← Back to SOC feed Coverage →

Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4

sigma HIGH SigmaHQ
imProcessCreate
evasion
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at SigmaHQ →
Retrieved: 2026-05-21T11:00:00Z · Confidence: medium

Hunt Hypothesis

Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Detection Rule

Sigma (Original)

title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4
id: 225274c4-8dd1-40db-9e09-71dff4f6fb3c
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
    - Internal Research
tags:
    - attack.stealth
date: 2022-12-05
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '๐Ÿ”ธ'
            - '๐Ÿ”น'
            - '๐Ÿ”ถ'
            - '๐Ÿ”ท'
            - '๐Ÿ”ณ'
            - '๐Ÿ”ฒ'
            - 'โ–ช๏ธ'
            - 'โ–ซ๏ธ'
            - 'โ—พ๏ธ'
            - 'โ—ฝ๏ธ'
            - 'โ—ผ๏ธ'
            - 'โ—ป๏ธ'
            - '๐ŸŸฅ'
            - '๐ŸŸง'
            - '๐ŸŸจ'
            - '๐ŸŸฉ'
            - '๐ŸŸฆ'
            - '๐ŸŸช'
            - 'โฌ›๏ธ'
            - 'โฌœ๏ธ'
            - '๐ŸŸซ'
            - '๐Ÿ”ˆ'
            - '๐Ÿ”‡'
            - '๐Ÿ”‰'
            - '๐Ÿ”Š'
            - '๐Ÿ””'
            - '๐Ÿ”•'
            - '๐Ÿ“ฃ'
            - '๐Ÿ“ข'
            - '๐Ÿ‘โ€๐Ÿ—จ'
            - '๐Ÿ’ฌ'
            - '๐Ÿ’ญ'
            - '๐Ÿ—ฏ'
            - 'โ™ ๏ธ'
            - 'โ™ฃ๏ธ'
            - 'โ™ฅ๏ธ'
            - 'โ™ฆ๏ธ'
            - '๐Ÿƒ'
            - '๐ŸŽด'
            - '๐Ÿ€„๏ธ'
            - '๐Ÿ•'
            - '๐Ÿ•‘'
            - '๐Ÿ•’'
            - '๐Ÿ•“'
            - '๐Ÿ•”'
            - '๐Ÿ••'
            - '๐Ÿ•–'
            - '๐Ÿ•—'
            - '๐Ÿ•˜'
            - '๐Ÿ•™'
            - '๐Ÿ•š'
            - '๐Ÿ•›'
            - '๐Ÿ•œ'
            - '๐Ÿ•'
            - '๐Ÿ•ž'
            - '๐Ÿ•Ÿ'
            - '๐Ÿ• '
            - '๐Ÿ•ก'
            - '๐Ÿ•ข'
            - '๐Ÿ•ฃ'
            - '๐Ÿ•ค'
            - '๐Ÿ•ฅ'
            - '๐Ÿ•ฆ'
            - '๐Ÿ•งโœข'
            - 'โœฃ'
            - 'โœค'
            - 'โœฅ'
            - 'โœฆ'
            - 'โœง'
            - 'โ˜…'
            - 'โ˜†'
            - 'โœฏ'
            - 'โœก๏ธŽ'
            - 'โœฉ'
            - 'โœช'
            - 'โœซ'
            - 'โœฌ'
            - 'โœญ'
            - 'โœฎ'
            - 'โœถ'
            - 'โœท'
            - 'โœต'
            - 'โœธ'
            - 'โœน'
            - 'โ†’'
            - 'โ‡’'
            - 'โŸน'
            - 'โ‡จ'
            - 'โ‡พ'
            - 'โžพ'
            - 'โ‡ข'
            - 'โ˜›'
            - 'โ˜ž'
            - 'โž”'
            - 'โžœ'
            - 'โž™'
            - 'โž›'
            - 'โž'
            - 'โžž'
            - 'โ™ ๏ธŽ'
            - 'โ™ฃ๏ธŽ'
            - 'โ™ฅ๏ธŽ'
            - 'โ™ฆ๏ธŽ'
            - 'โ™ค'
            - 'โ™ง'
            - 'โ™ก'
            - 'โ™ข'
            - 'โ™š'
            - 'โ™›'
            - 'โ™œ'
            - 'โ™'
            - 'โ™ž'
            - 'โ™Ÿ'
            - 'โ™”'
            - 'โ™•'
            - 'โ™–'
            - 'โ™—'
            - 'โ™˜'
            - 'โ™™'
            - 'โš€'
            - 'โš'
            - 'โš‚'
            - 'โšƒ'
            - 'โš„'
            - 'โš…'
            - '๐Ÿ‚ '
            - 'โšˆ'
            - 'โš‰'
            - 'โš†'
            - 'โš‡'
            - '๐“€€'
            - '๐“€'
            - '๐“€‚'
            - '๐“€ƒ'
            - '๐“€„'
            - '๐“€…'
            - '๐“€†'
            - '๐“€‡'
            - '๐“€ˆ'
            - '๐“€‰'
            - '๐“€Š'
            - '๐“€‹'
            - '๐“€Œ'
            - '๐“€'
            - '๐“€Ž'
            - '๐“€'
            - '๐“€'
            - '๐“€‘'
            - '๐“€’'
            - '๐“€“'
            - '๐“€”'
            - '๐“€•'
            - '๐“€–'
            - '๐“€—'
            - '๐“€˜'
            - '๐“€™'
            - '๐“€š'
            - '๐“€›'
            - '๐“€œ'
            - '๐“€๐Ÿณ๏ธ'
            - '๐Ÿด'
            - '๐Ÿ'
            - '๐Ÿšฉ'
            - '๐Ÿณ๏ธโ€๐ŸŒˆ'
            - '๐Ÿณ๏ธโ€โšง๏ธ'
            - '๐Ÿดโ€โ˜ ๏ธ'
            - '๐Ÿ‡ฆ๐Ÿ‡ซ'
            - '๐Ÿ‡ฆ๐Ÿ‡ฝ'
            - '๐Ÿ‡ฆ๐Ÿ‡ฑ'
            - '๐Ÿ‡ฉ๐Ÿ‡ฟ'
            - '๐Ÿ‡ฆ๐Ÿ‡ธ'
            - '๐Ÿ‡ฆ๐Ÿ‡ฉ'
            - '๐Ÿ‡ฆ๐Ÿ‡ด'
            - '๐Ÿ‡ฆ๐Ÿ‡ฎ'
            - '๐Ÿ‡ฆ๐Ÿ‡ถ'
            - '๐Ÿ‡ฆ๐Ÿ‡ฌ'
            - '๐Ÿ‡ฆ๐Ÿ‡ท'
            - '๐Ÿ‡ฆ๐Ÿ‡ฒ'
            - '๐Ÿ‡ฆ๐Ÿ‡ผ'
            - '๐Ÿ‡ฆ๐Ÿ‡บ'
            - '๐Ÿ‡ฆ๐Ÿ‡น'
            - '๐Ÿ‡ฆ๐Ÿ‡ฟ'
            - '๐Ÿ‡ง๐Ÿ‡ธ'
            - '๐Ÿ‡ง๐Ÿ‡ญ'
            - '๐Ÿ‡ง๐Ÿ‡ฉ'
            - '๐Ÿ‡ง๐Ÿ‡ง'
            - '๐Ÿ‡ง๐Ÿ‡พ'
            - '๐Ÿ‡ง๐Ÿ‡ช'
            - '๐Ÿ‡ง๐Ÿ‡ฟ'
            - '๐Ÿ‡ง๐Ÿ‡ฏ'
            - '๐Ÿ‡ง๐Ÿ‡ฒ'
            - '๐Ÿ‡ง๐Ÿ‡น'
            - '๐Ÿ‡ง๐Ÿ‡ด'
            - '๐Ÿ‡ง๐Ÿ‡ฆ'
            - '๐Ÿ‡ง๐Ÿ‡ผ'
            - '๐Ÿ‡ง๐Ÿ‡ท'
            - '๐Ÿ‡ฎ๐Ÿ‡ด'
            - '๐Ÿ‡ป๐Ÿ‡ฌ'
            - '๐Ÿ‡ง๐Ÿ‡ณ'
            - '๐Ÿ‡ง๐Ÿ‡ฌ'
            - '๐Ÿ‡ง๐Ÿ‡ซ'
            - '๐Ÿ‡ง๐Ÿ‡ฎ'
            - '๐Ÿ‡ฐ๐Ÿ‡ญ'
            - '๐Ÿ‡จ๐Ÿ‡ฒ'
            - '๐Ÿ‡จ๐Ÿ‡ฆ'
            - '๐Ÿ‡ฎ๐Ÿ‡จ'
            - '๐Ÿ‡จ๐Ÿ‡ป'
            - '๐Ÿ‡ง๐Ÿ‡ถ'
            - '๐Ÿ‡ฐ๐Ÿ‡พ'
            - '๐Ÿ‡จ๐Ÿ‡ซ'
            - '๐Ÿ‡น๐Ÿ‡ฉ'
            - '๐Ÿ‡จ๐Ÿ‡ฑ'
            - '๐Ÿ‡จ๐Ÿ‡ณ'
            - '๐Ÿ‡จ๐Ÿ‡ฝ'
            - '๐Ÿ‡จ๐Ÿ‡จ'
            - '๐Ÿ‡จ๐Ÿ‡ด'
            - '๐Ÿ‡ฐ๐Ÿ‡ฒ'
            - '๐Ÿ‡จ๐Ÿ‡ฌ'
            - '๐Ÿ‡จ๐Ÿ‡ฉ'
            - '๐Ÿ‡จ๐Ÿ‡ฐ'
            - '๐Ÿ‡จ๐Ÿ‡ท'
            - '๐Ÿ‡จ๐Ÿ‡ฎ'
            - '๐Ÿ‡ญ๐Ÿ‡ท'
            - '๐Ÿ‡จ๐Ÿ‡บ'
            - '๐Ÿ‡จ๐Ÿ‡ผ'
            - '๐Ÿ‡จ๐Ÿ‡พ'
            - '๐Ÿ‡จ๐Ÿ‡ฟ'
            - '๐Ÿ‡ฉ๐Ÿ‡ฐ'
            - '๐Ÿ‡ฉ๐Ÿ‡ฏ'
            - '๐Ÿ‡ฉ๐Ÿ‡ฒ'
            - '๐Ÿ‡ฉ๐Ÿ‡ด'
            - '๐Ÿ‡ช๐Ÿ‡จ'
            - '๐Ÿ‡ช๐Ÿ‡ฌ'
            - '๐Ÿ‡ธ๐Ÿ‡ป'
            - '๐Ÿ‡ฌ๐Ÿ‡ถ'
            - '๐Ÿ‡ช๐Ÿ‡ท'
            - '๐Ÿ‡ช๐Ÿ‡ช'
            - '๐Ÿ‡ช๐Ÿ‡น'
            - '๐Ÿ‡ช๐Ÿ‡บ'
            - '๐Ÿ‡ซ๐Ÿ‡ฐ'
            - '๐Ÿ‡ซ๐Ÿ‡ด'
            - '๐Ÿ‡ซ๐Ÿ‡ฏ'
            - '๐Ÿ‡ซ๐Ÿ‡ฎ'
            - '๐Ÿ‡ซ๐Ÿ‡ท'
            - '๐Ÿ‡ฌ๐Ÿ‡ซ'
            - '๐Ÿ‡ต๐Ÿ‡ซ'
            - '๐Ÿ‡น๐Ÿ‡ซ'
            - '๐Ÿ‡ฌ๐Ÿ‡ฆ'
            - '๐Ÿ‡ฌ๐Ÿ‡ฒ'
            - '๐Ÿ‡ฌ๐Ÿ‡ช'
            - '๐Ÿ‡ฉ๐Ÿ‡ช'
            - '๐Ÿ‡ฌ๐Ÿ‡ญ'
            - '๐Ÿ‡ฌ๐Ÿ‡ฎ'
            - '๐Ÿ‡ฌ๐Ÿ‡ท'
            - '๐Ÿ‡ฌ๐Ÿ‡ฑ'
            - '๐Ÿ‡ฌ๐Ÿ‡ฉ'
            - '๐Ÿ‡ฌ๐Ÿ‡ต'
            - '๐Ÿ‡ฌ๐Ÿ‡บ'
            - '๐Ÿ‡ฌ๐Ÿ‡น'
            - '๐Ÿ‡ฌ๐Ÿ‡ฌ'
            - '๐Ÿ‡ฌ๐Ÿ‡ณ'
            - '๐Ÿ‡ฌ๐Ÿ‡ผ'
            - '๐Ÿ‡ฌ๐Ÿ‡พ'
            - '๐Ÿ‡ญ๐Ÿ‡น'
            - '๐Ÿ‡ญ๐Ÿ‡ณ'
            - '๐Ÿ‡ญ๐Ÿ‡ฐ'
            - '๐Ÿ‡ญ๐Ÿ‡บ'
            - '๐Ÿ‡ฎ๐Ÿ‡ธ'
            - '๐Ÿ‡ฎ๐Ÿ‡ณ'
            - '๐Ÿ‡ฎ๐Ÿ‡ฉ'
            - '๐Ÿ‡ฎ๐Ÿ‡ท'
            - '๐Ÿ‡ฎ๐Ÿ‡ถ'
            - '๐Ÿ‡ฎ๐Ÿ‡ช'
            - '๐Ÿ‡ฎ๐Ÿ‡ฒ'
            - '๐Ÿ‡ฎ๐Ÿ‡ฑ'
            - '๐Ÿ‡ฎ๐Ÿ‡น'
            - '๐Ÿ‡ฏ๐Ÿ‡ฒ'
            - '๐Ÿ‡ฏ๐Ÿ‡ต'
            - '๐ŸŽŒ'
            - '๐Ÿ‡ฏ๐Ÿ‡ช'
            - '๐Ÿ‡ฏ๐Ÿ‡ด'
            - '๐Ÿ‡ฐ๐Ÿ‡ฟ'
            - '๐Ÿ‡ฐ๐Ÿ‡ช'
            - '๐Ÿ‡ฐ๐Ÿ‡ฎ'
            - '๐Ÿ‡ฝ๐Ÿ‡ฐ'
            - '๐Ÿ‡ฐ๐Ÿ‡ผ'
            - '๐Ÿ‡ฐ๐Ÿ‡ฌ'
            - '๐Ÿ‡ฑ๐Ÿ‡ฆ'
            - '๐Ÿ‡ฑ๐Ÿ‡ป'
            - '๐Ÿ‡ฑ๐Ÿ‡ง'
            - '๐Ÿ‡ฑ๐Ÿ‡ธ'
            - '๐Ÿ‡ฑ๐Ÿ‡ท'
            - '๐Ÿ‡ฑ๐Ÿ‡พ'
            - '๐Ÿ‡ฑ๐Ÿ‡ฎ'
            - '๐Ÿ‡ฑ๐Ÿ‡น'
            - '๐Ÿ‡ฑ๐Ÿ‡บ'
            - '๐Ÿ‡ฒ๐Ÿ‡ด'
            - '๐Ÿ‡ฒ๐Ÿ‡ฐ'
            - '๐Ÿ‡ฒ๐Ÿ‡ฌ'
            - '๐Ÿ‡ฒ๐Ÿ‡ผ'
            - '๐Ÿ‡ฒ๐Ÿ‡พ'
            - '๐Ÿ‡ฒ๐Ÿ‡ป'
            - '๐Ÿ‡ฒ๐Ÿ‡ฑ'
            - '๐Ÿ‡ฒ๐Ÿ‡น'
            - '๐Ÿ‡ฒ๐Ÿ‡ญ'
            - '๐Ÿ‡ฒ๐Ÿ‡ถ'
            - '๐Ÿ‡ฒ๐Ÿ‡ท'
            - '๐Ÿ‡ฒ๐Ÿ‡บ'
            - '๐Ÿ‡พ๐Ÿ‡น'
            - '๐Ÿ‡ฒ๐Ÿ‡ฝ'
            - '๐Ÿ‡ซ๐Ÿ‡ฒ'
            - '๐Ÿ‡ฒ๐Ÿ‡ฉ'
            - '๐Ÿ‡ฒ๐Ÿ‡จ'
            - '๐Ÿ‡ฒ๐Ÿ‡ณ'
            - '๐Ÿ‡ฒ๐Ÿ‡ช'
            - '๐Ÿ‡ฒ๐Ÿ‡ธ'
            - '๐Ÿ‡ฒ๐Ÿ‡ฆ'
            - '๐Ÿ‡ฒ๐Ÿ‡ฟ'
            - '๐Ÿ‡ฒ๐Ÿ‡ฒ'
            - '๐Ÿ‡ณ๐Ÿ‡ฆ'
            - '๐Ÿ‡ณ๐Ÿ‡ท'
            - '๐Ÿ‡ณ๐Ÿ‡ต'
            - '๐Ÿ‡ณ๐Ÿ‡ฑ'
            - '๐Ÿ‡ณ๐Ÿ‡จ'
            - '๐Ÿ‡ณ๐Ÿ‡ฟ'
            - '๐Ÿ‡ณ๐Ÿ‡ฎ'
            - '๐Ÿ‡ณ๐Ÿ‡ช'
            - '๐Ÿ‡ณ๐Ÿ‡ฌ'
            - '๐Ÿ‡ณ๐Ÿ‡บ'
            - '๐Ÿ‡ณ๐Ÿ‡ซ'
            - '๐Ÿ‡ฐ๐Ÿ‡ต'
            - '๐Ÿ‡ฒ๐Ÿ‡ต'
            - '๐Ÿ‡ณ๐Ÿ‡ด'
            - '๐Ÿ‡ด๐Ÿ‡ฒ'
            - '๐Ÿ‡ต๐Ÿ‡ฐ'
            - '๐Ÿ‡ต๐Ÿ‡ผ'
            - '๐Ÿ‡ต๐Ÿ‡ธ'
            - '๐Ÿ‡ต๐Ÿ‡ฆ'
            - '๐Ÿ‡ต๐Ÿ‡ฌ'
            - '๐Ÿ‡ต๐Ÿ‡พ'
            - '๐Ÿ‡ต๐Ÿ‡ช'
            - '๐Ÿ‡ต๐Ÿ‡ญ'
            - '๐Ÿ‡ต๐Ÿ‡ณ'
            - '๐Ÿ‡ต๐Ÿ‡ฑ'
            - '๐Ÿ‡ต๐Ÿ‡น'
            - '๐Ÿ‡ต๐Ÿ‡ท'
            - '๐Ÿ‡ถ๐Ÿ‡ฆ'
            - '๐Ÿ‡ท๐Ÿ‡ช'
            - '๐Ÿ‡ท๐Ÿ‡ด'
            - '๐Ÿ‡ท๐Ÿ‡บ'
            - '๐Ÿ‡ท๐Ÿ‡ผ'
            - '๐Ÿ‡ผ๐Ÿ‡ธ'
            - '๐Ÿ‡ธ๐Ÿ‡ฒ'
            - '๐Ÿ‡ธ๐Ÿ‡ฆ'
            - '๐Ÿ‡ธ๐Ÿ‡ณ'
            - '๐Ÿ‡ท๐Ÿ‡ธ'
            - '๐Ÿ‡ธ๐Ÿ‡จ'
            - '๐Ÿ‡ธ๐Ÿ‡ฑ'
            - '๐Ÿ‡ธ๐Ÿ‡ฌ'
            - '๐Ÿ‡ธ๐Ÿ‡ฝ'
            - '๐Ÿ‡ธ๐Ÿ‡ฐ'
            - '๐Ÿ‡ธ๐Ÿ‡ฎ'
            - '๐Ÿ‡ฌ๐Ÿ‡ธ'
            - '๐Ÿ‡ธ๐Ÿ‡ง'
            - '๐Ÿ‡ธ๐Ÿ‡ด'
            - '๐Ÿ‡ฟ๐Ÿ‡ฆ'
            - '๐Ÿ‡ฐ๐Ÿ‡ท'
            - '๐Ÿ‡ธ๐Ÿ‡ธ'
            - '๐Ÿ‡ช๐Ÿ‡ธ'
            - '๐Ÿ‡ฑ๐Ÿ‡ฐ'
            - '๐Ÿ‡ง๐Ÿ‡ฑ'
            - '๐Ÿ‡ธ๐Ÿ‡ญ'
            - '๐Ÿ‡ฐ๐Ÿ‡ณ'
            - '๐Ÿ‡ฑ๐Ÿ‡จ'
            - '๐Ÿ‡ต๐Ÿ‡ฒ'
            - '๐Ÿ‡ป๐Ÿ‡จ'
            - '๐Ÿ‡ธ๐Ÿ‡ฉ'
            - '๐Ÿ‡ธ๐Ÿ‡ท'
            - '๐Ÿ‡ธ๐Ÿ‡ฟ'
            - '๐Ÿ‡ธ๐Ÿ‡ช'
            - '๐Ÿ‡จ๐Ÿ‡ญ'
            - '๐Ÿ‡ธ๐Ÿ‡พ'
            - '๐Ÿ‡น๐Ÿ‡ผ'
            - '๐Ÿ‡น๐Ÿ‡ฏ'
            - '๐Ÿ‡น๐Ÿ‡ฟ'
            - '๐Ÿ‡น๐Ÿ‡ญ'
            - '๐Ÿ‡น๐Ÿ‡ฑ'
            - '๐Ÿ‡น๐Ÿ‡ฌ'
            - '๐Ÿ‡น๐Ÿ‡ฐ'
            - '๐Ÿ‡น๐Ÿ‡ด'
            - '๐Ÿ‡น๐Ÿ‡น'
            - '๐Ÿ‡น๐Ÿ‡ณ'
            - '๐Ÿ‡น๐Ÿ‡ท'
            - '๐Ÿ‡น๐Ÿ‡ฒ'
            - '๐Ÿ‡น๐Ÿ‡จ'
            - '๐Ÿ‡น๐Ÿ‡ป'
            - '๐Ÿ‡ป๐Ÿ‡ฎ'
            - '๐Ÿ‡บ๐Ÿ‡ฌ'
            - '๐Ÿ‡บ๐Ÿ‡ฆ'
            - '๐Ÿ‡ฆ๐Ÿ‡ช'
            - '๐Ÿ‡ฌ๐Ÿ‡ง'
            - '๐Ÿด๓ ง๓ ข๓ ฅ๓ ฎ๓ ง๓ ฟ'
            - '๐Ÿด๓ ง๓ ข๓ ณ๓ ฃ๓ ด๓ ฟ'
            - '๐Ÿด๓ ง๓ ข๓ ท๓ ฌ๓ ณ๓ ฟ'
            - '๐Ÿ‡บ๐Ÿ‡ณ'
            - '๐Ÿ‡บ๐Ÿ‡ธ'
            - '๐Ÿ‡บ๐Ÿ‡พ'
            - '๐Ÿ‡บ๐Ÿ‡ฟ'
            - '๐Ÿ‡ป๐Ÿ‡บ'
            - '๐Ÿ‡ป๐Ÿ‡ฆ'
            - '๐Ÿ‡ป๐Ÿ‡ช'
            - '๐Ÿ‡ป๐Ÿ‡ณ'
            - '๐Ÿ‡ผ๐Ÿ‡ซ'
            - '๐Ÿ‡ช๐Ÿ‡ญ'
            - '๐Ÿ‡พ๐Ÿ‡ช'
            - '๐Ÿ‡ฟ๐Ÿ‡ฒ'
            - '๐Ÿ‡ฟ๐Ÿ‡ผ๐Ÿซ '
            - '๐Ÿซข'
            - '๐Ÿซฃ'
            - '๐Ÿซก'
            - '๐Ÿซฅ'
            - '๐Ÿซค'
            - '๐Ÿฅน'
            - '๐Ÿซฑ'
            - '๐Ÿซฑ๐Ÿป'
            - '๐Ÿซฑ๐Ÿผ'
            - '๐Ÿซฑ๐Ÿฝ'
            - '๐Ÿซฑ๐Ÿพ'
            - '๐Ÿซฑ๐Ÿฟ'
            - '๐Ÿซฒ'
            - '๐Ÿซฒ๐Ÿป'
            - '๐Ÿซฒ๐Ÿผ'
            - '๐Ÿซฒ๐Ÿฝ'
            - '๐Ÿซฒ๐Ÿพ'
            - '๐Ÿซฒ๐Ÿฟ'
            - '๐Ÿซณ'
            - '๐Ÿซณ๐Ÿป'
            - '๐Ÿซณ๐Ÿผ'
            - '๐Ÿซณ๐Ÿฝ'
            - '๐Ÿซณ๐Ÿพ'
            - '๐Ÿซณ๐Ÿฟ'
            - '๐Ÿซด'
            - '๐Ÿซด๐Ÿป'
            - '๐Ÿซด๐Ÿผ'
            - '๐Ÿซด๐Ÿฝ'
            - '๐Ÿซด๐Ÿพ'
            - '๐Ÿซด๐Ÿฟ'
            - '๐Ÿซฐ'
            - '๐Ÿซฐ๐Ÿป'
            - '๐Ÿซฐ๐Ÿผ'
            - '๐Ÿซฐ๐Ÿฝ'
            - '๐Ÿซฐ๐Ÿพ'
            - '๐Ÿซฐ๐Ÿฟ'
            - '๐Ÿซต'
            - '๐Ÿซต๐Ÿป'
            - '๐Ÿซต๐Ÿผ'
            - '๐Ÿซต๐Ÿฝ'
            - '๐Ÿซต๐Ÿพ'
            - '๐Ÿซต๐Ÿฟ'
            - '๐Ÿซถ'
            - '๐Ÿซถ๐Ÿป'
            - '๐Ÿซถ๐Ÿผ'
            - '๐Ÿซถ๐Ÿฝ'
            - '๐Ÿซถ๐Ÿพ'
            - '๐Ÿซถ๐Ÿฟ'
            - '๐Ÿค๐Ÿป'
            - '๐Ÿค๐Ÿผ'
            - '๐Ÿค๐Ÿฝ'
            - '๐Ÿค๐Ÿพ'
            - '๐Ÿค๐Ÿฟ'
            - '๐Ÿซฑ๐Ÿปโ€๐Ÿซฒ๐Ÿผ'
            - '๐Ÿซฑ๐Ÿปโ€๐Ÿซฒ๐Ÿฝ'
            - '๐Ÿซฑ๐Ÿปโ€๐Ÿซฒ๐Ÿพ'
            - '๐Ÿซฑ๐Ÿปโ€๐Ÿซฒ๐Ÿฟ'
            - '๐Ÿซฑ๐Ÿผโ€๐Ÿซฒ๐Ÿป'
            - '๐Ÿซฑ๐Ÿผโ€๐Ÿซฒ๐Ÿฝ'
            - '๐Ÿซฑ๐Ÿผโ€๐Ÿซฒ๐Ÿพ'
            - '๐Ÿซฑ๐Ÿผโ€๐Ÿซฒ๐Ÿฟ'
            - '๐Ÿซฑ๐Ÿฝโ€๐Ÿซฒ๐Ÿป'
            - '๐Ÿซฑ๐Ÿฝโ€๐Ÿซฒ๐Ÿผ'
            - '๐Ÿซฑ๐Ÿฝโ€๐Ÿซฒ๐Ÿพ'
            - '๐Ÿซฑ๐Ÿฝโ€๐Ÿซฒ๐Ÿฟ'
            - '๐Ÿซฑ๐Ÿพโ€๐Ÿซฒ๐Ÿป'
            - '๐Ÿซฑ๐Ÿพโ€๐Ÿซฒ๐Ÿผ'
            - '๐Ÿซฑ๐Ÿพโ€๐Ÿซฒ๐Ÿฝ'
            - '๐Ÿซฑ๐Ÿพโ€๐Ÿซฒ๐Ÿฟ'
            - '๐Ÿซฑ๐Ÿฟโ€๐Ÿซฒ๐Ÿป'
            - '๐Ÿซฑ๐Ÿฟโ€๐Ÿซฒ๐Ÿผ'
            - '๐Ÿซฑ๐Ÿฟโ€๐Ÿซฒ๐Ÿฝ'
            - '๐Ÿซฑ๐Ÿฟโ€๐Ÿซฒ๐Ÿพ'
            - '๐Ÿซฆ'
            - '๐Ÿซ…'
            - '๐Ÿซ…๐Ÿป'
            - '๐Ÿซ…๐Ÿผ'
            - '๐Ÿซ…๐Ÿฝ'
            - '๐Ÿซ…๐Ÿพ'
            - '๐Ÿซ…๐Ÿฟ'
            - '๐Ÿซƒ'
            - '๐Ÿซƒ๐Ÿป'
            - '๐Ÿซƒ๐Ÿผ'
            - '๐Ÿซƒ๐Ÿฝ'
            - '๐Ÿซƒ๐Ÿพ'
            - '๐Ÿซƒ๐Ÿฟ'
            - '๐Ÿซ„'
            - '๐Ÿซ„๐Ÿป'
            - '๐Ÿซ„๐Ÿผ'
            - '๐Ÿซ„๐Ÿฝ'
            - '๐Ÿซ„๐Ÿพ'
            - '๐Ÿซ„๐Ÿฟ'
            - '๐ŸงŒ'
            - '๐Ÿชธ'
            - '๐Ÿชท'
            - '๐Ÿชน'
            - '๐Ÿชบ'
            - '๐Ÿซ˜'
            - '๐Ÿซ—'
            - '๐Ÿซ™'
            - '๐Ÿ›'
            - '๐Ÿ›ž'
            - '๐Ÿ›Ÿ'
            - '๐Ÿชฌ'
            - '๐Ÿชฉ'
            - '๐Ÿชซ'
            - '๐Ÿฉผ'
            - '๐Ÿฉป'
            - '๐Ÿซง'
            - '๐Ÿชช'
            - '๐ŸŸฐ'
            - '๐Ÿ˜ฎโ€๐Ÿ’จ'
            - '๐Ÿ˜ตโ€๐Ÿ’ซ'
            - '๐Ÿ˜ถโ€๐ŸŒซ๏ธ'
            - 'โค๏ธโ€๐Ÿ”ฅ'
            - 'โค๏ธโ€๐Ÿฉน'
            - '๐Ÿง”โ€โ™€๏ธ'
            - '๐Ÿง”๐Ÿปโ€โ™€๏ธ'
            - '๐Ÿง”๐Ÿผโ€โ™€๏ธ'
            - '๐Ÿง”๐Ÿฝโ€โ™€๏ธ'
            - '๐Ÿง”๐Ÿพโ€โ™€๏ธ'
            - '๐Ÿง”๐Ÿฟโ€โ™€๏ธ'
            - '๐Ÿง”โ€โ™‚๏ธ'
            - '๐Ÿง”๐Ÿปโ€โ™‚๏ธ'
            - '๐Ÿง”๐Ÿผโ€โ™‚๏ธ'
            - '๐Ÿง”๐Ÿฝโ€โ™‚๏ธ'
            - '๐Ÿง”๐Ÿพโ€โ™‚๏ธ'
            - '๐Ÿง”๐Ÿฟโ€โ™‚๏ธ'
            - '๐Ÿ’‘๐Ÿป'
            - '๐Ÿ’‘๐Ÿผ'
            - '๐Ÿ’‘๐Ÿฝ'
            - '๐Ÿ’‘๐Ÿพ'
            - '๐Ÿ’‘๐Ÿฟ'
            - '๐Ÿ’๐Ÿป'
            - '๐Ÿ’๐Ÿผ'
            - '๐Ÿ’๐Ÿฝ'
            - '๐Ÿ’๐Ÿพ'
            - '๐Ÿ’๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿง‘๐Ÿผ'
            - '๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿง‘๐Ÿฝ'
            - '๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿง‘๐Ÿพ'
            - '๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿง‘๐Ÿฟ'
            - '๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿง‘๐Ÿป'
            - '๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿง‘๐Ÿฝ'
            - '๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿง‘๐Ÿพ'
            - '๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿง‘๐Ÿฟ'
            - '๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿง‘๐Ÿป'
            - '๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿง‘๐Ÿผ'
            - '๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿง‘๐Ÿพ'
            - '๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿง‘๐Ÿฟ'
            - '๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿง‘๐Ÿป'
            - '๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿง‘๐Ÿผ'
            - '๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿง‘๐Ÿฝ'
            - '๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿง‘๐Ÿฟ'
            - '๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿง‘๐Ÿป'
            - '๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿง‘๐Ÿผ'
            - '๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿง‘๐Ÿฝ'
            - '๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿง‘๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ'
            - '๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ'
            - '๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿผ'
            - '๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฝ'
            - '๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿพ'
            - '๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฟ'
            - '๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿป'
            - '๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฝ'
            - '๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿพ'
            - '๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฟ'
            - '๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿป'
            - '๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿผ'
            - '๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿพ'
            - '๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฟ'
            - '๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿป'
            - '๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿผ'
            - '๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฝ'
            - '๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฟ'
            - '๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿป'
            - '๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿผ'
            - '๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฝ'
            - '๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿพ'
    condition: selection
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessCommandLine contains "๐Ÿ”ธ" or TargetProcessCommandLine contains "๐Ÿ”น" or TargetProcessCommandLine contains "๐Ÿ”ถ" or TargetProcessCommandLine contains "๐Ÿ”ท" or TargetProcessCommandLine contains "๐Ÿ”ณ" or TargetProcessCommandLine contains "๐Ÿ”ฒ" or TargetProcessCommandLine contains "โ–ช๏ธ" or TargetProcessCommandLine contains "โ–ซ๏ธ" or TargetProcessCommandLine contains "โ—พ๏ธ" or TargetProcessCommandLine contains "โ—ฝ๏ธ" or TargetProcessCommandLine contains "โ—ผ๏ธ" or TargetProcessCommandLine contains "โ—ป๏ธ" or TargetProcessCommandLine contains "๐ŸŸฅ" or TargetProcessCommandLine contains "๐ŸŸง" or TargetProcessCommandLine contains "๐ŸŸจ" or TargetProcessCommandLine contains "๐ŸŸฉ" or TargetProcessCommandLine contains "๐ŸŸฆ" or TargetProcessCommandLine contains "๐ŸŸช" or TargetProcessCommandLine contains "โฌ›๏ธ" or TargetProcessCommandLine contains "โฌœ๏ธ" or TargetProcessCommandLine contains "๐ŸŸซ" or TargetProcessCommandLine contains "๐Ÿ”ˆ" or TargetProcessCommandLine contains "๐Ÿ”‡" or TargetProcessCommandLine contains "๐Ÿ”‰" or TargetProcessCommandLine contains "๐Ÿ”Š" or TargetProcessCommandLine contains "๐Ÿ””" or TargetProcessCommandLine contains "๐Ÿ”•" or TargetProcessCommandLine contains "๐Ÿ“ฃ" or TargetProcessCommandLine contains "๐Ÿ“ข" or TargetProcessCommandLine contains "๐Ÿ‘โ€๐Ÿ—จ" or TargetProcessCommandLine contains "๐Ÿ’ฌ" or TargetProcessCommandLine contains "๐Ÿ’ญ" or TargetProcessCommandLine contains "๐Ÿ—ฏ" or TargetProcessCommandLine contains "โ™ ๏ธ" or TargetProcessCommandLine contains "โ™ฃ๏ธ" or TargetProcessCommandLine contains "โ™ฅ๏ธ" or TargetProcessCommandLine contains "โ™ฆ๏ธ" or TargetProcessCommandLine contains "๐Ÿƒ" or TargetProcessCommandLine contains "๐ŸŽด" or TargetProcessCommandLine contains "๐Ÿ€„๏ธ" or TargetProcessCommandLine contains "๐Ÿ•" or TargetProcessCommandLine contains "๐Ÿ•‘" or TargetProcessCommandLine contains "๐Ÿ•’" or TargetProcessCommandLine contains "๐Ÿ•“" or TargetProcessCommandLine contains "๐Ÿ•”" or TargetProcessCommandLine contains "๐Ÿ••" or TargetProcessCommandLine contains "๐Ÿ•–" or TargetProcessCommandLine contains "๐Ÿ•—" or TargetProcessCommandLine contains "๐Ÿ•˜" or TargetProcessCommandLine contains "๐Ÿ•™" or TargetProcessCommandLine contains "๐Ÿ•š" or TargetProcessCommandLine contains "๐Ÿ•›" or TargetProcessCommandLine contains "๐Ÿ•œ" or TargetProcessCommandLine contains "๐Ÿ•" or TargetProcessCommandLine contains "๐Ÿ•ž" or TargetProcessCommandLine contains "๐Ÿ•Ÿ" or TargetProcessCommandLine contains "๐Ÿ• " or TargetProcessCommandLine contains "๐Ÿ•ก" or TargetProcessCommandLine contains "๐Ÿ•ข" or TargetProcessCommandLine contains "๐Ÿ•ฃ" or TargetProcessCommandLine contains "๐Ÿ•ค" or TargetProcessCommandLine contains "๐Ÿ•ฅ" or TargetProcessCommandLine contains "๐Ÿ•ฆ" or TargetProcessCommandLine contains "๐Ÿ•งโœข" or TargetProcessCommandLine contains "โœฃ" or TargetProcessCommandLine contains "โœค" or TargetProcessCommandLine contains "โœฅ" or TargetProcessCommandLine contains "โœฆ" or TargetProcessCommandLine contains "โœง" or TargetProcessCommandLine contains "โ˜…" or TargetProcessCommandLine contains "โ˜†" or TargetProcessCommandLine contains "โœฏ" or TargetProcessCommandLine contains "โœก๏ธŽ" or TargetProcessCommandLine contains "โœฉ" or TargetProcessCommandLine contains "โœช" or TargetProcessCommandLine contains "โœซ" or TargetProcessCommandLine contains "โœฌ" or TargetProcessCommandLine contains "โœญ" or TargetProcessCommandLine contains "โœฎ" or TargetProcessCommandLine contains "โœถ" or TargetProcessCommandLine contains "โœท" or TargetProcessCommandLine contains "โœต" or TargetProcessCommandLine contains "โœธ" or TargetProcessCommandLine contains "โœน" or TargetProcessCommandLine contains "โ†’" or TargetProcessCommandLine contains "โ‡’" or TargetProcessCommandLine contains "โŸน" or TargetProcessCommandLine contains "โ‡จ" or TargetProcessCommandLine contains "โ‡พ" or TargetProcessCommandLine contains "โžพ" or TargetProcessCommandLine contains "โ‡ข" or TargetProcessCommandLine contains "โ˜›" or TargetProcessCommandLine contains "โ˜ž" or TargetProcessCommandLine contains "โž”" or TargetProcessCommandLine contains "โžœ" or TargetProcessCommandLine contains "โž™" or TargetProcessCommandLine contains "โž›" or TargetProcessCommandLine contains "โž" or TargetProcessCommandLine contains "โžž" or TargetProcessCommandLine contains "โ™ ๏ธŽ" or TargetProcessCommandLine contains "โ™ฃ๏ธŽ" or TargetProcessCommandLine contains "โ™ฅ๏ธŽ" or TargetProcessCommandLine contains "โ™ฆ๏ธŽ" or TargetProcessCommandLine contains "โ™ค" or TargetProcessCommandLine contains "โ™ง" or TargetProcessCommandLine contains "โ™ก" or TargetProcessCommandLine contains "โ™ข" or TargetProcessCommandLine contains "โ™š" or TargetProcessCommandLine contains "โ™›" or TargetProcessCommandLine contains "โ™œ" or TargetProcessCommandLine contains "โ™" or TargetProcessCommandLine contains "โ™ž" or TargetProcessCommandLine contains "โ™Ÿ" or TargetProcessCommandLine contains "โ™”" or TargetProcessCommandLine contains "โ™•" or TargetProcessCommandLine contains "โ™–" or TargetProcessCommandLine contains "โ™—" or TargetProcessCommandLine contains "โ™˜" or TargetProcessCommandLine contains "โ™™" or TargetProcessCommandLine contains "โš€" or TargetProcessCommandLine contains "โš" or TargetProcessCommandLine contains "โš‚" or TargetProcessCommandLine contains "โšƒ" or TargetProcessCommandLine contains "โš„" or TargetProcessCommandLine contains "โš…" or TargetProcessCommandLine contains "๐Ÿ‚ " or TargetProcessCommandLine contains "โšˆ" or TargetProcessCommandLine contains "โš‰" or TargetProcessCommandLine contains "โš†" or TargetProcessCommandLine contains "โš‡" or TargetProcessCommandLine contains "๐“€€" or TargetProcessCommandLine contains "๐“€" or TargetProcessCommandLine contains "๐“€‚" or TargetProcessCommandLine contains "๐“€ƒ" or TargetProcessCommandLine contains "๐“€„" or TargetProcessCommandLine contains "๐“€…" or TargetProcessCommandLine contains "๐“€†" or TargetProcessCommandLine contains "๐“€‡" or TargetProcessCommandLine contains "๐“€ˆ" or TargetProcessCommandLine contains "๐“€‰" or TargetProcessCommandLine contains "๐“€Š" or TargetProcessCommandLine contains "๐“€‹" or TargetProcessCommandLine contains "๐“€Œ" or TargetProcessCommandLine contains "๐“€" or TargetProcessCommandLine contains "๐“€Ž" or TargetProcessCommandLine contains "๐“€" or TargetProcessCommandLine contains "๐“€" or TargetProcessCommandLine contains "๐“€‘" or TargetProcessCommandLine contains "๐“€’" or TargetProcessCommandLine contains "๐“€“" or TargetProcessCommandLine contains "๐“€”" or TargetProcessCommandLine contains "๐“€•" or TargetProcessCommandLine contains "๐“€–" or TargetProcessCommandLine contains "๐“€—" or TargetProcessCommandLine contains "๐“€˜" or TargetProcessCommandLine contains "๐“€™" or TargetProcessCommandLine contains "๐“€š" or TargetProcessCommandLine contains "๐“€›" or TargetProcessCommandLine contains "๐“€œ" or TargetProcessCommandLine contains "๐“€๐Ÿณ๏ธ" or TargetProcessCommandLine contains "๐Ÿด" or TargetProcessCommandLine contains "๐Ÿ" or TargetProcessCommandLine contains "๐Ÿšฉ" or TargetProcessCommandLine contains "๐Ÿณ๏ธโ€๐ŸŒˆ" or TargetProcessCommandLine contains "๐Ÿณ๏ธโ€โšง๏ธ" or TargetProcessCommandLine contains "๐Ÿดโ€โ˜ ๏ธ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ซ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ฝ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡ฉ๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ฉ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ถ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ฉ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ง" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ฏ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ป๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ซ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ป" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ถ" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ซ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ฉ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฝ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฉ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ญ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ฉ๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡ฉ๐Ÿ‡ฏ" or TargetProcessCommandLine contains "๐Ÿ‡ฉ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ฉ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ช๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡ช๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ป" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ถ" or TargetProcessCommandLine contains "๐Ÿ‡ช๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ช๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ช๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ช๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡ซ๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡ซ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ซ๐Ÿ‡ฏ" or TargetProcessCommandLine contains "๐Ÿ‡ซ๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ซ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ซ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ซ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ซ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ฉ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ฉ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ต" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡ญ๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ญ๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ญ๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡ญ๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ฉ" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ถ" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡ฎ๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ฏ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ฏ๐Ÿ‡ต" or TargetProcessCommandLine contains "๐ŸŽŒ" or TargetProcessCommandLine contains "๐Ÿ‡ฏ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ฏ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ฝ๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡ป" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡ง" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ป" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ถ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡พ๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ฝ" or TargetProcessCommandLine contains "๐Ÿ‡ซ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ฉ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ต" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ซ" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ต" or TargetProcessCommandLine contains "๐Ÿ‡ฒ๐Ÿ‡ต" or TargetProcessCommandLine contains "๐Ÿ‡ณ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ด๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ถ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ท๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ท๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ท๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡ท๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡ผ๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ท๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฝ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ง" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡ฟ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ช๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡ง๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡ฐ๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ฑ๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡ต๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ป๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฉ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡จ๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡ธ๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ผ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ฏ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ฑ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ฐ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ด" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡น" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ท" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡จ" or TargetProcessCommandLine contains "๐Ÿ‡น๐Ÿ‡ป" or TargetProcessCommandLine contains "๐Ÿ‡ป๐Ÿ‡ฎ" or TargetProcessCommandLine contains "๐Ÿ‡บ๐Ÿ‡ฌ" or TargetProcessCommandLine contains "๐Ÿ‡บ๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ฆ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ฌ๐Ÿ‡ง" or TargetProcessCommandLine contains "๐Ÿด๓ ง๓ ข๓ ฅ๓ ฎ๓ ง๓ ฟ" or TargetProcessCommandLine contains "๐Ÿด๓ ง๓ ข๓ ณ๓ ฃ๓ ด๓ ฟ" or TargetProcessCommandLine contains "๐Ÿด๓ ง๓ ข๓ ท๓ ฌ๓ ณ๓ ฟ" or TargetProcessCommandLine contains "๐Ÿ‡บ๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡บ๐Ÿ‡ธ" or TargetProcessCommandLine contains "๐Ÿ‡บ๐Ÿ‡พ" or TargetProcessCommandLine contains "๐Ÿ‡บ๐Ÿ‡ฟ" or TargetProcessCommandLine contains "๐Ÿ‡ป๐Ÿ‡บ" or TargetProcessCommandLine contains "๐Ÿ‡ป๐Ÿ‡ฆ" or TargetProcessCommandLine contains "๐Ÿ‡ป๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ป๐Ÿ‡ณ" or TargetProcessCommandLine contains "๐Ÿ‡ผ๐Ÿ‡ซ" or TargetProcessCommandLine contains "๐Ÿ‡ช๐Ÿ‡ญ" or TargetProcessCommandLine contains "๐Ÿ‡พ๐Ÿ‡ช" or TargetProcessCommandLine contains "๐Ÿ‡ฟ๐Ÿ‡ฒ" or TargetProcessCommandLine contains "๐Ÿ‡ฟ๐Ÿ‡ผ๐Ÿซ " or TargetProcessCommandLine contains "๐Ÿซข" or TargetProcessCommandLine contains "๐Ÿซฃ" or TargetProcessCommandLine contains "๐Ÿซก" or TargetProcessCommandLine contains "๐Ÿซฅ" or TargetProcessCommandLine contains "๐Ÿซค" or TargetProcessCommandLine contains "๐Ÿฅน" or TargetProcessCommandLine contains "๐Ÿซฑ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซฒ" or TargetProcessCommandLine contains "๐Ÿซฒ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซฒ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซฒ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซฒ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซฒ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซณ" or TargetProcessCommandLine contains "๐Ÿซณ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซณ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซณ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซณ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซณ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซด" or TargetProcessCommandLine contains "๐Ÿซด๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซด๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซด๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซด๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซด๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซฐ" or TargetProcessCommandLine contains "๐Ÿซฐ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซฐ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซฐ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซฐ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซฐ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซต" or TargetProcessCommandLine contains "๐Ÿซต๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซต๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซต๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซต๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซต๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซถ" or TargetProcessCommandLine contains "๐Ÿซถ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซถ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซถ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซถ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซถ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿค๐Ÿป" or TargetProcessCommandLine contains "๐Ÿค๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿค๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿค๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿค๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿปโ€๐Ÿซฒ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿปโ€๐Ÿซฒ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿปโ€๐Ÿซฒ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿปโ€๐Ÿซฒ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿผโ€๐Ÿซฒ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿผโ€๐Ÿซฒ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿผโ€๐Ÿซฒ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿผโ€๐Ÿซฒ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฝโ€๐Ÿซฒ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฝโ€๐Ÿซฒ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฝโ€๐Ÿซฒ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฝโ€๐Ÿซฒ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿพโ€๐Ÿซฒ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿพโ€๐Ÿซฒ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿพโ€๐Ÿซฒ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿพโ€๐Ÿซฒ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฟโ€๐Ÿซฒ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฟโ€๐Ÿซฒ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฟโ€๐Ÿซฒ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซฑ๐Ÿฟโ€๐Ÿซฒ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซฆ" or TargetProcessCommandLine contains "๐Ÿซ…" or TargetProcessCommandLine contains "๐Ÿซ…๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซ…๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซ…๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซ…๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซ…๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซƒ" or TargetProcessCommandLine contains "๐Ÿซƒ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซƒ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซƒ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซƒ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซƒ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿซ„" or TargetProcessCommandLine contains "๐Ÿซ„๐Ÿป" or TargetProcessCommandLine contains "๐Ÿซ„๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿซ„๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿซ„๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿซ„๐Ÿฟ" or TargetProcessCommandLine contains "๐ŸงŒ" or TargetProcessCommandLine contains "๐Ÿชธ" or TargetProcessCommandLine contains "๐Ÿชท" or TargetProcessCommandLine contains "๐Ÿชน" or TargetProcessCommandLine contains "๐Ÿชบ" or TargetProcessCommandLine contains "๐Ÿซ˜" or TargetProcessCommandLine contains "๐Ÿซ—" or TargetProcessCommandLine contains "๐Ÿซ™" or TargetProcessCommandLine contains "๐Ÿ›" or TargetProcessCommandLine contains "๐Ÿ›ž" or TargetProcessCommandLine contains "๐Ÿ›Ÿ" or TargetProcessCommandLine contains "๐Ÿชฌ" or TargetProcessCommandLine contains "๐Ÿชฉ" or TargetProcessCommandLine contains "๐Ÿชซ" or TargetProcessCommandLine contains "๐Ÿฉผ" or TargetProcessCommandLine contains "๐Ÿฉป" or TargetProcessCommandLine contains "๐Ÿซง" or TargetProcessCommandLine contains "๐Ÿชช" or TargetProcessCommandLine contains "๐ŸŸฐ" or TargetProcessCommandLine contains "๐Ÿ˜ฎโ€๐Ÿ’จ" or TargetProcessCommandLine contains "๐Ÿ˜ตโ€๐Ÿ’ซ" or TargetProcessCommandLine contains "๐Ÿ˜ถโ€๐ŸŒซ๏ธ" or TargetProcessCommandLine contains "โค๏ธโ€๐Ÿ”ฅ" or TargetProcessCommandLine contains "โค๏ธโ€๐Ÿฉน" or TargetProcessCommandLine contains "๐Ÿง”โ€โ™€๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿปโ€โ™€๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿผโ€โ™€๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿฝโ€โ™€๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿพโ€โ™€๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿฟโ€โ™€๏ธ" or TargetProcessCommandLine contains "๐Ÿง”โ€โ™‚๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿปโ€โ™‚๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿผโ€โ™‚๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿฝโ€โ™‚๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿพโ€โ™‚๏ธ" or TargetProcessCommandLine contains "๐Ÿง”๐Ÿฟโ€โ™‚๏ธ" or TargetProcessCommandLine contains "๐Ÿ’‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ’‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ’‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ’‘๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ’‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ’๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ’๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ’๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ’๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ’๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿง‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿง‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿง‘๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿง‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿง‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿง‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿง‘๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿง‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿง‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿง‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿง‘๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿง‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿง‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿง‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿง‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿง‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿง‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿง‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿง‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿง‘๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘จ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘จ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿป" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿ‘ฉ๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿ‘ฉ๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿปโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿผโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿพ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฝโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿพโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฟ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿป" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿผ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿฝ" or TargetProcessCommandLine contains "๐Ÿง‘๐Ÿฟโ€โค๏ธโ€๐Ÿ’‹โ€๐Ÿง‘๐Ÿพ"

Required Data Sources

Sentinel TableNotes
imProcessCreateEnsure this data connector is enabled

False Positive Guidance

References

Original source: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_4.yml