(SourceImage:\\Akagi.exe OR SourceImage:\\Akagi64.exe OR SourceImage:\\atexec_windows.exe OR SourceImage:\\Certify.exe OR SourceImage:\\Certipy.exe OR SourceImage:\\CoercedPotato.exe OR SourceImage:\\crackmapexec.exe OR SourceImage:\\CreateMiniDump.exe OR SourceImage:\\dcomexec_windows.exe OR SourceImage:\\dpapi_windows.exe OR SourceImage:\\findDelegation_windows.exe OR SourceImage:\\GetADUsers_windows.exe OR SourceImage:\\GetNPUsers_windows.exe OR SourceImage:\\getPac_windows.exe OR SourceImage:\\getST_windows.exe OR SourceImage:\\getTGT_windows.exe OR SourceImage:\\GetUserSPNs_windows.exe OR SourceImage:\\gmer.exe OR SourceImage:\\hashcat.exe OR SourceImage:\\htran.exe OR SourceImage:\\ifmap_windows.exe OR SourceImage:\\impersonate.exe OR SourceImage:\\Inveigh.exe OR SourceImage:\\LocalPotato.exe OR SourceImage:\\mimikatz_windows.exe OR SourceImage:\\mimikatz.exe OR SourceImage:\\netview_windows.exe OR SourceImage:\\nmapAnswerMachine_windows.exe OR SourceImage:\\opdump_windows.exe OR SourceImage:\\PasswordDump.exe OR SourceImage:\\Potato.exe OR SourceImage:\\PowerTool.exe OR SourceImage:\\PowerTool64.exe OR SourceImage:\\psexec_windows.exe OR SourceImage:\\PurpleSharp.exe OR SourceImage:\\pypykatz.exe OR SourceImage:\\QuarksPwDump.exe OR SourceImage:\\rdp_check_windows.exe OR SourceImage:\\Rubeus.exe OR SourceImage:\\SafetyKatz.exe OR SourceImage:\\sambaPipe_windows.exe OR SourceImage:\\SelectMyParent.exe OR SourceImage:\\SharpChisel.exe OR SourceImage:\\SharPersist.exe OR SourceImage:\\SharpEvtMute.exe OR SourceImage:\\SharpImpersonation.exe OR SourceImage:\\SharpLDAPmonitor.exe OR SourceImage:\\SharpLdapWhoami.exe OR SourceImage:\\SharpUp.exe OR SourceImage:\\SharpView.exe OR SourceImage:\\smbclient_windows.exe OR SourceImage:\\smbserver_windows.exe OR SourceImage:\\sniff_windows.exe OR SourceImage:\\sniffer_windows.exe OR SourceImage:\\split_windows.exe OR SourceImage:\\SpoolSample.exe OR SourceImage:\\Stracciatella.exe OR SourceImage:\\SysmonEOP.exe OR SourceImage:\\temp\\rot.exe OR SourceImage:\\ticketer_windows.exe OR SourceImage:\\TruffleSnout.exe OR SourceImage:\\winPEASany_ofs.exe OR SourceImage:\\winPEASany.exe OR SourceImage:\\winPEASx64_ofs.exe OR SourceImage:\\winPEASx64.exe OR SourceImage:\\winPEASx86_ofs.exe OR SourceImage:\\winPEASx86.exe OR SourceImage:\\xordump.exe) OR (SourceImage:\\goldenPac* OR SourceImage:\\just_dce_* OR SourceImage:\\karmaSMB* OR SourceImage:\\kintercept* OR SourceImage:\\LocalPotato* OR SourceImage:\\ntlmrelayx* OR SourceImage:\\rpcdump* OR SourceImage:\\samrdump* OR SourceImage:\\secretsdump* OR SourceImage:\\smbexec* OR SourceImage:\\smbrelayx* OR SourceImage:\\wmiexec* OR SourceImage:\\wmipersist* OR SourceImage:HotPotato* OR SourceImage:Juicy\ Potato* OR SourceImage:JuicyPotato* OR SourceImage:PetitPotam* OR SourceImage:RottenPotato*)