To bruteforce like this, wouldn't you need every possible application installed on the computer?

If the payload is a zero day for an obscure Iranian made piece of software, no one will ever get that