "Ġ726564 63616", + "Ġyyy y", + "Ġ'(?< =\"", + "NetEventPacketCapture Provider", + "pYyBSZWQg VGVhbSI", + "ATOMICREDT EAM", + "HJZe hgs", + "IiAtdm FsdWUg", + "MacroSheet s", + "Macadem iaNut", + "QgLX BhdGggIi", + "RURn pJS", + "RtlCreate UserThread", + "SKzg ryizoopBPg", + "SKIPCERT CHECK", + "SimonTath am", + "Workbook s", + "\\/]*\\ //--/", + "Ġanonymo usly", + "ĠUseActionCenter Experience", + "errorreporting faults", + "SetupInf ObjectInstallAction", + "obfuskit tiedump", + "bGxvIGZ yb", + "IGZvciBDcmV hdGluZ", + "AEwAaQB zAHQAIABuAG", + "AEAAQBhX tvkSe", + "BlbmV yKG", + "CnBz ID", + "CCLCSWRPWPDT LOCRRC", + "IsNullOr WhiteSpace", + "TGJk bix", + "VyLU FnZW", + "WtXb LKqD", + "dzrGn y", + "nchanget ype", + "pvqFCYy iJAailslxOw", + "pubpr n", + "pOwphPXVybGxpYjI udXJsb", + "qxQo LR", + "vyvZ uHNmAy", + "wMDQucm MuY", + "wpbKl pGIflS", + "}}]} }'", + "ĠScreenSaver IsSecure", + "Ġlockoutobservation window", + "ĠPortableVBox DRV", + "Ġshutdownwit houtlogon", + "AaQBNAGU AdABoAG", + "SimulateLater alMovement", + "ĠAllowMult ipleTSSessions", + "ĠAllowEncryption Oracle", + "WhiteChocolate MacademiaNut", + "WhiteOak Security", + "):\\/\\/ [", + ")\\\"}| {", + "=='));\\\\ \\\"", + "AQQByAG cAdQBtAGUA", + "BitsTrans fer", + "CbOsx SensorService", + "DNSExfiltr ator", + "FuUnhrd mszST", + "ISNU MBER", + "Ikhl bGxvIGZyb", + "KVLJdH phY", + "LsGy Fokoy", + "RhbdWH p", + "SGFuZGxlcig pOwpvID", + "Snaff ler", + "UIDYu MTsgV", + "UsoClientDLL System", + "aXQoKQppb XBvcnQgdXJsbGliM", + "czssnTe Gvy", + "cztpbXBvcnQg cmUsIHN", + "generaldomain info", + "hAHQAZQAg AC", + "jAHIAZQB hAHQAZQAgAC", + "jZXNzLlBJ UEUpCm", + "jZXNzLnBocC c", + "kuyuqow ve", + "mhGXihUQJ QPNk", + "nfHLL icweJ", + "tYXJrZXI udHh", + "wRvkWi ZRerjmDde", + "ĠAppleShow AllFiles", + "ĠDEFEND ER", + "ĠmySecret Password", + "NoAutoReboot WithLoggedOnUsers", + "cmVxPXVybGxpYjI uUmVxdWVzd", + "MailboxAuditBypass Association", + "SmbMapp ing", + "ĠAutoShareWk s", + "Blbihj bWQsIHNoZW", + "BlbihyZXEs dGltZW", + "EtwpCreate EtwThread", + "RpZnlpbmcgcmMub G", + "yZWFkKCkKcHMu c", + "IGdyZXAi CnBzID", + "IGdyZXAgTG l", + "/[^-][^ \\/]*\\//--/", + "/-/|/' &&", + "5344661034 40", + "80450396 2", + "AAcgBvAG MAZQBzAH", + "AYQBtAGUAIAB jAHIAZQBhAHQAZQAgAC", + "BQYMtZ AS", + "BDXqwE foZZ", + "BwIAAAA kAABSU", + "DonaldTru mp", + "EyAAQAA AEAAQBhXtvkSe", + "FPPng EmNz", + "Favorite s", + "FbdgpBE q", + "GWzVAgSZaGV CFpuk", + "GGSxPGih T", + "Hypervis orEnforcedCode", + "JSVjQIdPT XZbF", + "KToKIC Agc", + "KpyYw V", + "LUNvbnRlbn QgLXBhdGggIi", + "MvRHl DY", + "MimiPeng uin", + "NtQue ueApcThreadEx", + "NiccXnb HJZehgs", + "OhujBHD m", + "PKzIiTu FfcP", + "QZhAJ Bnn", + "RQJqWS Gk", + "SesUz KVLJdHphY", + "TkKjXEo WulXNliBpe", + "VhcmNoKC JMaXR", + "WKQHIHj kzG", + "XHwtkRVM LBsp", + "besimorh ino", + "dYiSUUsk lSedRLjh", + "gatherNetwork Info", + "gKsymmhd kTGsXc", + "iKTsKcHJveHk gPSB", + "jNwhkWr Ba", + "kTRlIH mowdbd", + "lglOefcacy YEHPX", + "lIxsdRekhNZ jNwhkWrBa", + "mirrorbl ast", + "nWHMoMY V", + "pdGNoIi wgb", + "qeEuvy V", + "tufnEeDMAQjm Lku", + "tkZLVMuMuf mn", + "vZGlmaWNhdGlvb icpCg", + "wKSBsaWtlIE dlY", + "wOyBydj oxMS", + "zbIrJFfmtYn j", + "Ġignoreallfailure s", + "stQtTmLxdhZbOs NDJpsqnzwE", + "etQECfkCRven kTRlIHmowdbd", + "vemlsbGEv NS", + "GetAllTrustRelation ships", + "ypwmFZaNmt L", + "ĠfSingleSessionPer User", + "LMNOPQRST UVWXYZ", + "AdABlAHAAYQB kAC", + "lsSJyuICplrCTP GGSxPGihT", + "DisableRemoteDesktopAnti Alias", + "DisableAttachements InPV", + "UnifiedAuditLogIngestion Enabled", + "ĠSQBuAHYAbwBrAGUAL QBXAG", + "ATHRemoteFXvGP UDisablementCommand", + "vcGVuZXIocHJveHk pOwp", + "ABCDEFGHIJK LMNOPQRSTUVWXYZ", + "IFRyaWRlbn QvNy", + "AUABhAHQAaAAg AHcAaQBuADMAMgBfAH", + ";[^/]*/;|__ ;", + "tbLZUefrFnLNiHfVj Ni", + "mVsSVWrmgDP KHGGRx", + "IiAtdmFsdWUg IkhlbGxvIGZyb", + "IGZvciBDcmVhdGluZ yBTeXN", + "AQQByAGcAdQBtAGUA bgB", + "aXQoKQppbXBvcnQgdXJsbGliM jsKVUE", + "wRvkWiZRerjmDde hJIboWsx", + "cmVxPXVybGxpYjIuUmVxdWVzd ChzZXJ", + "BlbihjbWQsIHNoZW xsPVRydWUsIHN", + "AAcgBvAGMAZQBzAH MAIAAtAE", + "EyAAQAAAEAAQBhXtvkSe H", + "HypervisorEnforcedCode Integrity", + "LUNvbnRlbnQgLXBhdGggIi RlbnY", + "TkKjXEoWulXNliBpe lsSJyuICplrCTPGGSxPGihT", + "gKsymmhdkTGsXc DXir", + "stQtTmLxdhZbOsNDJpsqnzwE UfL", + "AUABhAHQAaAAgAHcAaQBuADMAMgBfAH AAcgBvAGMAZQBzAHMAIAAtAE" + ] + } +} \ No newline at end of file