(Image:\\goldenPac* OR Image:\\karmaSMB* OR Image:\\kintercept* OR Image:\\ntlmrelayx* OR Image:\\rpcdump* OR Image:\\samrdump* OR Image:\\secretsdump* OR Image:\\smbexec* OR Image:\\smbrelayx* OR Image:\\wmiexec* OR Image:\\wmipersist*) OR (Image:\\atexec_windows.exe OR Image:\\dcomexec_windows.exe OR Image:\\dpapi_windows.exe OR Image:\\findDelegation_windows.exe OR Image:\\GetADUsers_windows.exe OR Image:\\GetNPUsers_windows.exe OR Image:\\getPac_windows.exe OR Image:\\getST_windows.exe OR Image:\\getTGT_windows.exe OR Image:\\GetUserSPNs_windows.exe OR Image:\\ifmap_windows.exe OR Image:\\mimikatz_windows.exe OR Image:\\netview_windows.exe OR Image:\\nmapAnswerMachine_windows.exe OR Image:\\opdump_windows.exe OR Image:\\psexec_windows.exe OR Image:\\rdp_check_windows.exe OR Image:\\sambaPipe_windows.exe OR Image:\\smbclient_windows.exe OR Image:\\smbserver_windows.exe OR Image:\\sniff_windows.exe OR Image:\\sniffer_windows.exe OR Image:\\split_windows.exe OR Image:\\ticketer_windows.exe)